Skip to content

build(deps): update cbor2 requirement from >=5.4.0 to >=6.1.3 - #25

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/cbor2-gte-6.1.3
Closed

build(deps): update cbor2 requirement from >=5.4.0 to >=6.1.3#25
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/cbor2-gte-6.1.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on cbor2 to permit the latest version.

Release notes

Sourced from cbor2's releases.

6.1.3

  • Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
  • Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
  • Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
  • Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
  • Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
  • Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)
Commits
  • 5820bd4 Bumped up the version
  • 8bb0466 Bump the github-actions group with 2 updates (#323)
  • 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
  • aeff00b Measure text strings by byte length in maybe_stringref (#314)
  • 1c827f1 Encode whole-second datetime timestamps as integers across full range (#317)
  • 791172c Worked around coveralls not working with Homebrew 6
  • 32f66ee [pre-commit.ci] pre-commit autoupdate (#322)
  • 1d5054e Switched to quarterly pre-commit updates
  • c348bbf [pre-commit.ci] pre-commit autoupdate (#319)
  • 6625bc1 Optimized bytestring and text string decoding (#316)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 6, 2026
Updates the requirements on [cbor2](https://github.com/agronholm/cbor2) to permit the latest version.
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@5.4.0...6.1.3)

---
updated-dependencies:
- dependency-name: cbor2
  dependency-version: 6.1.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/cbor2-gte-6.1.3 branch from 518b58b to 6f988bc Compare July 19, 2026 16:32
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #40.

@dependabot dependabot Bot closed this Aug 10, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/cbor2-gte-6.1.3 branch August 10, 2026 17:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants