build(deps): bump cbor2 from 5.9.0 to 6.1.5

[dependabot]

Bumps cbor2 from 5.9.0 to 6.1.5.

Release notes

Sourced from cbor2's releases.

6.1.5

• Fixed CBORSimpleValue hashing inconsistently with the integer it compares equal to (#334; PR by @​sahvx655-wq)
• Fixed canonical encoding with value sharing enabled emitting shared references to container keys that were never written to the stream, because the throwaway encoding used to sort the keys registered them as shared values; the output then failed to decode, or decoded with the wrong keys substituted in (#339; PR by @​sahvx655-wq)
• Fixed shared references (tag 29) to a map or an unhandled tag resolving to the raw dict or CBORTag instead of the value returned by object_hook or tag_hook, a regression from 5.x (#343; PR by @​sahvx655-wq)
• Fixed the encoder not giving a nested stringref namespace (tag 256) its own index space (#335; PR by @​dylanpulver)
• Fixed the decoder returning its internal break marker as a value when a break stop code appeared where a data item was expected (#305; PR by @​sahvx655-wq)
• Fixed a PanicException when trying to decode an epoch-form date (tag 100) with a payload near i32::MAX which then overflowed the addition instead of raising a clean decode error (#340; PR by @​sahvx655-wq)
• Fixed the decoder accepting a string-form datetime (tag 0) without a UTC offset and returning a naive ~datetime.datetime instead of rejecting it (#347; PR by @​sahvx655-wq)
• Fixed a reused CBOREncoder no longer flushing its output or resetting its shared container and string reference tracking after an encode() call had raised an exception (#348; PR by @​sahvx655-wq)

6.1.4

• Fixed frozendict deriving its hash from its keys and its values as two independent sets, so that frozendicts holding the same keys and the same values all collided regardless of how the two were paired; since the decoder builds a frozendict for every map in an immutable position, a payload keyed by such maps decoded in quadratic time (#333; PR by @​sahvx655-wq)
• Fixed the encoder not registering bytearray values in the string reference namespace, unlike bytes and str; since the decoder registers every byte string it reads, a single bytearray desynchronised the namespace and made subsequent string references resolve to the wrong value (#332; PR by @​sahvx655-wq)
• Fixed the decoder silently accepting an indefinite-length map whose break marker arrives after a key with no value, dropping that trailing key and returning a truncated map instead of rejecting the ill-formed input (#331; PR by @​sahvx655-wq)
• Fixed the decoder accepting a non-byte-string payload for a positive or negative bignum (tags 2 and 3). int.from_bytes() also accepts an array (or a map, whose keys it iterates), so a tag wrapping one of those was coerced into an integer instead of being rejected as malformed (#326; PR by @​sahvx655-wq)

6.1.3

• Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
• Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
• Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
• Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
• Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
• Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)

6.1.2

• Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#308; PR by @​sahvx655-wq)
• Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#307; PR by @​noderyos)

6.1.1

• Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#304)

6.1.0

• Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#283)
• Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#297)
• Fixed compatibility issues with 32-bit systems (#300)

6.0.1

• Fixed an error in the mutability logic during decoding, leading to values being decoded as immutable in unexpected places (#295)

6.0.0

• No changes since v6.0.0rc1

6.0.0rc1

• MAJOR REWRITE: The Python and C implementations of the encoder and decoder were replaced with a single, Rust-based implementation in the interest of maintainability.

  Here are some of the highlights:

  • Improved memory safety (100% safe-mode Rust)
  • Complete elimination of reference leaks
  • Support for free-threading and subinterpreters

... (truncated)

Commits

• cf5b8c5 Fixed flaky datetime comparison
• 4a20060 Bumped up the version
• c895351 Reset encoder state after a failed encode (#348)
• c562883 Bump the github-actions group with 2 updates (#349)
• 2774413 Reject string-form datetime (tag 0) without a UTC offset (#347)
• ab3a865 Fixed integer overflow when decoding epoch-form dates (tag 100) (#340)
• 96c5b15 reject misplaced break stop code instead of leaking break marker (#341)
• bb301da Give a nested stringref namespace its own index space (#335)
• 7f84e3d Make shared references honour object_hook and tag_hook results (#343)
• e480550 Disable value sharing while computing canonical sort keys (#339)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)