allow cachebox 6

[braingram]

Closes #601

I saw no usage of API mentioned in the breaking changes for cachebox 6: https://github.com/awolverp/cachebox/releases/tag/v6.0.0

Testing locally with python 3.14 the tests passed except for one:

_______________________________________________________________________________________ TestPicklingSecurity.test_restricted_unpickler_memory_exhaustion_cve ________________________________________________________________________________________

self = <tests.test_serialization.TestPicklingSecurity object at 0x10ba28690>

    @pytest.mark.skipif(sys.platform == "win32", reason="Resource module is Unix-only")
    def test_restricted_unpickler_memory_exhaustion_cve(self):
        """CVE-2026-33155: Prevent DoS via massive allocation through REDUCE opcode.

        The payload calls bytes(10_000_000_000) which is allowed by find_class
        but would allocate ~9.3GB of memory. The fix should reject this before
        the allocation happens.
        """
        import resource

        # 1. Cap memory to 500MB to prevent system freezes during the test
        soft, hard = resource.getrlimit(resource.RLIMIT_AS)
        maxsize_bytes = 500 * 1024 * 1024
>       resource.setrlimit(resource.RLIMIT_AS, (maxsize_bytes, hard))
E       ValueError: current limit exceeds maximum limit

tests/test_serialization.py:241: ValueError

which I suspect is unrelated (and due to the system used for testing).

I wasn't able to run the test suite on python 3.15 since several test/static/dev dependencies (based on the current pins) don't have python 3.15 wheels. However with the changes in this PR I'm able to install deepdiff on python 3.15.

[seperman]

Static review: #637 allow cachebox 6

Summary: Widens the runtime requirement from cachebox>=5.2,<6 to cachebox>=5.2,<7 (pyproject.toml:9) and adds an "Unreleased" CHANGELOG entry. It targets dev and references #601, which is still open.

Overlap with other PRs

• #623 ("Allow CacheBox 6 for Windows ARM64 support") makes the same pyproject.toml change. It targets master, also re-locks uv.lock to cachebox 6.2.6, and has no CHANGELOG entry. Only one of the two is needed.
• No commit already merged on dev touches cachebox.

Security / supply chain

No security concerns found in static review. The diff is one dependency line and one CHANGELOG line, with no lockfile, CI, build or entry-point changes. cachebox 6.x is published on PyPI by the same upstream maintainer as 5.x (awolverp, github.com/awolverp/cachebox) and has no runtime dependencies. The GitHub advisory database lists no advisories for cachebox.

Correctness

• deepdiff uses only LRUCache(maxsize), .get(key, default), .insert(key, value) and key in cache (deepdiff/lfucache.py:2, :18-33). The signatures are the same in the cachebox 5.2.3 and 6.2.6 sources. from cachebox import LRUCache is still exported in 6.x.
• None of the v6.0.0 breaking changes affect deepdiff: copy_level, TTLCache.ttl → global_ttl, removal of cachedmethod, removal of maxmemory, and the new pickle state format. _distance_cache is removed before pickling for multiprocessing (deepdiff/_multiprocessing.py:146), so the pickle-format change should not matter.
• The <7 upper bound follows the project's major-version-cap style.
• uv.lock is not updated. It still pins cachebox 5.2.3 and records specifier = ">=5.2,<6" (uv.lock:554 on dev), so uv lock --check / uv sync --locked will report the lock as stale until it is re-locked. CI is not affected because nox installs from pyproject.toml, not from the lock. CI will now resolve the newest 6.x (currently 6.2.8).
• FYI: cachebox first ships cp315 wheels in 6.1.2 and win_arm64 wheels in 6.2.6. With the floor left at 5.2, resolvers will still pick those versions by default.

Suggestions

• Re-lock uv.lock together with this change, or as a follow-up. The lock update in #623 merges cleanly onto dev in a trial git merge-tree, and its cachebox 6.2.6 hashes match PyPI.

---

AI-assisted static review; the code was not executed.