Update requirements: Bump rarfile from 4.2 to 4.4

[dependabot]

Bumps rarfile from 4.2 to 4.4.

Release notes

Sourced from rarfile's releases.

rarfile v4.4

Security fixes:

• Skip CRC check for some old subblocks. Previously rarfile tried to calculate header CRC by reading data payload for those, but that could cause excessive allocations.

Fixes:

• RAR5: Reattempt passwords after trying wrong password when header encryption is used. [#131]
• Restore fd position in file type detection functions. [#121]

rarfile v4.3

Fixes

• Disallow extraction outside extraction path, in case of existing symlink. [#114]
• Disallow creating symlinks to outside of extraction path. [#118]
• Apply length limit to passwords, so too long password give same result as for unrar.

Changelog

Sourced from rarfile's changelog.

Version 4.4 (2026-07-22)

Security fixes:

• Skip CRC check for some old subblocks. Previously rarfile tried to calculate header CRC by reading data payload for those, but that could cause excessive allocations.

Fixes:

• RAR5: Reattempt passwords after trying wrong password when header encryption is used. [[#131](https://github.com/markokr/rarfile/issues/131) <https://github.com/markokr/rarfile/pull/131>_]

• Restore fd position in file type detection functions. [[#121](https://github.com/markokr/rarfile/issues/121) <https://github.com/markokr/rarfile/pull/121>_]

Version 4.3 (2026-07-08)

Security fixes:

• Disallow extraction outside extraction path, in case of existing symlink. [[#114](https://github.com/markokr/rarfile/issues/114) <https://github.com/markokr/rarfile/pull/114>_]

• Disallow creating symlinks to outside of extraction path. [[#118](https://github.com/markokr/rarfile/issues/118) <https://github.com/markokr/rarfile/pull/118>_]

Fixes:

• Apply length limit to passwords, so too long password give same result as for unrar.

Commits

• d106d20 Refresh news.rst
• 8ab9f71 ci: restore CI on push
• 1b3db89 v4.4
• c94c969 Skip CRC check for some old subblocks.
• e2c0d6e Reattempt passwords
• cc6368e build(deps): bump tox from 4.53.1 to 4.56.1
• 0b3d453 dependabot: drop unnecessary etc
• edb967c build(deps): bump actions/checkout from 4 to 7
• 79bd2e4 build(deps): bump twine from 5.1.1 to 6.2.0
• 1c0c6a6 build(deps): bump actions/upload-artifact from 4 to 7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)