Skip to content

Update dependency msgpack to v1.2.1 - #11

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/msgpack-1.x
Open

mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/msgpack-1.x

Conversation

@mend-for-github-com

@mend-for-github-com mend-for-github-com Bot commented Aug 26, 2026 •

Copy link
Copy Markdown

This PR contains the following updates:

Package Update Change
msgpack (changelog) minor ==1.0.0 → ==1.2.1

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score Vulnerability
High High 7.5 CVE-2026-57585

Release Notes

msgpack/msgpack-python (msgpack)

v1.2.1

Compare Source

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure.
But note that reusing the same Unpacker instance after an unpacking failure is not supported.
Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

v1.2.0

Compare Source

Release Date: 2026-06-11

  • Support free threaded Python. #​654, #​686
  • Dropped support for Python 3.9. #​656
  • Fix missing error checks in C code. #​665, #​666, #​667, #​672
  • Fix strict_map_key option didn't work for object_pairs_hook. #​673
  • Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #​676
  • Fix memory leak when Unpacker returns error for invalid input. #​671
  • Fix Packer.pack_ext_type() ignored autoreset option. #​663
  • Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #​662
  • Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #​677
  • Fix possible memory leak when calling Unpacker.__init__() several times. #​687

v1.1.2

Compare Source

Release Date: 2025-10-08

This release does not change source code. It updates only building
wheels:

  • Update Cython to v3.1.4
  • Update cibuildwheel to v3.2.0
  • Drop Python 3.8
  • Add Python 3.14
  • Add windows-arm

v1.1.1

Compare Source

Release Date: 2025-06-13

  • No change from 1.1.1rc1.

v1.1.0

Compare Source

Release Date: 2024-09-10

  • use PyLong_* instead of PyInt_* for compatibility with future
    Cython. (#​620)

v1.0.8

Compare Source

Release Date: 2024-03-01

  • Update Cython to 3.0.8. This fixes memory leak when iterating
    Unpacker object on Python 3.12.
  • Do not include C/Cython files in binary wheels.

v1.0.7

Compare Source

Release Date: 2023-09-28

  • Fix build error of extension module on Windows. (#​567)
  • setup.py doesn't skip build error of extension module. (#​568)

v1.0.6

Compare Source

Release Date: 2023-09-21

[!NOTE]
v1.0.6 Wheels for Windows don't contain extension module. Please
upgrade to v1.0.7 or newer.

  • Add Python 3.12 wheels (#​517)
  • Remove Python 2.7, 3.6, and 3.7 support

v1.0.5

Compare Source

Release Date: 2023-03-08

  • Use __BYTE_ORDER__ instead of __BYTE_ORDER for portability. (#​513,
    #​514)
  • Add Python 3.11 wheels (#​517)
  • fallback: Fix packing multidimensional memoryview (#​527)

v1.0.4

Compare Source

Release Date: 2022-06-03

v1.0.3

Compare Source

Release Date: 2021-11-24 JST

  • Fix Docstring (#​459)
  • Fix error formatting (#​463)
  • Improve error message about strict_map_key (#​485)

v1.0.2

Compare Source

  • Fix year 2038 problem regression in 1.0.1. (#​451)

v1.0.1

Compare Source

  • Add Python 3.9 and linux/arm64 wheels. (#​439)
  • Fixed Unpacker.tell() after read_bytes() (#​426)
  • Fixed unpacking datetime before epoch on Windows (#​433)
  • Fixed fallback Packer didn't check DateTime.tzinfo (#​434)

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com Bot added the security fix Security fix generated by Mend label Aug 26, 2026
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/msgpack-1.x branch from 97b6825 to 86d6aaa Compare October 24, 2026 13:45
@mend-for-github-com mend-for-github-com Bot changed the title Update dependency msgpack to v1.2.1 Update dependency msgpack to v1.2.3 Oct 24, 2026
@mend-for-github-com
mend-for-github-com Bot force-pushed the whitesource-remediate/msgpack-1.x branch from 86d6aaa to 6a57b43 Compare October 28, 2026 02:59
@mend-for-github-com mend-for-github-com Bot changed the title Update dependency msgpack to v1.2.3 Update dependency msgpack to v1.2.1 Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants