chore(deps-dev): bump py7zr from 1.1.3 to 1.1.4

[dependabot]

Bumps py7zr from 1.1.3 to 1.1.4.

Release notes

Sourced from py7zr's releases.

Fix multiple Vulnerbilities and bugs

• Fix arbitrary file write outside the extraction directory   (GHSA-jwx8-hv8g-gjjq).
• Fix memory exhaustion when opening a crafted archive header   (GHSA-6pr6-cqpq-x889).
• Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Changelog

Sourced from py7zr's changelog.

v1.1.4_

Security

• Fix arbitrary file write above the extraction directory via a symlink chain (incomplete fix of CVE-2026-23879, GHSA-jwx8-hv8g-gjjq).
  • canonical_path() cancelled .. lexically before any symlink was resolved, so link/.. was treated as the directory holding link instead of the parent of its target. A chain of symlink members extracted from the same archive could therefore redirect a later write an archive-chosen number of levels above the extraction directory, while the member name still reduced to something apparently inside it.
  • Containment is now decided on the real path: symlink components are followed first and .. is normalized only afterwards. This also covers symlink targets, which may legitimately contain .. and so cannot be rejected by name.
  • Archive member names containing a .. component are now rejected outright.
• Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).
• Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Users are encouraged to upgrade. Details will be published in the corresponding security advisories.

Fixed

• Raise PasswordRequired when an archive is opened in write or append mode with a crypto filter (e.g. FILTER_CRYPTO_AES256_SHA256) but no password, instead of failing later with an AttributeError. The check also covers direct use of SevenZipCompressor. (#723, #739)
• Limit concurrent extraction workers for non-solid archives to os.cpu_count(), instead of starting one thread or process per folder. When the limit is reached, the oldest task is joined before a new one starts. (#630, #740)
• Fix AttributeError in archiveinfo() for archives with no compressed content, such as an empty archive or one containing only empty files or directories. _get_method_names(), _is_solid() and archiveinfo() now handle header.main_streams being None. (#665, #741)
• Fix intermittent false negatives in the relative-path check on Windows. Path.resolve() may or may not return the extended-length prefix (\\?\), and when only one of the compared paths had it, the relative_to check always failed. The prefix is now stripped before comparison. (#714, #743)
• Fix io.UnsupportedOperation in extract() and extractall() when a WriterFactory returns a non-seekable handle, such as one from zipfile.ZipFile.open. The unnecessary seek(0) after decompression is removed, and MemIO.close() now rewinds only

... (truncated)

Commits

• c717d21 Release version 1.1.4 to fix multiple vulnerabilities and bugs
• c51e4f6 Merge commit from fork
• f4204fa Merge commit from fork
• 5c78459 Merge commit from fork
• 23610d1 fix: raise Bad7zFile when decompression makes no progress
• f3e4862 fix: enhance path sanitization and symlink resolution to prevent directory tr...
• e41864c docs: update SECURITY.rst with threat model, hardening measures, and regressi...
• 8ff8a30 docs: add guidelines for writing and organizing security regression tests
• 0a3c81e tests: add malformed header tests into test_badheaders.py and enhance coverage
• 3e37932 feat: add boundary checks for truncated reads in read_byte, read_uint64, ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: deps, poetry. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[lab700xdev]

Verified on top of current main (merged locally, including the urllib3 2.8.0 fix):

• Dev-only dependency (used to build the 7z corpus case); does not ship to users.
• Lock diff is isolated to py7zr, plus the generator header moving to Poetry 2.5.1. poetry check --lock passes.
• pytest --cov-fail-under=85: 1498 passed, 93.79% coverage.
• CLI regression snapshot (help, version, info, all scan formats, --strict, --lint, --no-fail-on-risk, diff, error paths, exit codes): byte-identical to main.