chore(deps): Bump msgpack from 1.1.2 to 1.2.1#1445
Conversation
Bumps [msgpack](https://github.com/msgpack/msgpack-python) from 1.1.2 to 1.2.1. - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](msgpack/msgpack-python@v1.1.2...v1.2.1) --- updated-dependencies: - dependency-name: msgpack dependency-version: 1.2.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
gcko
left a comment
gcko
left a comment
There was a problem hiding this comment.
Adversarial review of the full gh pr diff (#1445), cross-checked against the msgpack-python 1.2.0/1.2.1 release notes, the PyPI advisory database, and recce's actual usage. No code changed — only the resolved lockfile entry.
LOW (positive / security) — bump closes a known advisory. GHSA-6v7p-g79w-8964 ("MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error") affects msgpack <= 1.2.0 and is first patched in 1.2.1. recce was previously pinned to 1.1.2, i.e. vulnerable. This bump is therefore security-positive. Real-world exposure to recce is low (recce doesn't unpack untrusted msgpack directly; the consumer is dbt's manifest (de)serialization of trusted local artifacts), but moving off a flagged version is the right call. uv.lock:1298 (msgpack package block).
NIT — minor version jump carries a Python-floor change that does not affect recce. msgpack 1.2.0 dropped Python 3.9 support (msgpack-python PR #656). recce declares requires-python = ">=3.10" (pyproject.toml:7), so this is a no-op for recce; the new lockfile wheels start at cp310, consistent with the floor. Flagging only for completeness.
NIT — behavioral change in 1.2.0: DEFAULT_RECURSE_LIMIT raised 511 → 1024 (msgpack-python PR #676). This is strictly more permissive (deeper nested structures now decode rather than raising). It cannot break code that previously worked, and recce/dbt do not depend on the old 511 ceiling. No action.
NIT — no test/coverage impact. A lockfile-only Dependabot bump touches no source and no tests; there is no coverage drift, no hidden behavioral shift in recce's own code, and no error-path holes introduced. The risk surface is entirely "does dbt still work against msgpack 1.2.1," which is a minor-version, semver-compatible bump whose 1.2.0/1.2.1 changelog is bugfix/memory-safety only (use-after-free in get_data_from_buffer, memory-leak on invalid nested arrays, Unpacker re-entry hardening) — no API removals or signature changes.
Overall: A clean, low-risk, security-positive transitive lockfile bump. No CRITICAL/HIGH/MEDIUM concerns. Recommendation: APPROVE; CI on the recce PR is the remaining gate (confirms dbt resolves and imports cleanly against 1.2.1).
1 participant
Bumps msgpack from 1.1.2 to 1.2.1.
Release notes
Sourced from msgpack's releases.
... (truncated)
Changelog
Sourced from msgpack's changelog.
Commits
448d43frelease v1.2.1 (#698)2c56ddbMerge commit from fork0f4f350Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group (#694)11ed0a5release v1.2.0 (#692)c410a38Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (#691)97ba6caskip ci: remove unneeded CIBW_SKIP optioncdde1b0Wheels CI hangs for MacOS Intel (#689)5eb57e1release v1.2.0rc1 (#681)77395c1HardenUnpacker.__init__re-entry cleanup to prevent buffer/context leaks (...7df7136GuardPackerbuffer protocol hooks with Cython critical sections (#686)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.