msgspec-cbor
CBOR (RFC 8949) encoding and decoding for msgspec, backed by cbor2.
msgspec-cbor is a thin, pure-Python bridge that mirrors the msgspec.toml / msgspec.yaml
wrapper modules: it lowers objects with msgspec.to_builtins, hands them to cbor2's native
encoder, and validates decoded output back into your types with msgspec.convert. Rich types
(datetime, bytes, Decimal, UUID, …) travel as real CBOR tags — never base64 or ISO strings.
Install
pip install msgspec-cbor
Usage
import msgspec
import msgspec_cbor
class Point(msgspec.Struct):
x: int
y: int
data = msgspec_cbor.encode(Point(1, 2)) # -> bytes
point = msgspec_cbor.decode(data, type=Point) # -> Point(x=1, y=2)
Omit type= to decode into plain CBOR/Python objects with no validation.
Supported types
The default type table is the intersection of what cbor2 encodes as a native CBOR tag and what
msgspec.convert accepts back — so every rich type round-trips losslessly.
| Python type | On the wire | Notes |
|---|---|---|
int, float, bool, str, None |
native CBOR scalar | |
bytes, bytearray |
byte string (major type 2) | not base64 |
list, tuple |
array (major type 4) | |
dict, msgspec.Struct, dataclass, attrs |
map (major type 5) | |
datetime.datetime |
tag 0 | tz-aware only; naive raises msgspec.EncodeError |
datetime.date |
tag 1004 | |
decimal.Decimal |
tag 4 | |
uuid.UUID |
tag 37 | |
datetime.time |
text string | not natively CBOR; string fallback |
set, frozenset |
array (major type 4) | decode into a set[...]-typed field to coerce back |
fractions.Fraction, datetime.timedelta |
not built in | supply enc_hook / dec_hook if needed |
Malformed input raises msgspec.DecodeError; a shape mismatch against type= raises
msgspec.ValidationError. cbor2's own exceptions never escape the public API.
API
def encode(obj, *, enc_hook=None, order=None) -> bytes: ...
def decode(buf, *, type=Any, strict=True, dec_hook=None) -> Any: ...
The signatures mirror msgspec.toml / msgspec.yaml, so this is a drop-in sibling format.
order accepts msgspec's "deterministic" / "sorted" (lexicographic) plus "canonical", which
emits CBOR canonical length-first key ordering (cbor2's canonical=True) for byte-exact wire formats.
Not affiliated
This is an independent bridge and is not affiliated with or endorsed by the msgspec project.
Attribution
msgspec-cbor is MIT licensed and copies no code from either project.
Metadata
Release files for msgspec-cbor 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| msgspec_cbor-0.2.0.tar.gz | 114.6 kB | With provenance | Details for msgspec_cbor-0.2.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| msgspec_cbor-0.2.0-py3-none-any.whl | Python 3 | none | any | Details for msgspec_cbor-0.2.0-py3-none-any.whl |
Total release size: 119.2 kB
Release files / msgspec_cbor-0.2.0.tar.gz
| Download URL | msgspec_cbor-0.2.0.tar.gz |
|---|---|
| Size | 114.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
4e340d01e533c9190998dd54a460d0c05306f1afb04eccedf77be1c3962c83b5
|
|
BLAKE2b-256 checksum How to use checksums |
216dd74123817748e5588020ce55ad80b8c629bc29250e19fa4c1fe113879bf3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logRelease files / msgspec_cbor-0.2.0-py3-none-any.whl
| Download URL | msgspec_cbor-0.2.0-py3-none-any.whl |
|---|---|
| Size | 4.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
87e506b067bc8a7a0ae60bc307f48f3258b0ace4bd349023ea97d5e6e857d48a
|
|
BLAKE2b-256 checksum How to use checksums |
39eb2da515d6356f972540178fefa09adad57a375604a2fdddbee3c81c7173bb
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logSecurity for msgspec-cbor 0.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for msgspec_cbor-0.2.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 15, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.