`URLSafeSerializer.dumps` may return `bytes`

[stgn]

>>> import msgpack
>>> from itsdangerous import URLSafeSerializer
>>> s = URLSafeSerializer("secret")
>>> s.dumps({"id": 123})
'eyJpZCI6MTIzfQ.UIuiA6AeHCMVakMgReamCo8eHes'
>>> s = URLSafeSerializer("secret", serializer=msgpack) 
>>> s.dumps({"id": 123})
b'gaJpZHs.5dxbKqWJ035xXL4QPY7qC6d2WS4'

I'm assuming this is unintentional.

Additionally, typing information states that the return type of URLSafeSerializer.dumps is str, since URLSafeSerializer is a subclass of Serializer[str]. Evidently, this is false.

Environment:

• Python version: 3.13
• ItsDangerous version: 2.2.0

[davidism]

It returns whatever the serializer returns. You can write a wrapper if you want msgpack to return str instead. Happy to review a PR if the types are not expressed properly.

[RazerM]

I just ran into this issue by opting some existing code into type checking. I don't think I can wrap a serializer like cbor2/msgpack to return str since they're not valid as strings until URLSafeSerializerMixin encodes to base64.