Skip to content

Bump the ci-constraints group across 1 directory with 29 updates - #73

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ci/ci-constraints-c5050928f4
Open

Bump the ci-constraints group across 1 directory with 29 updates#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ci/ci-constraints-c5050928f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the ci-constraints group with 29 updates in the /ci directory:

Package From To
tomli 2.4.1 2.5.0
certifi 2026.7.22 2026.10.23
charset-normalizer 3.4.9 3.5.2
cyclonedx-python-lib 11.11.0 11.12.0
filelock 3.32.2 4.1.0
idna 3.18 3.20
msgpack 1.2.1 1.2.4
pip 26.2.1 26.2.2
pip-api 0.0.34 0.0.35
platformdirs 4.11.0 4.12.4
pygments 2.20.0 2.21.0
pyparsing 3.3.2 3.3.3
urllib3 2.7.0 2.8.0
coverage 7.15.4 7.16.2
iniconfig 2.3.0 2.3.1
pluggy 1.6.0 1.7.0
pytest 9.1.1 9.2.0
setuptools 83.0.0 84.2.1
wheel 0.47.0 0.48.0
domdf-python-tools 3.10.0 3.11.0
flake8 7.3.0 7.4.1
flake8-bugbear 25.11.29 26.10.27
pycodestyle 2.14.0 2.15.0
pyflakes 3.4.0 4.0.3
imagesize 2.0.0 2.0.1
markupsafe 3.0.3 3.0.4
soupsieve 2.9.2 2.10
sphinxcontrib-jsmath 1.0.1 2.0.0
webencodings 0.5.1 0.6.1

Updates tomli from 2.4.1 to 2.5.0

Changelog

Sourced from tomli's changelog.

2.5.0

  • Added
    • Binary wheels for Python 3.15
  • Fixed
    • Set nested inline array/table limit to 400 to fix mypyc generated binaries crashing unrecoverably in constrained environments (e.g. worker thread in a python:3.13-alpine image)

2.3.1

  • Fixed
    • Backport: Limit number of parts of a TOML key to address quadratic time complexity
Commits
  • a2a5789 Bump version: 2.4.1 → 2.5.0
  • 94a6081 Add 2.5.0 changelog
  • 85f8748 Update README.md
  • 70fd460 Allow flit_core v4
  • 00d0610 Update pre-commit
  • eb93c12 Improve tomllib compatibility and sync docs (#299)
  • 18d8d59 Bump cibuildwheel for Python 3.15 wheels (#317)
  • 1e6e869 Set smaller MAX_INLINE_NESTING to avoid python:3.13-alpine worker thread crash
  • c329998 Use Trusted Publishing
  • ba611c5 Add zizmor security scanner to pre-commit (#301)
  • Additional commits viewable in compare view

Updates certifi from 2026.7.22 to 2026.10.23

Commits

Updates charset-normalizer from 3.4.9 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Version 3.5.1

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Commits
  • 935c29a Release 3.5.2 (#805)
  • 9d3238a test: disable traefik in downstream niquests
  • b4c0368 docs: write changelog entry for 3.5.2
  • 717da31 chore: bump version to 3.5.2
  • 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
  • 41e28b6 chore: raise Cython upper bound to 3.3
  • b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
  • f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
  • e239bdc Merge pull request #795 from jawah/release-3.5.1
  • 648ad77 docs: update faq
  • Additional commits viewable in compare view

Updates cyclonedx-python-lib from 11.11.0 to 11.12.0

Release notes

Sourced from cyclonedx-python-lib's releases.

v11.12.0 (2026-08-13)

Features

  • Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

What's Changed

New Contributors

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.2...v11.12.0

v11.11.2 (2026-08-12)

Bug Fixes

What's Changed

New Contributors

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.1...v11.11.2

v11.11.1 (2026-08-10)

Bug Fixes

What's Changed

... (truncated)

Changelog

Sourced from cyclonedx-python-lib's changelog.

v11.12.0 (2026-08-13)

Features

  • Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

v11.11.2 (2026-08-12)

Bug Fixes

v11.11.1 (2026-08-10)

Bug Fixes

Commits
  • 52cb3c9 chore(release): 11.12.0
  • 6993dea feat: add isExternal property to Component for CycloneDX v1.7 (#959)
  • 27b2d43 tests: add Python 3.14 to tox tests (#1029)
  • a092c49 chore(release): 11.11.2
  • 17a0136 fix: encode paths when loading XML schemas (#1028)
  • 8edee5c chore(release): 11.11.1
  • 7b5350c chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#1026)
  • 72e4e4c chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#1027)
  • d718ac2 fix: ComparablePackageURL includes name (#1022)
  • cb1a4e2 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1019)
  • Additional commits viewable in compare view

Updates filelock from 3.32.2 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

Features

  • Import OwnerMode, CompromiseReason and has_fcntl from filelock. #790 by @​gaborbernat.
  • AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. #803 by @​gaborbernat.
  • A Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. #815 by @​gaborbernat.
  • Every option given in seconds takes a Decimal or Fraction, as a file lock's timeout already did, and a read-write lock or lease refuses a bool or string one. #815 by @​gaborbernat.

Bug fixes

  • is_lock_held_by_us and is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. #774 by @​lprnmns.
  • SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. #775 by @​harbinresearcher.
  • acquire and acquire no longer wait past timeout when poll_interval is longer than the time left. #777 by @​feiiiiii5.
  • SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. #778 by @​dxbjavid.
  • ReadWriteLock, SoftReadWriteLock and their async wrappers treat a inf timeout like -1 and raise ValueError for a blocking nan one. #779 by @​darrenhuai.
  • ReadWriteLock and SoftReadWriteLock accept a timeout above TIMEOUT_MAX instead of raising OverflowError. #780 by @​darrenhuai.
  • acquire raises ValueError for a blocking nan timeout or a poll_interval above TIMEOUT_MAX, and treats a inf timeout like -1. #781 by @​gaborbernat.
  • SoftFileLock and MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. #782 by @​gaborbernat.
  • UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises FileNotFoundError instead of retrying. #785 by @​gaborbernat.
  • SoftFileLock and SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. #786 by @​gaborbernat.
  • StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that landed as published, and no longer reports is_locked after a failed claim cleanup. #787 by @​gaborbernat.
  • On Python 3.10 without the exceptiongroup backport, a release failure under the default context_error_policy no longer turns into ModuleNotFoundError; cleanup failures chain instead of grouping, and on_acquired is allowed. #788 by @​gaborbernat.
  • AsyncReadWriteLock and AsyncSoftReadWriteLock drop a task's hold when a caller cancels it during a release that still completes, instead of blocking every later writer. #789 by @​gaborbernat.
  • SoftFileLease releases a lease dropped while held, at garbage collection or interpreter exit, and raises ValueError for a heartbeat_interval above TIMEOUT_MAX. #791 by @​gaborbernat.
  • StrictSoftFileLock judges an abandoned private record's age by the filesystem's clock, so a client clock ahead of an NFS server no longer aborts live publications. #792 by @​gaborbernat.
  • BaseAsyncFileLock raises RuntimeError instead of CancelledError when its executor shuts down with the call still queued, and a waiter interrupted by anything else no longer wedges later calls. #793 by @​gaborbernat.
  • Constructing or closing a second ReadWriteLock on a held database no longer drops the holder's lock, so other processes stay excluded. #794 by @​gaborbernat.
  • SoftReadWriteLock no longer admits a second writer after <path>.rw is removed under a live instance, and flushes each snapshot before publishing it so a crash cannot leave an empty one that wedges every peer. #795 by @​gaborbernat.
  • SoftFileLease reclaims a dead MarkerSoftFileLock owner, and expires a lease or a malformed soft marker after it stays unchanged on the contender's own monotonic clock, so clock skew cannot break it. #796 by @​gaborbernat.
  • A soft lock marker written in a Linux container records its PID namespace with the hostname, so a sibling container that shares the hostname and volume no longer breaks a live lock. #797 by @​gaborbernat.
  • SoftReadWriteLock.close() makes an acquire still waiting in another thread raise RuntimeError, where it used to take the lock on the closed instance and hold it until the process exited. #798 by @​gaborbernat.
  • SoftReadWriteLock reads the head from gen/HEAD, so a client whose cached directory listing is more than 64 generations stale no longer takes an old generation for the head and forks the log. #799 by @​gaborbernat.
  • When the garbage collector finalizes a held BaseAsyncFileLock, it releases on a loop running in another thread, or in place once no loop is left; the lifetime check and path resolution now run in the executor. #800 by @​gaborbernat.
  • SoftReadWriteLock waits out a holder's own stale_threshold before evicting it, keys its singleton on the path its log sits beside, and no longer leaks ledger entries or the holder record of a failed acquire. #801 by @​gaborbernat.
  • lock_descriptor raises ValueError for a blocking poll_interval above TIMEOUT_MAX up front, instead of OverflowError once the descriptor is contended. #802 by @​sricharanreddycheruku.
  • BaseFileLock rejects a bool or string timeout, an out-of-range mode and a non-bool blocking set at any time, rejects unknown options on a singleton cache hit, and tracks an on_acquired reacquire. #803 by @​gaborbernat.
  • StrictSoftFileLock raises SoftFileLockProtocolError naming a directory, symlink or exited soft-lock owner's marker at the lock path, and lock_path_occupant shows what blocks it. #804 by @​gaborbernat.
  • ReadWriteLock raises ValueError for a WAL-mode database instead of disk I/O error, and its /dev/fd fallback links beside the database, so a lock off the TMPDIR filesystem no longer fails with EXDEV. #805 by @​gaborbernat.
  • ReadWriteLock.release() from a thread that holds no read level raises RuntimeError instead of ending another thread's read lock and letting a writer in. #806 by @​gaborbernat.
  • SoftFileLockLifetimeWarning derives from FutureWarning instead of DeprecationWarning, so Python shows it by default outside __main__. #807 by @​gaborbernat.
  • SoftFileLock applies an explicit mode past the umask as UnixFileLock does, and reads a marker number spelled other than in ASCII digits, or a lease with an empty token, as malformed. #807 by @​gaborbernat.
  • ReadWriteLock raises OSError when its database is unlinked or replaced while an acquisition waits, instead of taking a lock that no later opener sees. #808 by @​gaborbernat.
  • On a thread-local synchronous lock, release with force=True and garbage collection release holds exited threads left, and a release() re-entered from a signal handler closes the descriptor once. #810 by @​gaborbernat.
  • SoftFileLease records a lease_duration given as a float subclass, such as NumPy's, in a form every contender parses, so a live lease is no longer evicted as malformed. #815 by @​gaborbernat.
  • StrictSoftFileLock raises SoftFileLockProtocolError for a file at the lock path it cannot parse once it stays unchanged for two seconds, instead of waiting on it forever. #815 by @​gaborbernat.
  • A lock finalized at interpreter exit no longer hangs when a daemon thread stopped inside filelock's fork bookkeeping. #815 by @​gaborbernat.

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-6:

4.2.6 (2026-10-31)

.. _release-4-2-6-fixed:

Fixed

  • Fix a race in :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (:pr:899) by :user:dxbjavid and :user:gaborbernat.

.. _release-4-2-5:

4.2.5 (2026-10-30)

.. _release-4-2-5-fixed:

Fixed

  • :meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire raise :class:TypeError for a blocking that is not a :class:bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1 (:pr:870) by :user:simpleqt and :user:gaborbernat.
  • A :class:~filelock.SoftFileLock acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (:pr:869) by :user:simpleqt and :user:gaborbernat.
  • A fork() child of a process holding a :class:~filelock.SoftFileLease starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so :attr:~filelock.SoftFileLease.token and :attr:~filelock.SoftFileLease.compromise reported a claim the child never held while is_locked reported it unheld (:pr:868) by :user:dxbjavid and :user:gaborbernat.
  • A nested acquire of a held :class:~filelock.FileLock or :class:~filelock.SoftFileLock no longer creates the lock

... (truncated)

Commits
  • 6c0ecc2 Release 4.1.0
  • df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
  • 0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
  • 73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
  • 181b36b 🧪 test(lease): give the age-out test a real-time margin (#814)
  • 2c19af4 🐛 fix(api): release thread holds, guard reentry (#810)
  • 367b111 🐛 fix(soft-rw): publish the head through gen/HEAD (#799)
  • 61582c5 🐛 fix(api): validate lock options up front (#803)
  • 20c4b5a 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX (#802)
  • cf092c7 🧪 test: drop timing races from two runner-load flakes (#809)
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.20

Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

Updates msgpack from 1.2.1 to 1.2.4

Release notes

Sourced from msgpack's releases.

v1.2.4

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.3...v1.2.4

v1.2.3

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.2...v1.2.3

v1.2.2

What's Changed

... (truncated)

Changelog

Sourced from msgpack's changelog.

1.2.4

Release Date: 2026-10-27

  • Limit container preallocation to 10000 items to prevent excessive memory allocation from deeply nested, large array or map headers. Larger containers grow as their contents are decoded; max_array_len and max_map_len still limit their total size. See GHSA-j8c6-9vc5-hj6x.
  • Pass a list of pairs to object_pairs_hook in the pure Python unpacker, ensuring that the entire map is consumed even if the hook does not iterate over its argument. #744
  • Leave the next object unread when read_array_header() or read_map_header() raises ValueError for a mismatched type in the pure Python unpacker. #748
  • Return bytes from Unpacker.read_bytes() in the pure Python implementation, matching the C extension. #747
  • Update GitHub Actions dependencies, including cibuildwheel to 4.3.1. #749

1.2.3

Release Date: 2026-09-29

  • Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
  • Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip() after previously unpacking a nested object in the C extension.
  • Raise ValueError in the C extension when switching between unpacking, skipping, header readers, or read_bytes() while an object is incomplete. Resume with the same method after feeding more data; unpack() and iteration remain interchangeable.
  • Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization of the same C Unpacker while unpacking is in progress.
  • Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #742
  • Support packing Python 3.15 frozendict objects. #738
  • Update Cython from 3.2.5 to 3.3.0. #738
  • Build wheels for Pyodide using Emscripten. #732
  • Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #741

1.2.2

Release Date: 2026-08-27

  • Fix the read_size documentation. #700
  • Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701
  • Prevent reentrant calls to Unpacker.feed() while unpacking. #704
  • Improve error handling and reporting in unpacking functions. #707
  • Fix Timestamp.from_datetime() precision for far-future datetimes. #710
  • Fix typos in the documentation. #712
  • Validate the nanoseconds range when unpacking timestamps in the C extension. #716

... (truncated)

Commits

@dependabot
Bump the ci-constraints group across 1 directory with 29 updates
721f3c4 
Bumps the ci-constraints group with 29 updates in the /ci directory:

| Package | From | To |
| --- | --- | --- |
| [tomli](https://github.com/hukkin/tomli) | `2.4.1` | `2.5.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.7.22` | `2026.10.23` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.9` | `3.5.2` |
| [cyclonedx-python-lib](https://github.com/CycloneDX/cyclonedx-python-lib) | `11.11.0` | `11.12.0` |
| [filelock](https://github.com/tox-dev/filelock) | `3.32.2` | `4.1.0` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.20` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.4` |
| [pip](https://github.com/pypa/pip) | `26.2.1` | `26.2.2` |
| [pip-api](https://github.com/di/pip-api) | `0.0.34` | `0.0.35` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.12.4` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [pyparsing](https://github.com/pyparsing/pyparsing) | `3.3.2` | `3.3.3` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.2` |
| [iniconfig](https://github.com/pytest-dev/iniconfig) | `2.3.0` | `2.3.1` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [setuptools](https://github.com/pypa/setuptools) | `83.0.0` | `84.2.1` |
| [wheel](https://github.com/pypa/wheel) | `0.47.0` | `0.48.0` |
| [domdf-python-tools](https://github.com/domdfcoding/domdf_python_tools) | `3.10.0` | `3.11.0` |
| [flake8](https://github.com/pycqa/flake8) | `7.3.0` | `7.4.1` |
| [flake8-bugbear](https://github.com/PyCQA/flake8-bugbear) | `25.11.29` | `26.10.27` |
| [pycodestyle](https://github.com/PyCQA/pycodestyle) | `2.14.0` | `2.15.0` |
| [pyflakes](https://github.com/PyCQA/pyflakes) | `3.4.0` | `4.0.3` |
| [imagesize](https://github.com/shibukawa/imagesize_py) | `2.0.0` | `2.0.1` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.3` | `3.0.4` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.9.2` | `2.10` |
| [sphinxcontrib-jsmath](https://github.com/sphinx-doc/sphinxcontrib-jsmath) | `1.0.1` | `2.0.0` |
| [webencodings](https://github.com/CourtBouillon/webencodings) | `0.5.1` | `0.6.1` |



Updates `tomli` from 2.4.1 to 2.5.0
- [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md)
- [Commits](hukkin/tomli@2.4.1...2.5.0)

Updates `certifi` from 2026.7.22 to 2026.10.23
- [Commits](certifi/python-certifi@2026.07.22...2026.10.23)

Updates `charset-normalizer` from 3.4.9 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.2)

Updates `cyclonedx-python-lib` from 11.11.0 to 11.12.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-python-lib/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md)
- [Commits](CycloneDX/cyclonedx-python-lib@v11.11.0...v11.12.0)

Updates `filelock` from 3.32.2 to 4.1.0
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...4.1.0)

Updates `idna` from 3.18 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.20)

Updates `msgpack` from 1.2.1 to 1.2.4
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.4)

Updates `pip` from 26.2.1 to 26.2.2
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.2.1...26.2.2)

Updates `pip-api` from 0.0.34 to 0.0.35
- [Release notes](https://github.com/di/pip-api/releases)
- [Changelog](https://github.com/di/pip-api/blob/master/CHANGELOG)
- [Commits](di/pip-api@0.0.34...0.0.35)

Updates `platformdirs` from 4.11.0 to 4.12.4
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.0...4.12.4)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `pyparsing` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/pyparsing/pyparsing/releases)
- [Changelog](https://github.com/pyparsing/pyparsing/blob/master/CHANGES)
- [Commits](pyparsing/pyparsing@3.3.2...3.3.3)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

Updates `coverage` from 7.15.4 to 7.16.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.2)

Updates `iniconfig` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/pytest-dev/iniconfig/releases)
- [Changelog](https://github.com/pytest-dev/iniconfig/blob/main/CHANGELOG)
- [Commits](pytest-dev/iniconfig@v2.3.0...v2.3.1)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pluggy@1.6.0...1.7.0)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `setuptools` from 83.0.0 to 84.2.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v83.0.0...v84.2.1)

Updates `wheel` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](pypa/wheel@0.47.0...0.48.0)

Updates `domdf-python-tools` from 3.10.0 to 3.11.0
- [Release notes](https://github.com/domdfcoding/domdf_python_tools/releases)
- [Commits](domdfcoding/domdf_python_tools@v3.10.0...v3.11.0)

Updates `flake8` from 7.3.0 to 7.4.1
- [Commits](PyCQA/flake8@7.3.0...7.4.1)

Updates `flake8-bugbear` from 25.11.29 to 26.10.27
- [Release notes](https://github.com/PyCQA/flake8-bugbear/releases)
- [Commits](PyCQA/flake8-bugbear@25.11.29...26.10.27)

Updates `pycodestyle` from 2.14.0 to 2.15.0
- [Release notes](https://github.com/PyCQA/pycodestyle/releases)
- [Changelog](https://github.com/PyCQA/pycodestyle/blob/main/CHANGES.txt)
- [Commits](PyCQA/pycodestyle@2.14.0...2.15.0)

Updates `pyflakes` from 3.4.0 to 4.0.3
- [Changelog](https://github.com/PyCQA/pyflakes/blob/main/NEWS.rst)
- [Commits](PyCQA/pyflakes@3.4.0...4.0.3)

Updates `imagesize` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/shibukawa/imagesize_py/releases)
- [Commits](shibukawa/imagesize_py@2.0.0...2.0.1)

Updates `markupsafe` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.3...3.0.4)

Updates `soupsieve` from 2.9.2 to 2.10
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](facelessuser/soupsieve@2.9.2...2.10)

Updates `sphinxcontrib-jsmath` from 1.0.1 to 2.0.0
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-jsmath/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-jsmath/blob/master/CHANGES.rst)
- [Commits](sphinx-doc/sphinxcontrib-jsmath@1.0.1...2.0.0)

Updates `webencodings` from 0.5.1 to 0.6.1
- [Release notes](https://github.com/CourtBouillon/webencodings/releases)
- [Changelog](https://github.com/CourtBouillon/webencodings/blob/main/docs/changelog.rst)
- [Commits](CourtBouillon/webencodings@v0.5.1...v0.6.1)

---
updated-dependencies:
- dependency-name: tomli
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: cyclonedx-python-lib
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: filelock
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: msgpack
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: pip
  dependency-version: 26.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: pip-api
  dependency-version: 0.0.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: platformdirs
  dependency-version: 4.12.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: pyparsing
  dependency-version: 3.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: setuptools
  dependency-version: 84.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: wheel
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: domdf-python-tools
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: flake8
  dependency-version: 7.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: flake8-bugbear
  dependency-version: 26.10.27
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: pycodestyle
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: pyflakes
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: imagesize
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: soupsieve
  dependency-version: '2.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: sphinxcontrib-jsmath
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: webencodings
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
...

Signed-off-by: dependabot[bot] <support@github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ci dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants