[dependabot]

Bumps cbor2 from 6.1.4 to 6.1.5.

Release notes

Sourced from cbor2's releases.

6.1.5

• Fixed CBORSimpleValue hashing inconsistently with the integer it compares equal to (#334; PR by @​sahvx655-wq)
• Fixed canonical encoding with value sharing enabled emitting shared references to container keys that were never written to the stream, because the throwaway encoding used to sort the keys registered them as shared values; the output then failed to decode, or decoded with the wrong keys substituted in (#339; PR by @​sahvx655-wq)
• Fixed shared references (tag 29) to a map or an unhandled tag resolving to the raw dict or CBORTag instead of the value returned by object_hook or tag_hook, a regression from 5.x (#343; PR by @​sahvx655-wq)
• Fixed the encoder not giving a nested stringref namespace (tag 256) its own index space (#335; PR by @​dylanpulver)
• Fixed the decoder returning its internal break marker as a value when a break stop code appeared where a data item was expected (#305; PR by @​sahvx655-wq)
• Fixed a PanicException when trying to decode an epoch-form date (tag 100) with a payload near i32::MAX which then overflowed the addition instead of raising a clean decode error (#340; PR by @​sahvx655-wq)
• Fixed the decoder accepting a string-form datetime (tag 0) without a UTC offset and returning a naive ~datetime.datetime instead of rejecting it (#347; PR by @​sahvx655-wq)
• Fixed a reused CBOREncoder no longer flushing its output or resetting its shared container and string reference tracking after an encode() call had raised an exception (#348; PR by @​sahvx655-wq)

Commits

• cf5b8c5 Fixed flaky datetime comparison
• 4a20060 Bumped up the version
• c895351 Reset encoder state after a failed encode (#348)
• c562883 Bump the github-actions group with 2 updates (#349)
• 2774413 Reject string-form datetime (tag 0) without a UTC offset (#347)
• ab3a865 Fixed integer overflow when decoding epoch-form dates (tag 100) (#340)
• 96c5b15 reject misplaced break stop code instead of leaking break marker (#341)
• bb301da Give a nested stringref namespace its own index space (#335)
• 7f84e3d Make shared references honour object_hook and tag_hook results (#343)
• e480550 Disable value sharing while computing canonical sort keys (#339)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cbor2@​6.1.4 ⏵ 6.1.5

View full report