Bump msgpack from 1.1.1 to 1.2.1

[dependabot]

Bumps msgpack from 1.1.1 to 1.2.1.

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

• Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#694
• release v1.2.1 by @​methane in msgpack/msgpack-python#698

Full Changelog: msgpack/msgpack-python@v1.2.0...v1.2.1

v1.2.0

What's Changed

• relax setuptools version by @​methane in msgpack/msgpack-python#652
• update setuptools requirements to >=78.1.1 by @​methane in msgpack/msgpack-python#653
• cython: freethreading_compatible by @​methane in msgpack/msgpack-python#654
• drop Python 3.9 by @​methane in msgpack/msgpack-python#656
• update cython and cibuildwheel by @​methane in msgpack/msgpack-python#658
• ci: add riscv64 manylinux/musllinux wheels by @​justeph in msgpack/msgpack-python#664
• fix: check unpack_callback_uint32 result by @​KowalskiThomas in msgpack/msgpack-python#666
• fix: re-raise existing exception when available by @​KowalskiThomas in msgpack/msgpack-python#667
• fix: check return code in unpack_callback_int64 by @​KowalskiThomas in msgpack/msgpack-python#665
• Fixed README example by @​vallsv in msgpack/msgpack-python#668
• Bump the all-dependencies group with 6 updates by @​dependabot[bot] in msgpack/msgpack-python#669
• ci: use ubuntu-slim for lint by @​methane in msgpack/msgpack-python#670
• fix: enforce strict_map_key with object_pairs_hook by @​KowalskiThomas in msgpack/msgpack-python#673
• Raise DEFAULT_RECURSE_LIMIT from 511 to 1024 by @​Copilot in msgpack/msgpack-python#676
• fix: properly handle return codes in pack_timestamp by @​KowalskiThomas in msgpack/msgpack-python#672
• fix: avoid memory leak when decoding invalid nested arrays by @​KowalskiThomas in msgpack/msgpack-python#671
• Add missing autoreset in Packer.pack_ext_type by @​bysiber in msgpack/msgpack-python#663
• Add no-GIL interpreter support by @​clin1234 in msgpack/msgpack-python#641
• skip recursion limit test on free-threaded CPython builds by @​methane in msgpack/msgpack-python#679
• Fix Timestamp.from_datetime returning wrong value for pre-epoch datetimes by @​bysiber in msgpack/msgpack-python#662
• Add 3.15 to CI by @​clin1234 in msgpack/msgpack-python#678
• fix: use-after-free in get_data_from_buffer by @​KowalskiThomas in msgpack/msgpack-python#677
• change changelog format to markdown by @​methane in msgpack/msgpack-python#680
• Bump the all-dependencies group with 2 updates by @​dependabot[bot] in msgpack/msgpack-python#684
• Bump sys.setrecursionlimit within test_nest_limit_1024 by @​clin1234 in msgpack/msgpack-python#682
• Guard Packer buffer protocol hooks with Cython critical sections by @​Copilot in msgpack/msgpack-python#686
• Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks by @​Copilot in msgpack/msgpack-python#687
• release v1.2.0rc1 by @​methane in msgpack/msgpack-python#681
• Wheels CI hangs for MacOS Intel by @​crusaderky in msgpack/msgpack-python#689
• Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#691
• release v1.2.0 by @​methane in msgpack/msgpack-python#692

New Contributors

• @​justeph made their first contribution in msgpack/msgpack-python#664
• @​KowalskiThomas made their first contribution in msgpack/msgpack-python#666
• @​vallsv made their first contribution in msgpack/msgpack-python#668
• @​dependabot[bot] made their first contribution in msgpack/msgpack-python#669
• @​Copilot made their first contribution in msgpack/msgpack-python#676
• @​bysiber made their first contribution in msgpack/msgpack-python#663
• @​clin1234 made their first contribution in msgpack/msgpack-python#641

... (truncated)

Changelog

Sourced from msgpack's changelog.

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

1.2.0

Release Date: 2026-06-11

• Support free threaded Python. #654, #686
• Dropped support for Python 3.9. #656
• Fix missing error checks in C code. #665, #666, #667, #672
• Fix strict_map_key option didn't work for object_pairs_hook. #673
• Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #676
• Fix memory leak when Unpacker returns error for invalid input. #671
• Fix Packer.pack_ext_type() ignored autoreset option. #663
• Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #662
• Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #677
• Fix possible memory leak when calling Unpacker.__init__() several times. #687

1.1.2

Release Date: 2025-10-08

This release does not change source code. It updates only building wheels:

• Update Cython to v3.1.4
• Update cibuildwheel to v3.2.0
• Drop Python 3.8
• Add Python 3.14
• Add windows-arm

Commits

• 448d43f release v1.2.1 (#698)
• 2c56ddb Merge commit from fork
• 0f4f350 Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group (#694)
• 11ed0a5 release v1.2.0 (#692)
• c410a38 Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (#691)
• 97ba6ca skip ci: remove unneeded CIBW_SKIP option
• cdde1b0 Wheels CI hangs for MacOS Intel (#689)
• 5eb57e1 release v1.2.0rc1 (#681)
• 77395c1 Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks (...
• 7df7136 Guard Packer buffer protocol hooks with Cython critical sections (#686)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

PR Summary

Medium Risk
Minor-version bump of a native dependency on dbt’s serialization path with documented security fixes; no repo code changes, but behavior of msgpack-backed dbt internals could shift slightly.

Overview
This PR only updates uv.lock, pinning transitive msgpack from 1.1.1 to 1.2.1. There are no application or pyproject.toml changes.

msgpack is pulled in through dbt’s mashumaro[msgpack] extra (used by dbt-core, dbt-common, and dbt-adapters) for MessagePack serialization in the dbt toolchain. The lockfile refresh also swaps in the new release’s wheel set, including additional platforms (e.g. riscv64, win_arm64, cp314 / free-threaded builds) and updated hashes for existing targets.

The jump from 1.1.1 to 1.2.1 includes upstream security and robustness fixes in the C unpacker/packer (e.g. use-after-free, memory leaks, and a segfault after failed unpack documented as GHSA-6v7p-g79w-8964 in 1.2.1).

^{Reviewed by Cursor Bugbot for commit 95b5c93. Configure here.}