chore(deps): update dependency msgpack to v1 [security]

[manifest-self-hosted-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
msgpack (changelog)	==0.6.2 → ==1.2.1

---

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

GHSA-6v7p-g79w-8964

More information

Details

Impact

If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.

If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.

Patches

v1.2.1

Workarounds

Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.

Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.

Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
• https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d
• https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1
• https://github.com/advisories/GHSA-6v7p-g79w-8964

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

msgpack/msgpack-python (msgpack)

v1.2.1

Compare Source

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure.
But note that reusing the same Unpacker instance after an unpacking failure is not supported.
Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

v1.2.0

Compare Source

Release Date: 2026-06-11

• Support free threaded Python. #​654, #​686
• Dropped support for Python 3.9. #​656
• Fix missing error checks in C code. #​665, #​666, #​667, #​672
• Fix strict_map_key option didn't work for object_pairs_hook. #​673
• Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #​676
• Fix memory leak when Unpacker returns error for invalid input. #​671
• Fix Packer.pack_ext_type() ignored autoreset option. #​663
• Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #​662
• Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #​677
• Fix possible memory leak when calling Unpacker.__init__() several times. #​687

v1.1.2

Compare Source

Release Date: 2025-10-08

This release does not change source code. It updates only building
wheels:

• Update Cython to v3.1.4
• Update cibuildwheel to v3.2.0
• Drop Python 3.8
• Add Python 3.14
• Add windows-arm

v1.1.1

Compare Source

Release Date: 2025-06-13

• No change from 1.1.1rc1.

v1.1.0

Compare Source

Release Date: 2024-09-10

• use PyLong_* instead of PyInt_* for compatibility with future
  Cython. (#​620)

v1.0.8

Compare Source

Release Date: 2024-03-01

• Update Cython to 3.0.8. This fixes memory leak when iterating
  Unpacker object on Python 3.12.
• Do not include C/Cython files in binary wheels.

v1.0.7

Compare Source

Release Date: 2023-09-28

• Fix build error of extension module on Windows. (#​567)
• setup.py doesn't skip build error of extension module. (#​568)

v1.0.6

Compare Source

Release Date: 2023-09-21

[!NOTE]
v1.0.6 Wheels for Windows don't contain extension module. Please
upgrade to v1.0.7 or newer.

• Add Python 3.12 wheels (#​517)
• Remove Python 2.7, 3.6, and 3.7 support

v1.0.5

Compare Source

Release Date: 2023-03-08

• Use __BYTE_ORDER__ instead of __BYTE_ORDER for portability. (#​513,
  #​514)
• Add Python 3.11 wheels (#​517)
• fallback: Fix packing multidimensional memoryview (#​527)

v1.0.4

Compare Source

Release Date: 2022-06-03

• Support Python 3.11 (beta).
• Don't define __*_ENDIAN__ macro
  on Unix. by @​methane in
  #​495
• Use PyFloat_Pack8() on Python 3.11a7 by @​vstinner in
  #​499
• Fix Unpacker max_buffer_length handling by @​methane in
  #​506

v1.0.3

Compare Source

Release Date: 2021-11-24 JST

• Fix Docstring (#​459)
• Fix error formatting (#​463)
• Improve error message about strict_map_key (#​485)

v1.0.2

Compare Source

• Fix year 2038 problem regression in 1.0.1. (#​451)

v1.0.1

Compare Source

• Add Python 3.9 and linux/arm64 wheels. (#​439)
• Fixed Unpacker.tell() after read_bytes() (#​426)
• Fixed unpacking datetime before epoch on Windows (#​433)
• Fixed fallback Packer didn't check DateTime.tzinfo (#​434)

v1.0.0

Compare Source

Release Date: 2020-02-17

• Remove Python 2 support from the msgpack/_cmsgpack.
  msgpack/fallback still supports Python 2.
• Remove encoding option from the Packer and Unpacker.
• Unpacker: The default value of max_buffer_size is changed to 100MiB.
• Unpacker: strict_map_key is True by default now.
• Unpacker: String map keys are interned.
• Drop old buffer protocol support.
• Support Timestamp type.
• Support serializing and decerializing datetime object with tzinfo.
• Unpacker: Fix Unpacker.read_bytes() in fallback implementation.
  (#​352)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.