Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

chore(deps): bump msgpack from 1.1.2 to 1.2.1#121

Open
dependabot[bot] wants to merge 1 commit into
mainancilis/ancilis:mainfrom
dependabot/pip/msgpack-1.2.1ancilis/ancilis:dependabot/pip/msgpack-1.2.1Copy head branch name to clipboard
Open

chore(deps): bump msgpack from 1.1.2 to 1.2.1#121
dependabot[bot] wants to merge 1 commit into
mainancilis/ancilis:mainfrom
dependabot/pip/msgpack-1.2.1ancilis/ancilis:dependabot/pip/msgpack-1.2.1Copy head branch name to clipboard

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps msgpack from 1.1.2 to 1.2.1.

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

Full Changelog: msgpack/msgpack-python@v1.2.0...v1.2.1

v1.2.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from msgpack's changelog.

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

1.2.0

Release Date: 2026-06-11

  • Support free threaded Python. #654, #686
  • Dropped support for Python 3.9. #656
  • Fix missing error checks in C code. #665, #666, #667, #672
  • Fix strict_map_key option didn't work for object_pairs_hook. #673
  • Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #676
  • Fix memory leak when Unpacker returns error for invalid input. #671
  • Fix Packer.pack_ext_type() ignored autoreset option. #663
  • Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #662
  • Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #677
  • Fix possible memory leak when calling Unpacker.__init__() several times. #687
Commits
  • 448d43f release v1.2.1 (#698)
  • 2c56ddb Merge commit from fork
  • 0f4f350 Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group (#694)
  • 11ed0a5 release v1.2.0 (#692)
  • c410a38 Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (#691)
  • 97ba6ca skip ci: remove unneeded CIBW_SKIP option
  • cdde1b0 Wheels CI hangs for MacOS Intel (#689)
  • 5eb57e1 release v1.2.0rc1 (#681)
  • 77395c1 Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks (...
  • 7df7136 Guard Packer buffer protocol hooks with Cython critical sections (#686)
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
chore(deps): bump msgpack from 1.1.2 to 1.2.1
906df3f 
Bumps [msgpack](https://github.com/msgpack/msgpack-python) from 1.1.2 to 1.2.1.
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.1.2...v1.2.1)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-version: 1.2.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 20, 2026
@dependabot
dependabot Bot requested a review from ancilis as a code owner June 20, 2026 16:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 20, 2026
@github-actions

github-actions Bot commented Jun 20, 2026

Copy link
Copy Markdown

⚠️ Claude reviewer Action failed to produce a verdict. Falling back to human review. (Run: https://github.com/ancilis/ancilis/actions/runs/27876475718)

@ancilis

ancilis commented Jun 20, 2026

Copy link
Copy Markdown
Owner

Claude Reviewer

Recommendation: APPROVE WITH NOTES

Linked ticket: NONE
Scope match: no ticket

Findings

Scope match (info): No linked ANC-XXXX ticket in title, branch, description, or commit. This is an automated dependabot lockfile bump, so the missing ticket is expected rather than alarming — but it is still a finding by the scope-match dimension. The diff is exactly one line (msgpack==1.1.2 → 1.2.1 in requirements-lock.txt) and matches the description precisely. No scope drift, no hidden additions.

Hidden assumptions and risk (warn): Two things worth knowing before merge, neither a blocker:

  • This is a minor bump (1.1.x → 1.2.x), not a patch. Per the upstream changelog, msgpack 1.2.0 dropped support for Python 3.9 (msgpack-python #656). If Ancilis still declares python_requires covering 3.9 anywhere, the resolver could refuse to install or silently skip the wheel. Confirm the supported Python floor is ≥3.10 before merging. If 3.9 is still supported, this bump should be held.
  • The 1.2.1 release notes a behavior change: an Unpacker instance is no longer reusable after an unpacking failure (GHSA-6v7p-g79w-8964 segfault fix — you must create a new instance). msgpack reaches Ancilis transitively via mcp==1.26.0, not direct first-party use, so impact is almost certainly nil, but flagging since it is a documented semantic change rather than a pure patch.

On the positive side, 1.2.1 carries the GHSA segfault fix plus several memory-leak/use-after-free fixes, so this is a net security improvement.

Hygiene check (info): Clean. No local agent/IDE state, no absolute dev paths, no machine identifiers, single-line lockfile delta. No platform, SDK, AKSI, evidence-chain, overlay, or positioning surfaces touched. No patent-implicating mechanisms involved.

Suggested follow-up

  • Confirm the project's minimum supported Python is ≥3.10 (msgpack 1.2.0 dropped 3.9). If not, hold this bump.
  • Optional: have dependabot config attach a tracking ticket so dependency bumps satisfy the scope-match requirement automatically.

Reviewer notes

This is about as low-risk as a PR gets, and I am not going to manufacture concern over a one-line transitive lock bump that improves the security posture. The only real thing a senior engineer would want a second pair of eyes on is the Python-3.9 drop hidden inside a "minor" version jump — dependabot's compatibility badge won't catch that for you, because it scores on test-pass not on interpreter-floor changes. Verify the floor, then merge.

Claude claude-opus-4-8 · review_id: 52542fed-f0a3-49e9-ba31-35c5953e25fe · prompt_version: 2026-05-03.1 · context: pr_diff, pr_metadata, commits, ticket:none, project_instructions, aksi_framework, adr:session-2026-03-13-adr-005-producer-protocol.md

@ancilis

ancilis commented Jun 20, 2026

Copy link
Copy Markdown
Owner

Merger note: this PR has no linked Paperclip issue. Please add an ANC-XXXX identifier to the PR title so Merger can reconcile it with Paperclip before landing it.

ancilis
ancilis approved these changes Jul 6, 2026
View reviewed changes

@ancilis ancilis left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved from a code-review perspective.

  • The diff is the expected one-line lockfile bump in requirements-lock.txt only.
  • pyproject.toml declares requires-python = ">=3.10" and classifiers for 3.10-3.13, so msgpack 1.2.x dropping Python 3.9 support does not conflict with this repo's supported interpreter floor.
  • Local verification on PR head 906df3f: python -m pytest python/tests -q passed in an isolated venv after installing the repo's .[dev] extras (3337 passed, 2 skipped, 1 xfailed).
  • Existing CI is green for the runtime/test matrix; the remaining failing checks are governance automation (Validate ANC issue linkage, review), not code or compatibility regressions from this dependency bump.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ancilis ancilis ancilis approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ancilis
Morty Proxy This is a proxified and sanitized view of the page, visit original site.