From 144a83ba8e30ad7edb2fb9512ccc276008c67074 Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Mon, 26 Oct 2026 19:02:22 +0100 Subject: [PATCH] support msgpack 1.2.4 msgpack 1.2.4 limits container preallocation in the C unpacker to 10000 items, so a large declared array/map length can no longer force an excessive memory allocation (GHSA-j8c6-9vc5-hj6x). max_array_len and max_map_len still limit the total container size. The other changes only affect the pure Python fallback unpacker, which borg does not use. Co-Authored-By: Claude Opus 5.5 --- pyproject.toml | 2 +- src/borg/helpers/msgpack.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 58527d27d5..c8c82ef8e0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -32,7 +32,7 @@ license-files = ["LICENSE", "AUTHORS"] dependencies = [ "borghash ~= 0.2.0", "borgstore[rest,blake3] ~= 0.7.0", - "msgpack >=1.0.3, <=1.2.3", + "msgpack >=1.0.3, <=1.2.4", "packaging", "platformdirs >=3.0.0, <5.0.0; sys_platform == 'darwin'", # for macOS: breaking changes in 3.0.0. "platformdirs >=2.6.0, <5.0.0; sys_platform != 'darwin'", # for others: 2.6+ works consistently. diff --git a/src/borg/helpers/msgpack.py b/src/borg/helpers/msgpack.py index d1b802ec42..0e44df7d5d 100644 --- a/src/borg/helpers/msgpack.py +++ b/src/borg/helpers/msgpack.py @@ -219,7 +219,7 @@ def is_supported_msgpack(): if msgpack.version in []: # < add bad releases here to deny list return False - return (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 3) + return (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 4) def get_limited_unpacker(kind):