deps: update msgpack requirement from >=1.2.2 to >=1.2.3

[dependabot]

Updates the requirements on msgpack to permit the latest version.

Release notes

Sourced from msgpack's releases.

v1.2.3

What's Changed

• Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
• wheels: also build for pyodide using emscripten. by @​mr-c in msgpack/msgpack-python#732
• Support packing Python 3.15 frozentdict (PEP 814) by @​edgarrmondragon in msgpack/msgpack-python#738
• Reject negative array and map header sizes by @​jakezwang in msgpack/msgpack-python#742
• Bump the all-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in msgpack/msgpack-python#741

New Contributors

• @​mr-c made their first contribution in msgpack/msgpack-python#732
• @​jakezwang made their first contribution in msgpack/msgpack-python#742

Full Changelog: msgpack/msgpack-python@v1.2.2...v1.2.3

Changelog

Sourced from msgpack's changelog.

1.2.3

Release Date: 2026-09-29

• Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
• Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip() after previously unpacking a nested object in the C extension.
• Raise ValueError in the C extension when switching between unpacking, skipping, header readers, or read_bytes() while an object is incomplete. Resume with the same method after feeding more data; unpack() and iteration remain interchangeable.
• Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization of the same C Unpacker while unpacking is in progress.
• Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #742
• Support packing Python 3.15 frozendict objects. #738
• Update Cython from 3.2.5 to 3.3.0. #738
• Build wheels for Pyodide using Emscripten. #732
• Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #741

1.2.2

Release Date: 2026-08-27

• Fix the read_size documentation. #700
• Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701
• Prevent reentrant calls to Unpacker.feed() while unpacking. #704
• Improve error handling and reporting in unpacking functions. #707
• Fix Timestamp.from_datetime() precision for far-future datetimes. #710
• Fix typos in the documentation. #712
• Validate the nanoseconds range when unpacking timestamps in the C extension. #716
• Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #722
• Prevent a buffer overflow when converting Packer's buf_size. #726
• Translate RecursionError to StackError in the fallback Unpacker.skip(). #727
• Raise OverflowError when use_single_float=True cannot represent a value. #728

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

1.2.0

Release Date: 2026-06-11

... (truncated)

Commits

• 742cb6d release v1.2.3
• 620b0eb Merge commit from fork
• 475c1b7 Bump the all-dependencies group across 1 directory with 2 updates (#741)
• 0014ca9 Reject negative array and map header sizes (#742)
• 7a63920 Support packing Python 3.15 frozentdict (PEP 814) (#738)
• 9f4909c wheels: also build for pyodide using emscripten. (#732)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)