Skip to content

Bump rarfile from 4.2 to 4.3#22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/rarfile-4.3
Open

Bump rarfile from 4.2 to 4.3#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/rarfile-4.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor

Bumps rarfile from 4.2 to 4.3.

Release notes

Sourced from rarfile's releases.

rarfile v4.3

Fixes

  • Disallow extraction outside extraction path, in case of existing symlink. [#114]
  • Disallow creating symlinks to outside of extraction path. [#118]
  • Apply length limit to passwords, so too long password give same result as for unrar.
Changelog

Sourced from rarfile's changelog.

Version 4.3 (2026-07-08)

Fixes

  • Disallow extraction outside extraction path, in case of existing symlink. [[#114](https://github.com/markokr/rarfile/issues/114) <https://github.com/markokr/rarfile/pull/114>_]

  • Disallow creating symlinks to outside of extraction path. [[#118](https://github.com/markokr/rarfile/issues/118) <https://github.com/markokr/rarfile/pull/118>_]

  • Apply length limit to passwords, so too long password give same result as for unrar.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 17, 2026
Bumps [rarfile](https://github.com/markokr/rarfile) from 4.2 to 4.3.
- [Release notes](https://github.com/markokr/rarfile/releases)
- [Changelog](https://github.com/markokr/rarfile/blob/master/doc/news.rst)
- [Commits](markokr/rarfile@v4.2...v4.3)

---
updated-dependencies:
- dependency-name: rarfile
  dependency-version: '4.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/rarfile-4.3 branch from e03cc33 to df67969 Compare July 17, 2026 19:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants