Repository navigation
Update module github.com/fxamacker/cbor/v2 to v2.9.6 - #224
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github.com-fxamacker-cbor-v2-2.x
branch
2 times, most recently
from
September 1, 2026 17:16
79e6060 to
255e7fa
Compare
renovate
Bot
force-pushed
the
renovate/github.com-fxamacker-cbor-v2-2.x
branch
from
September 14, 2026 21:50
255e7fa to
b4a8b08
Compare
renovate
Bot
changed the title
Generated by renovateBot
renovate
Bot
force-pushed
the
renovate/github.com-fxamacker-cbor-v2-2.x
branch
from
October 7, 2026 02:46
b4a8b08 to
926fcc3
Compare
renovate
Bot
changed the title
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.2.0→v2.9.6Release Notes
fxamacker/cbor (github.com/fxamacker/cbor/v2)
v2.9.6Compare Source
v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.
Most of these bugs were identified while improving tests and reviewing code for an upcoming release.
Tests and fuzz tests were extended.
Upgrading to v2.9.6 from all prior versions is recommended.
🐞 Important Fix
Not affected:
map[any]any, and intoany(with unchangedDefaultMapType).For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including
55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #855 for details.Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #827), which was not the intended behavior.
What's Changed
Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.
Decoding
Encoding
CI / GitHub Actions and Docs
Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6
v2.9.5Compare Source
This version was tagged from the wrong branch by mistake and is retracted.
Use v2.9.6 (https://github.com/fxamacker/cbor/releases/tag/v2.9.6) instead.
v2.9.4Compare Source
This release fixes potential panics when decoding a CBOR map whose key decodes to an uncomparable Go value under certain conditions.
Not affected: user apps that don't register tag types and don't use map key types that are either named empty interfaces (e.g.
type MyAny any) or contain interfaces.These potential panics can be encountered when one of these two conditions is met:
TagSetinterface) that is an array or struct with uncomparable orinterface{}element or field type, orThis was identified while improving tests and reviewing code for an upcoming release.
Tests and fuzz tests were extended to cover this bug.
Upgrading to v2.9.4 is recommended.
What's Changed
Full Changelog: fxamacker/cbor@v2.9.3...v2.9.4
v2.9.3Compare Source
This release fixes a potential panic when decoding into a
time.Timefrom a CBOR byte string, map, or array under certain conditions.Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with
timeTag = DecTagRequired.Upgrading to v2.9.3 is recommended.
The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.
What's Changed
Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3
v2.9.2Compare Source
This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.
Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).
The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.
This release passed fuzz tests (billions of execs) and it is production quality.
What's Changed
CI / GitHub Actions and Docs
🔎 Details...
Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2
v2.9.1Compare Source
This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.
🐞 Bug fixes related to the
keyasintfeatureThese changes only affect Go struct fields tagged with
keyasint:math.MaxInt64when decoding CBOR map to a struct withkeyasintfield (PR #757)keyasinttag values (PR #757)🐞 Other bug fixes and defensive checks
Some of the bugs fixed are related to decoding extreme values that cannot be encoded with this library. For example, the decoder checks if epoch time encoded as CBOR float value representing hundreds of billions of years overflows int64(seconds).
NOTE: It is generally good practice to avoid using floating point to store epoch time (even when not using CBOR).
RawMessagefromRawMessage.MarshalCBOR(PR #753)U+FFFDreplacement character (PR #753)What's Changed
TimeRFC3339NanoUTCby @fxamacker in #688CI / GitHub Actions and Docs
🔎 Details...
New Contributors
Full Changelog: fxamacker/cbor@v2.9.0...v2.9.1
v2.9.0Compare Source
v2.9.0 adds new features, refactors tests, and improves docs. New features improve interoperability/transcoding between CBOR & JSON.
v2.9.0 passed fuzz tests and is production quality. However, the new
TextUnmarshalerfeature will continue being fuzz tested a bit longer due to recent changes. The recent changes are limited and don't affect other parts of the codec that passed ~2 billion execs fuzzing.What's Changed
Docs
CI
🔎 Details
Special Thanks
Many thanks to @benluddy for adding these new features! 🎉
New Contributors
Full Changelog: fxamacker/cbor@v2.8.0...v2.9.0
v2.8.0Compare Source
v2.8.0 adds
omitzerostruct tag option, fixes and deprecates 3 functions, and bumps requirements to go 1.20+.Many thanks to @liggitt for contributing the
omitzerosupport!This release fixes 3 functions (when called directly by user apps) to use same error handling on bad input as
cbor.Unmarshal():RawTag.UnmarshalCBOR()(thanks @thomas-fossati for reporting this!)ByteString.UnmarshalCBOR()SimpleValue.UnmarshalCBOR()This release also deprecates those 3 functions because they were initially created for internal use. Please use
Unmarshal()orUnmarshalFirst()instead.To preserve backward compatibility, the deprecated functions were added to fuzz tests and will not be removed in v2.x.
What's Changed
interface{}withanyby @fxamacker in #627reflect.Ptrwithreflect.Pointerby @fxamacker in #628reflect.PtrTowithreflect.PointerToby @fxamacker in #629RawTag.UnmarshalCBOR(), etc. to matchcbor.Unmarshal()by @fxamacker in #645UnmarshalCBOR()forByteString,RawTag,SimpleValueby @fxamacker in #647Other Changes
🔍 Details
New Contributors
Full Changelog: fxamacker/cbor@v2.7.0...v2.8.0
v2.7.1Compare Source
v2.7.1 fixes 3 functions (when called directly by user apps) to use same error handling on bad inputs as
cbor.Unmarshal():ByteString.UnmarshalCBOR()RawTag.UnmarshalCBOR()SimpleValue.UnmarshalCBOR()The above 3 fixed functions are deprecated because they were initially created for internal use. Please use
Unmarshal()orUnmarshalFirst()instead.To preserve backward compatibility, the deprecated functions were added to fuzz tests and will not be removed in v2.x.
Before Upgrading to v2.7.1
v2.8.0 is being fuzz tested and will be released later today. It adds support for
omitzerostruct tag option.v2.7.1 is the last version to support go 1.17-1.19. v2.8.0 and newer releases will require go 1.20+.
What's Changed
Special Thanks
Thanks @thomas-fossati for reporting the bug in
RawTag.UnmarshalCBOR()when it is called directly by user apps providing bad input data!Full Changelog: fxamacker/cbor@v2.7.0...v2.7.1
v2.7.0Compare Source
v2.7.0 (June 23, 2024)
v2.7.0 adds features and improvements that help large projects (e.g. Kubernetes) use CBOR as an alternative to JSON and Protocol Buffers. Other improvements include speedups, improved memory use, bug fixes, decoding/encoding options, etc. Passed 5+ billion execs fuzzing.
Special thanks to @benluddy for contributing features, optimizations, improvements, bug fixes, and discussions! 👍
⭐ Features and Optimizations
cbor.MarshalToBuffer(),UserBufferEncModeinterface, etc. by @fxamacker in #553🛠 Improvements
Most improvements focused on fixing or updating new features. See 🐞 Bug Fixes section for fixes to features already released.
*errors.errorStringwithInadmissibleTagContentTypeErrorby @fxamacker in #552🐞 Bug Fixes
Other changes
Details
Full Changelog
Full Changelog: fxamacker/cbor@v2.6.0...v2.7.0
v2.6.0Compare Source
This release adds important new features, optimizations, bug fixes, and 3 new contributors. Fuzz tests passed 5+ billion execs for CBOR encoding and decoding functions. Minimum officially supported Go is bumped to Go 1.17.
⭐ Features and Optimizations
interface{}as*big.Intby @fxamacker in #456interface{}by @fxamacker in #457anyby @ssuriyan7 in #475🚀 Notable Optimizations
Improve memory allocs 🗜️ and speed 🚀 of encoding maps by using Go 1.18-1.20 features by @dinhxuanvu in #468
📊 Benchmarks
benchstatresults provided by @dinhxuanvuNOTE: Go 1.17 is the minimum version supported by v2.6.0. Go 1.20+ will use optimizations introduced by PR 468.
🛠 Improvements
UnrecognizedTagToAnyoption toTestDecOptionsby @fxamacker in #484🐞 Bug Fixes
*cbor.SimpleValueby @fxamacker in #461📖 Docs and CI
New Contributors
Full Changelog: fxamacker/cbor@v2.5.0...v2.6.0
v2.5.0Compare Source
This release adds important new features, optimizations, bug fixes, and 8 new contributors. Fuzz tests passed 5+ billion execs for CBOR encoding and decoding functions.
Notable changes are split into 3 categories.
⭐ Notable Changes to Review Before Upgrading
These new features and bug fixes were cherry-picked to highlight for review (for projects using older version).
SimpleValuetype to more fully support CBOR Simple Values, including values not assigned by IANA and...ByteStringtype to support CBOR maps with byte string keys because Go doesn't allow []byte as map keysConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.