Skip to content

Upgrading msgpack 0.6 to 1

Breaking0.6.2 → 1.2.4Breaking3Security3Platform6New7Changed20Fixed37Other81

Full comparisonBack to msgpack
BreakingUpgrade verdict

3 breaking changes and 6 platform requirement changes and 3 security fixes.

In plain terms
  • The fast C version of the library no longer works on Python 2; only the pure-Python fallback still does.
  • You can no longer pass an `encoding` setting when packing or unpacking data.
  • Objects that only implement the legacy buffer protocol can no longer be packed directly.
  • This version no longer runs on Python 3.9; you need a newer Python.
Must act Top 5 of 12 that need code or config changes

Requires Python >=3.10 from 1.2.0rc1 (none stated before).

What you must change

Breaking3
Removes Python 2 support from the msgpack/_cmsgpack C extension, while msgpack/fallback still supports Python 2.
msgpack/_cmsgpackmsgpack/fallback
1.0.0CHANGELOG.mdSummarizedView source
Removes the encoding option from the Packer and Unpacker.
PackerUnpackerencoding
1.0.0CHANGELOG.mdSummarizedView source
Drops support for the old buffer protocol.
1.0.0CHANGELOG.mdSummarizedView source
Security3
Fixes memory leaks in the C extension when map key validation or container hooks fail.
High · CVSS 7.5
1.2.3GitHub ReleaseSummarizedView source
Fixes a use-after-free in the unpackb() ExtraData path for non-contiguous input.
unpackb()ExtraData
1.2.2GitHub ReleaseSummarizedView source
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
High · CVSS 7.5
1.2.1GitHub AdvisoryOriginalView source
Platform6
Drops support for Python 3.9.
1.2.0GitHub ReleaseSummarizedView source
Adds experimental support for Python 3.13.
1.1.0GitHub ReleaseSummarizedView source
Drops Python 2 support.
1.0.6GitHub ReleaseSummarizedView source
Drops Python 3.6 support.
1.0.6GitHub ReleaseSummarizedView source
Adds support for Python 3.11 (beta).
1.0.4GitHub ReleaseSummarizedView source
Supports Python 3.10 and drops Python 3.5.
1.0.3GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • removed: class ExtType(namedtuple('ExtType', 'code data'))
  • removed: export version
  • added: export ExtType
  • added: export Timestamp
  • added: variable version
  • added: class ExtType(namedtuple('ExtType', 'code data'))
  • added: class Timestamp
  • added: constructor Timestamp(seconds, nanoseconds=…)
  • added: method Timestamp.to_bytes()
  • added: method Timestamp.to_datetime()
  • added: method Timestamp.to_unix()
  • added: method Timestamp.to_unix_nano()
  • added: static method Timestamp.from_bytes(b)
  • added: static method Timestamp.from_datetime(dt)
  • added: static method Timestamp.from_unix(unix_sec)
  • added: static method Timestamp.from_unix_nano(unix_ns)
  • removed: class StringIO(object)
  • removed: constructor StringIO(s=…)
  • removed: function dict_iteritems(d)
  • removed: function unpack(stream, **kwargs)
  • removed: method StringIO.getvalue()
  • removed: method StringIO.write(s)
  • removed: variable PY2
  • removed: variable RecursionError
  • removed: variable USING_STRINGBUILDER
  • removed: variable int_types
  • removed: variable newlist_hint
  • removed: variable unicode
  • removed: variable xrange
  • changed: class Packer(object) → class Packer
  • changed: class Unpacker(object) → class Unpacker
  • changed: constructor Packer(default=…, encoding=…, unicode_errors=…, use_single_float=…, autoreset=…, use_bin_type=…, strict_types=…) → constructor Packer(*, default=…, use_single_float=…, autoreset=…, use_bin_type=…, strict_types=…, datetime=…, unicode_errors=…, buf_size=…)
  • changed: constructor Unpacker(file_like=…, read_size=…, use_list=…, raw=…, strict_map_key=…, object_hook=…, object_pairs_hook=…, list_hook=…, encoding=…, unicode_errors=…, max_buffer_size=…, ext_hook=…, max_str_len=…, max_bin_len=…, max_array_len=…, max_map_len=…, max_ext_len=…) → constructor Unpacker(file_like=…, *, read_size=…, use_list=…, raw=…, timestamp=…, strict_map_key=…, object_hook=…, object_pairs_hook=…, list_hook=…, unicode_errors=…, max_buffer_size=…, ext_hook=…, max_str_len=…, max_bin_len=…, max_array_len=…, max_map_len=…, max_ext_len=…)
  • added: class BytesIO
  • added: class frozendict
  • added: constructor BytesIO(s=…)
  • added: function newlist_hint(size)
  • added: method BytesIO.getvalue()
  • added: method BytesIO.write(s)
  • added: variable frozendict