[dependabot]

Bumps py7zr from 1.1.0 to 1.1.3.

Release notes

Sourced from py7zr's releases.

Release version 1.1.3: Fix multiple vulnerabilities

• CVE-2026-23879: Arbitrary File Write Vulnerability in py7zr (high severity)
  • Harden check of path traversal and enhance test cases to reproduce many attack scenarios.
• CVE-2026-55206: O(n^2) algorithmic complexity DoS in PackInfo._read() in py7zr
  • Enforced variation of the parameter with a limit and optimized calculation algorithm to prevent excessive CPU consumption.
• CVE-2026-55195: py7zr <= 1.1.2: Decompression bomb (zip bomb) denial of service via unchecked extraction size
  • Added check of extraction size and introduced max_extract_size as constructor parameter to guard against excessive decompression.

Update path sanitize

No release notes provided.

Changelog

Sourced from py7zr's changelog.

v1.1.3_

Security

• CVE-2026-23879: Arbitrary File Write Vulnerability in py7zr (high severity)
  • Harden check of path traversal and enhance test cases to reproduce many attack scenarios.
• CVE-2026-55206: O(n^2) algorithmic complexity DoS in PackInfo._read() in py7zr
  • Enforced variation of the parameter with a limit and optimized calculation algorithm to prevent excessive CPU consumption.
• CVE-2026-55195: py7zr <= 1.1.2: Decompression bomb (zip bomb) denial of service via unchecked extraction size
  • Added check of extraction size and introduced max_extract_size as constructor parameter to guard against excessive decompression.

Notes:

• Fixed three security vulnerabilities in the py7zr library.
• Improvements made include path traversal hardening, optimization of CPU-intensive algorithms, and protection against zip bombs.

Fixed

• BufferError when calling Py7zBytesIO.size() (#736,#737)
• fix: extractall() raises TypeError: int() argument must be a string, a bytes-like object or a real number, not 'NoneType' (#734,#735)

Changed

• feat(io): add Py7zIO.close() lifecycle hook called once per extracted file (#699,#732)
• test: Bump dependency [email protected]
• ci: bump numerous actions with SHA256 hash and newer versions (#729,#730)

v1.1.2_

Security

• security: fix Zip-Slip vulnerability by symlink

Removed

• Remove Code of Conduct from repository.

Changed

• remove unused _lzma imports

v1.1.1_

Fixed

• fix: default unix file attributes with proper permissions (#705)

... (truncated)

Commits

• e278bc0 Release v1.1.3: Multiple security fixes
• e4a225b docs: update authors and changelog with recent contributions and security fixes
• 94db766 Merge commit from fork
• d9ee25c Merge commit from fork
• c1c8001 Merge commit from fork
• 7e03185 Merge pull request #732 from SAY-5/feat/issue-699-py7zio-close
• 2de71fb Merge pull request #735 from gaoflow/fix-734-missing-lastwritetime
• f429952 Merge branch 'master' into fork/SAY-5/feat/issue-699-py7zio-close
• b181a4b Merge branch 'master' into fork/gaoflow/fix-734-missing-lastwritetime
• 1534b3f Merge pull request #737 from miurahr/topic/miurahr/fix-pypy-getbuffer
• Additional commits viewable in compare view

[ancongui]

Resolved by #343, merged at f4234f9e481dd9c54e10048a2d67f7216a75f9e1, for Agentic 26.10.1.

Require and lock 1.1.4, which completes the extraction fixes beyond the requested 1.1.3. Replace removed readall() with bounded in-memory extraction.

The combined change preserves compatible provider extras and is qualified as one dependency graph. The resolution record records all requests and the six remaining optional-package advisories. This closes the superseded proposal while retaining its full history.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.