Update dependency msgpack to v1.2.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
msgpack (changelog)	==1.0.8 → ==1.2.1

---

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

GHSA-6v7p-g79w-8964

More information

Details

Impact

If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.

If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.

Patches

v1.2.1

Workarounds

Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.

Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.

Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
• https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d
• https://github.com/msgpack/msgpack-python
• https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

msgpack/msgpack-python (msgpack)

v1.2.1

Compare Source

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure.
But note that reusing the same Unpacker instance after an unpacking failure is not supported.
Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

v1.2.0

Compare Source

Release Date: 2026-06-11

• Support free threaded Python. #​654, #​686
• Dropped support for Python 3.9. #​656
• Fix missing error checks in C code. #​665, #​666, #​667, #​672
• Fix strict_map_key option didn't work for object_pairs_hook. #​673
• Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #​676
• Fix memory leak when Unpacker returns error for invalid input. #​671
• Fix Packer.pack_ext_type() ignored autoreset option. #​663
• Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #​662
• Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #​677
• Fix possible memory leak when calling Unpacker.__init__() several times. #​687

v1.1.2

Compare Source

=====

Release Date: 2025-10-08

This release does not change source code. It updates only building wheels:

• Update Cython to v3.1.4
• Update cibuildwheel to v3.2.0
• Drop Python 3.8
• Add Python 3.14
• Add windows-arm

v1.1.1

Compare Source

=====

Release Date: 2025-06-13

• No change from 1.1.1rc1.

v1.1.0

Compare Source

=====

Release Date: 2024-09-10

• use PyLong_* instead of PyInt_* for compatibility with
  future Cython. (#​620)

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.