| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: python314-cbor2 | Distribution: openSUSE Tumbleweed |
| Version: 6.2.0.post2 | Vendor: openSUSE |
| Release: 1.1 | Build date: Thu Nov 5 01:48:39 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 1349072 | Source RPM: python-cbor2-6.2.0.post2-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/agronholm/cbor2 | |
| Summary: Pure Python CBOR (de)serializer with extensive tag support | |
Pure Python CBOR (de)serializer with extensive tag support
MIT
* Thu Nov 05 2026 Steve Kowalik <steven.kowalik@suse.com>
- Update to 6.2.0.post2:
* MAJOR REWRITE: The Python and C implementations of the encoder and
decoder were replaced with a single, Rust-based implementation in the
interest of maintainability. Highlights include improved memory safety
(100% safe-mode Rust), complete elimination of reference leaks, support
for free-threading and subinterpreters, substantially improved
performance, improved decoder error handling where any non-base
exception gets wrapped in a CBORDecodeError, and iterative rather than
recursive decoding so container nesting depth is limited only by
available memory rather than the C stack size.
* BACKWARD INCOMPATIBLE: Changed the signature of the tag_hook decoder
callables to accept (CBORTag, immutable) as arguments instead of
(CBORDecoder, CBORTag).
* BACKWARD INCOMPATIBLE: Changed the signature of the object_hook decoder
callables to accept (Mapping[Any, Any], bool) instead of (CBORDecoder,
dict[Any, Any]).
* BACKWARD INCOMPATIBLE: Removed the break_marker singleton as no longer
necessary.
* BACKWARD INCOMPATIBLE: Removed the CBORDecodeValueError exception,
instead chaining ValueError or TypeError to a CBORDecodeError.
* BACKWARD INCOMPATIBLE: Changed the decoding of semantic tag 261 to yield
an IPv4Interface or IPv6Interface if the address contains host bits.
* BACKWARD INCOMPATIBLE: Removed the individual decoding functions from
the API as they were mistakenly called directly by users.
* BACKWARD INCOMPATIBLE: Changed the encoding of IP addresses to use the
semantic tags 52 and 54 instead of the deprecated 260 and 261.
* BACKWARD INCOMPATIBLE: Dropped the deprecated cbor2.decoder and
cbor2.encoder modules; everything in the API is now importable directly
from cbor2.
* BACKWARD INCOMPATIBLE: Renamed the cbor2.FrozenDict class to frozendict
(not available on Python 3.15 where the built-in frozendict class must
be used instead).
* Dropped support for Python 3.9.
* Added the semantic_decoders decoder option to add or override decoders
for specific semantic tags.
* Added the immutable decoder flag to always use immutable containers
where possible when decoding a CBOR stream.
* Added the allow_indefinite decoder option to optionally disallow
indefinite-length strings and containers.
* Added the allow_duplicate_keys parameter to CBORDecoder, load() and
loads() (default: True) to raise a CBORDecodeError upon encountering a
duplicate key within the same map.
* Added support for decoding from any object supporting the buffer API
(e.g. memoryview or bytearray) in addition to bytes.
* Added the strict_hashable_types parameter to CBORDecoder, load() and
loads() which restricts map keys and set elements to text strings and
byte strings in order to prevent denial-of-service attacks via hash
collisions (GHSA-p6xp-9h6j-r278).
* Documented decoding concatenated CBOR objects with EOF checks between
objects.
* Built Pyodide (pyemscripten) wheels for Python 3.14.
* Fixed the decoder not rejecting invalid two-byte simple value sequences
(0xF800 - 0xF81F).
* Fixed an error in the mutability logic during decoding, leading to
values being decoded as immutable in unexpected places.
* Fixed compatibility issues with 32-bit systems.
* Fixed cbor2.load() returning corrupted data for payloads exceeding 4096
bytes.
* Fixed cbor2.load() crash caused by incorrect handling of internal read
buffer extension during stream deserialization.
* Fixed incorrect tracking of string references for definite-length text
strings of length greater than 65536.
* Fixed the decoder registering 6-byte strings in the string reference
namespace at indices 65536-4294967295 where the encoder does not,
desynchronising the namespace.
* Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently
truncating an address byte string that is longer than the address size
instead of rejecting it as malformed.
* Fixed frozendict deriving its hash from its keys and its values as two
independent sets, which caused hash collisions and quadratic-time
decoding for payloads keyed by such maps.
* Fixed the encoder not registering bytearray values in the string
reference namespace, which desynchronised the namespace.
* Fixed the decoder silently accepting an indefinite-length map whose
break marker arrives after a key with no value.
* Fixed the decoder accepting a non-byte-string payload for a positive or
negative bignum (tags 2 and 3).
* Fixed CBORSimpleValue hashing inconsistently with the integer it
compares equal to.
* Fixed canonical encoding with value sharing enabled emitting shared
references to container keys that were never written to the stream.
* Fixed shared references (tag 29) to a map or an unhandled tag resolving
to the raw dict or CBORTag instead of the value returned by object_hook
or tag_hook.
* Fixed the encoder not giving a nested stringref namespace (tag 256) its
own index space.
* Fixed the decoder returning its internal break marker as a value when a
break stop code appeared where a data item was expected.
* Fixed a PanicException when trying to decode an epoch-form date (tag
100) with a payload near i32::MAX.
* Fixed the decoder accepting a string-form datetime (tag 0) without a
UTC offset and returning a naive datetime instead of rejecting it.
* Fixed a reused CBOREncoder no longer flushing its output or resetting
its shared container and string reference tracking after an encode()
call raised an exception.
* Fixed CBOREncoder.encode_to_bytes() sharing the string reference
namespace of the enclosing encode operation when called from a default
hook.
* Fixed the encoder writing the repr() of a bytes regular expression
pattern (tag 35) instead of the pattern itself.
* Fixed shared references (tag 29) allowing the decoder to construct
object graphs nested deeper than max_depth, which could crash the
interpreter with a segmentation fault when hashed
(GHSA-55vx-2phh-7grr).
* Fixed missing conversion of date values (tags 100 and 1004) to JSON as
ISO formatted strings.
* Fixed a PanicException on Python 3.10 when decoding a string-form
datetime (tag 0) whose fractional seconds part contains a multi-byte
Unicode numeric character.
* Fixed the decoder accepting a set (tag 258) whose payload is not an
array.
* Fixed the decoder accepting a non-integer exponent or mantissa in a
decimal fraction (tag 4) or a bigfloat (tag 5).
* Tue Mar 24 2026 Markéta Machová <mmachova@suse.com>
- Update to 5.9.0 (CVE-2026-26209, bsc#1260367)
* Added the max_depth decoder parameter to limit the maximum allowed
nesting level of containers, with a default value of 400 levels.
* Changed the default read_size from 4096 to 1 for backwards
compatibility.
* Fixed C encoder not respecting string referencing when encoding
string-type datetimes.
* Fixed a missed check for an exception in the C implementation of
CBOREncoder.encode_shared().
* Fixed two reference/memory leaks in the C extension's long string
decoder.
* Fixed C decoder ignoring the str_errors setting when decoding
strings, and improved string decoding performance by using stack
allocation for small strings and purging unnecessary conditionals.
* Fri Jan 02 2026 Markéta Machová <mmachova@suse.com>
- Update to 5.8.0 (CVE-2025-68131, bsc#1255783)
* Added readahead buffering to C decoder for improved performance.
* Fixed Python decoder not preserving share index when decoding
array items containing nested shareable tags, causing shared
references to resolve to wrong objects.
* Reset shared reference state at the start of each top-level
encode/decode operation.
* Thu Oct 30 2025 John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
- Update to 5.7.1
* Improved performance on decoding large definite bytestrings
* Fixed a read(-1) vulnerability caused by boundary handling error
* Mon Sep 29 2025 Dirk Müller <dmueller@suse.com>
- update to 5.7.0:
* Added support for Python 3.14 (no free-threading support yet,
sorry)
* Dropped support for Python 3.8
* Added support for encoding indefinite containers
* Added complex number support (tag 43000)
* Tue Aug 12 2025 Markéta Machová <mmachova@suse.com>
- Make the libalternatives transition conditional
* Wed Jun 25 2025 Markéta Machová <mmachova@suse.com>
- Convert to libalternatives
* Tue Oct 22 2024 Dirk Müller <dmueller@suse.com>
- update to 5.6.5:
* Published binary wheels for Python 3.13
* Thu Jun 06 2024 John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
- Update to 5.6.4
* Fixed compilation of C extension failing on GCC 14
* Fixed compiler warnings when building C extension
- Drop patches for issues fixed upstream
* https://github.com/agronholm/cbor2/pull/238.patch
* Wed Jun 05 2024 John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
- Update to 5.6.3 (bsc#1220096, CVE-2024-26134):
* Fixed decoding of epoch-based dates being affected by the local
time zone in the C extension
- from version 5.6.2
* Fixed ``__hash__()`` of the C version of the ``CBORTag`` type crashing
when there's a recursive reference cycle
* Fixed type annotation for the file object in ``cbor2.dump()``, ``cbor2.load()``,
``CBOREncoder`` and ``CBORDecoder`` to be ``IO[bytes]`` instead of ``BytesIO``
* Worked around a `CPython bug <https://github.com/python/cpython/issues/99612>`_
that caused a ``SystemError`` to be raised, or even a buffer overflow to occur
when decoding a long text string that contained only ASCII characters
* Changed the return type annotations of ``cbor2.load()`` and ``cbor2.load()``
to return ``Any`` instead of ``object`` so as not to force users to make type casts
- from version 5.6.1
* Fixed use-after-free in the decoder's C version when prematurely encountering
the end of stream
* Fixed the C version of the decoder improperly raising ``CBORDecodeEOF`` when
decoding a text string longer than 65536 bytes
- from version 5.6.0
* Added the ``cbor2`` command line tool (for ``pipx run cbor2``)
* Added support for native date encoding (bschoenmaeckers)
* Made the C extension mandatory when the environment variable
``CBOR2_BUILD_C_EXTENSION`` is set to ``1``.
* Fixed ``SystemError`` in the C extension when decoding a ``Fractional``
with a bad number of arguments or a non-tuple value
* Fixed ``SystemError`` in the C extension when the decoder object hook
raises an exception
* Fixed a segmentation fault when decoding invalid unicode data
* Fixed infinite recursion when trying to hash a CBOR tag whose
value points to the tag itself
* Fixed ``MemoryError`` when maliciously constructed bytestrings or string
(declared to be absurdly large) are being decoded
* Fixed ``UnicodeDecodeError`` from failed parsing of a UTF-8 text string
not being wrapped as ``CBORDecodeValueError``
* Fixed ``TypeError`` or ``ZeroDivisionError`` from a failed decoding of
``Fraction`` not being wrapped as ``CBORDecodeValueError``
* Fixed ``TypeError`` or ``ValueError`` from a failed decoding of ``UUID``
not being wrapped as ``CBORDecodeValueError``
* Fixed ``TypeError`` from a failed decoding of ``MIMEMessage`` not being
wrapped as ``CBORDecodeValueError``
* Fixed ``OverflowError``, ``OSError`` or ``ValueError`` from a failed decoding
of epoch-based ``datetime`` not being wrapped as ``CBORDecodeValueError``
- Cherry-pick upstream patch to fix build with GCC 14
* https://github.com/agronholm/cbor2/pull/238.patch
- Add update-alternatives to Requires for post and postun
- Install cbor2 binary in %files section using %python_alternative
- Run %python_install_alternative in %post section
- Run %python_uninstall_alternative in %postun section
- Set CBOR2_BUILD_C_EXTENSION to 1 to build C extension
* Thu Dec 14 2023 Petr Gajdos <pgajdos@suse.com>
- update to 5.5.1:
* Fixed ``CBORSimpleValue`` allowing the use of reserved values
(24 to 31) which resulted in invalid byte sequences
* Fixed encoding of simple values from 20 to 23 producing the
wrong byte sequences
* The ``cbor2.encoder``, ``cbor2.decoder`` or ``cbor2.types``
modules were deprecated – import their contents directly
from ``cbor2`` from now on. The old modules will be removed
in the next major release.
* Added support for Python 3.12
* Added type annotations
* Dropped support for Python 3.7
* Fixed bug in the ``fp`` attribute of the built-in version of
``CBORDecoder`` and ``CBOREncoder`` where the getter returns
an invalid pointer if the ``read`` method of the file was a
built-in method
* Sun Jun 11 2023 ecsos <ecsos@opensuse.org>
- Add %{?sle15_python_module_pythons}
* Sat Jan 07 2023 Dirk Müller <dmueller@suse.com>
- update to 5.4.6:
* Fix tag decoding error
* fix potential memory leak
* Bump requirement to 3.7+
/usr/bin/cbor2 /usr/bin/cbor2-3.14 /usr/lib/python3.14/site-packages/cbor2 /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/INSTALLER /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/METADATA /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/RECORD /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/REQUESTED /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/WHEEL /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/entry_points.txt /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/licenses /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/licenses/LICENSE.txt /usr/lib/python3.14/site-packages/cbor2-6.2.0.post2.dist-info/top_level.txt /usr/lib/python3.14/site-packages/cbor2/__init__.py /usr/lib/python3.14/site-packages/cbor2/__init__.pyi /usr/lib/python3.14/site-packages/cbor2/__pycache__ /usr/lib/python3.14/site-packages/cbor2/__pycache__/__init__.cpython-314.opt-1.pyc /usr/lib/python3.14/site-packages/cbor2/__pycache__/__init__.cpython-314.pyc /usr/lib/python3.14/site-packages/cbor2/__pycache__/tool.cpython-314.opt-1.pyc /usr/lib/python3.14/site-packages/cbor2/__pycache__/tool.cpython-314.pyc /usr/lib/python3.14/site-packages/cbor2/_cbor2.cpython-314-i386-linux-gnu.so /usr/lib/python3.14/site-packages/cbor2/py.typed /usr/lib/python3.14/site-packages/cbor2/tool.py /usr/share/doc/packages/python314-cbor2 /usr/share/doc/packages/python314-cbor2/README.rst /usr/share/libalternatives/cbor2 /usr/share/libalternatives/cbor2/314.conf /usr/share/licenses/python314-cbor2 /usr/share/licenses/python314-cbor2/LICENSE.txt
Generated by rpm2html 1.8.1
Fabrice Bellet, Sat Nov 7 22:24:24 2026