django/django-project
django/django-project
Template
1
0
Fork 0
Code Issues Pull requests 10 Releases Wiki Activity Actions

Update dependency cbor2 to v6.1.4 #12

Open
bot.renovate wants to merge 1 commit from renovate/cbor2-6.x into main
pull from: renovate/cbor2-6.x
merge into: django:main
Conversation 0 Commits 1 Files changed 2 +2 -2
bot.renovate commented 2026-07-26 12:10:24 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Update Change
cbor2 (changelog) minor ==6.0.1 → ==6.1.4

Release Notes

agronholm/cbor2 (cbor2)

v6.1.4

Compare Source

  • Fixed frozendict deriving its hash from its keys and its values as two independent sets, so that frozendicts holding the same keys and the same values all collided regardless of how the two were paired; since the decoder builds a frozendict for every map in an immutable position, a payload keyed by such maps decoded in quadratic time (#​333; PR by @​sahvx655-wq)
  • Fixed the encoder not registering bytearray values in the string reference namespace, unlike bytes and str; since the decoder registers every byte string it reads, a single bytearray desynchronised the namespace and made subsequent string references resolve to the wrong value (#​332; PR by @​sahvx655-wq)
  • Fixed the decoder silently accepting an indefinite-length map whose break marker arrives after a key with no value, dropping that trailing key and returning a truncated map instead of rejecting the ill-formed input (#​331; PR by @​sahvx655-wq)
  • Fixed the decoder accepting a non-byte-string payload for a positive or negative bignum (tags 2 and 3). int.from_bytes() also accepts an array (or a map, whose keys it iterates), so a tag wrapping one of those was coerced into an integer instead of being rejected as malformed (#​326; PR by @​sahvx655-wq)

v6.1.3

Compare Source

  • Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#​313; PR by @​sahvx655-wq)
  • Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#​309; PR by @​sahvx655-wq)
  • Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#​316; PR by @​sahvx655-wq)
  • Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#​317; PR by @​sahvx655-wq)
  • Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#​314; PR by @​sahvx655-wq)
  • Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#​324; PR by @​sahvx655-wq)

v6.1.2

Compare Source

  • Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#​308; PR by @​sahvx655-wq)
  • Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#​307; PR by @​noderyos)

v6.1.1

Compare Source

  • Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#​304)

v6.1.0

Compare Source

  • Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#​283)
  • Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#​297)
  • Fixed compatibility issues with 32-bit systems (#​300)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cbor2](https://github.com/agronholm/cbor2) ([changelog](https://cbor2.readthedocs.io/en/latest/versionhistory.html)) | minor | `==6.0.1` → `==6.1.4` | --- ### Release Notes <details> <summary>agronholm/cbor2 (cbor2)</summary> ### [`v6.1.4`](https://github.com/agronholm/cbor2/releases/tag/6.1.4) [Compare Source](https://github.com/agronholm/cbor2/compare/6.1.3...6.1.4) - Fixed `frozendict` deriving its hash from its keys and its values as two independent sets, so that frozendicts holding the same keys and the same values all collided regardless of how the two were paired; since the decoder builds a frozendict for every map in an immutable position, a payload keyed by such maps decoded in quadratic time ([#&#8203;333](https://github.com/agronholm/cbor2/pull/333); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed the encoder not registering `bytearray` values in the string reference namespace, unlike `bytes` and `str`; since the decoder registers every byte string it reads, a single `bytearray` desynchronised the namespace and made subsequent string references resolve to the wrong value ([#&#8203;332](https://github.com/agronholm/cbor2/pull/332); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed the decoder silently accepting an indefinite-length map whose break marker arrives after a key with no value, dropping that trailing key and returning a truncated map instead of rejecting the ill-formed input ([#&#8203;331](https://github.com/agronholm/cbor2/pull/331); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed the decoder accepting a non-byte-string payload for a positive or negative bignum (tags 2 and 3). `int.from_bytes()` also accepts an array (or a map, whose keys it iterates), so a tag wrapping one of those was coerced into an integer instead of being rejected as malformed ([#&#8203;326](https://github.com/agronholm/cbor2/pull/326); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) ### [`v6.1.3`](https://github.com/agronholm/cbor2/releases/tag/6.1.3) [Compare Source](https://github.com/agronholm/cbor2/compare/6.1.2...6.1.3) - Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value ([#&#8203;313](https://github.com/agronholm/cbor2/pull/313); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed ([#&#8203;309](https://github.com/agronholm/cbor2/pull/309); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with `+` instead of building the result once ([#&#8203;316](https://github.com/agronholm/cbor2/pull/316); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed `datetime_as_timestamp` encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer ([#&#8203;317](https://github.com/agronholm/cbor2/pull/317); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings ([#&#8203;314](https://github.com/agronholm/cbor2/pull/314); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a `CBORDecodeError` reading `invalid types in input array`; the encoder emits them as `[address, null, zone id]` but the decoder only handled the network and interface array forms, so a scoped `~ipaddress.IPv6Address` could not be decoded back ([#&#8203;324](https://github.com/agronholm/cbor2/pull/324); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) ### [`v6.1.2`](https://github.com/agronholm/cbor2/releases/tag/6.1.2) [Compare Source](https://github.com/agronholm/cbor2/compare/6.1.1...6.1.2) - Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 ([#&#8203;308](https://github.com/agronholm/cbor2/pull/308); PR by [@&#8203;sahvx655-wq](https://github.com/sahvx655-wq)) - Fixed `cbor2.load()` crash caused by incorrect handling of internal read buffer extension during stream deserialization. ([#&#8203;307](https://github.com/agronholm/cbor2/pull/307); PR by [@&#8203;noderyos](https://github.com/noderyos)) ### [`v6.1.1`](https://github.com/agronholm/cbor2/releases/tag/6.1.1) [Compare Source](https://github.com/agronholm/cbor2/compare/6.1.0...6.1.1) - Fixed `cbor2.load()` returning corrupted data for payloads exceeding 4096 bytes ([#&#8203;304](https://github.com/agronholm/cbor2/issues/304)) ### [`v6.1.0`](https://github.com/agronholm/cbor2/releases/tag/6.1.0) [Compare Source](https://github.com/agronholm/cbor2/compare/6.0.1...6.1.0) - Added the `allow_duplicate_keys` parameter to `CBORDecoder`, `load` and `loads` (default: `True`). When set to `False`, a `CBORDecodeError` is raised upon encountering a duplicate key within the same map. ([#&#8203;283](https://github.com/agronholm/cbor2/issues/283)) - Added support for decoding from any object supporting the buffer API (e.g. `memoryview` or `bytearray`) in addition to `bytes` ([#&#8203;297](https://github.com/agronholm/cbor2/issues/297)) - Fixed compatibility issues with 32-bit systems ([#&#8203;300](https://github.com/agronholm/cbor2/issues/300)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjEuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI2MS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
bot.renovate force-pushed renovate/cbor2-6.x from 31fe4e86a2 to 58e1d04775 2026-08-02 03:10:22 +02:00 Compare
bot.renovate changed title from Update dependency cbor2 to v6.1.3 to Update dependency cbor2 to v6.1.4 2026-08-02 03:10:24 +02:00
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/cbor2-6.x:renovate/cbor2-6.x
git switch renovate/cbor2-6.x

Merge

Merge the changes and update on Forgejo.
git switch main
git merge --no-ff renovate/cbor2-6.x
git switch renovate/cbor2-6.x
git rebase main
git switch main
git merge --ff-only renovate/cbor2-6.x
git switch renovate/cbor2-6.x
git rebase main
git switch main
git merge --no-ff renovate/cbor2-6.x
git switch main
git merge --squash renovate/cbor2-6.x
git switch main
git merge --ff-only renovate/cbor2-6.x
git switch main
git merge renovate/cbor2-6.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
django/django-project!12
No description provided.