[dependabot]

Bumps the production-dependencies group with 2 updates: json5 and msgspec.

Updates json5 from 0.15.0 to 0.17.3

Commits

• 835dc35 Bump to v0.17.3 to pick up a security fix.
• efd1946 Sigh. Re-release again as v0.17.2.
• b9eb909 Re-release as v0.17.1.
• dcb49c0 Merge in changes for v0.17.0 (#120)
• a7ab730 bump version to v0.17.0.dev0
• fad917f update README.md
• 7b14898 rework GitHub CI to do different things on different versions of Python
• 1f4f812 Rework run script and project dependencies.
• 8f70c4c Bump version to v0.16.0.
• b475c55 Update dependencies and fix any newly raised issues.
• Additional commits viewable in compare view

Updates msgspec from 0.21.1 to 0.22.0

Release notes

Sourced from msgspec's releases.

Version 0.22.0 (2026-09-29)

• BREAKING: Setting gc=False on a struct type that has a weakref slot, whether from weakref=True or from a base class, now raises ValueError. On CPython 3.12 and later the weakref slot is stored in a pre-header in front of the instance, so releasing an instance of a gc=False type with that slot corrupted memory, in most builds crashing the interpreter outright. The combination worked on 3.10 and 3.11, and the restriction applies there as well, so that the same class definition behaves the same way on every supported version (#1207).
• Add frozendict support on Python 3.15+ (#1052, #1105).
• Support passing a callable as decimal_format to msgspec.json.Encoder and msgspec.msgpack.Encoder for custom Decimal encoding (#978).
• Support Literal[True] and Literal[False] types (#1004).
• Publish CPython 3.15 wheels, including freethreaded builds (#1152).
• Publish Linux riscv64 wheels (#987).
• Support the PyEmscripten (Pyodide) platform (#1083).
• Fix handling of PEP 695 type parameter syntax (class Foo[T]) and of types.GenericAlias instances in type annotations (#962).
• Fix NameError when creating a Struct with an unquoted forward reference on Python 3.14 (#1165).
• Fix a crash on incorrect typing.ClassVar annotations (#1097).
• Fix an AttributeError when converting to a Struct type defined in a namespace without a __name__ (#1072).
• Fix overriding an inherited field alias back to the field's own name (#1133).
• Raise ValidationError instead of SystemError when convert receives an out-of-range int for a float target (#1162).
• Report raw rather than the misleading any as the expected type when a non-Raw value is given for a Raw field in convert, and therefore in yaml.decode and toml.decode (#1169).
• Fix an empty expected-type name in validation errors for a required Raw field in a TypedDict, or a Raw field with a default_factory on a dataclass or an attrs class (#1176).
• Correct the error messages for out-of-range Meta length bounds (#1172).
• Fix a reference leak when decoding msgpack Ext payloads (#1109).
• Fix backing type declaration of Ext.code (#1135).
• Fix a reference leak in msgspec.to_builtins, and therefore in yaml.encode, for array_like=True structs (#1177).
• Fix reference leaks in typenode_collect_literal, Meta.__rich_repr__, ms_decode_bigint, and Encoder.__init__ (#1021, #1022, #1023, #1040).
• Fix msgspec.inspect.type_info and msgspec.json.schema crashing on mixed-type Literals such as Literal[1, None] (#1080).
• Place null last in the anyOf generated for optional unions in JSON schemas (#1028).
• Fix minItems in the JSON schema for array_like=True structs whose fields are all optional (#1124).
• Use [] or "" rather than a Python set or bytearray object as the JSON schema default for Struct fields with a set or bytearray

... (truncated)

Changelog

Sourced from msgspec's changelog.

Version 0.22.0 (2026-09-29)

• BREAKING: Setting gc=False on a struct type that has a weakref slot, whether from weakref=True or from a base class, now raises ValueError. On CPython 3.12 and later the weakref slot is stored in a pre-header in front of the instance, so releasing an instance of a gc=False type with that slot corrupted memory, in most builds crashing the interpreter outright. The combination worked on 3.10 and 3.11, and the restriction applies there as well, so that the same class definition behaves the same way on every supported version ({pr}1207).
• BREAKING: Encode an object as a dataclass only when its type defines __dataclass_fields__, as dataclasses.is_dataclass does. Objects that expose it only through instance attribute access, such as proxies wrapping a dataclass instance, are now passed to enc_hook, and encoding them raises TypeError when no enc_hook is given. An enc_hook can return the wrapped instance, which is then encoded as a dataclass. Objects with a Python-level __getattr__, such as pydantic models, now reach enc_hook without that __getattr__ being called ({pr}1196).
• Add frozendict support on Python 3.15+ ({pr}1052, {pr}1105).
• Support passing a callable as decimal_format to msgspec.json.Encoder and msgspec.msgpack.Encoder for custom Decimal encoding ({pr}978).
• Support Literal[True] and Literal[False] types ({pr}1004).
• Publish CPython 3.15 wheels, including freethreaded builds ({pr}1152).
• Publish Linux riscv64 wheels ({pr}987).
• Support the PyEmscripten (Pyodide) platform ({pr}1083).
• Fix handling of PEP 695 type parameter syntax (class Foo[T]) and of types.GenericAlias instances in type annotations ({pr}962).
• Fix NameError when creating a Struct with an unquoted forward reference on Python 3.14 ({issue}1165).
• Fix a crash on incorrect typing.ClassVar annotations ({pr}1097).
• Raise TypeError instead of crashing when a base class of a Struct type is a C extension type that has not been initialized with PyType_Ready yet ({pr}1199).
• Fix an AttributeError when converting to a Struct type defined in a namespace without a __name__ ({pr}1072).
• Fix overriding an inherited field alias back to the field's own name ({pr}1133).
• Raise ValidationError instead of SystemError when convert receives an out-of-range int for a float target ({pr}1162).
• Report raw rather than the misleading any as the expected type when a non-Raw value is given for a Raw field in convert, and therefore in yaml.decode and toml.decode ({pr}1169).
• Fix an empty expected-type name in validation errors for a required Raw field in a TypedDict, or a Raw field with a default_factory on a dataclass or an attrs class ({pr}1176).
• Correct the error messages for out-of-range Meta length bounds ({pr}1172).
• Fix a reference leak when decoding msgpack Ext payloads ({pr}1109).
• Fix backing type declaration of Ext.code ({pr}1135).
• Raise DecodeError instead of TypeError when a decoded msgpack map key is

... (truncated)

Commits

• 6d3443f Fix a reference leak of a non-Struct base's type dict (#1199)
• 2f0b50d Correct the reported signatures of several public callables (#1197)
• 8a25471 Skip instance __dataclass_fields__ lookup for non-dataclass types (#1196)
• 7930780 Fix reference leak when defining a Struct type (#1194)
• 55f5cdd fix(msgpack): raise DecodeError for unhashable map keys (#1209)
• b2d1b7a Reject gc=False on struct types with a weakref slot (#1207)
• f2bbec5 Move the unreleased changes into the 0.22.0 changelog (#1211)
• c23e150 Fix json schema defaults for set / bytearray default_factory fields (#1183)
• fed9fc3 Skip recursive type alias test on Windows ARM64 with Python 3.12 (#1210)
• e7552f0 Bump msgpack from 1.2.1 to 1.2.2 (#1202)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions