chore(deps): update indirect go modules - #3302

v0.26.0

Compare Source

What's Changed

• Add checker conformance tests for type parameter deduction for type(t) by @​l46kok in #​529
• Add conformance tests around type decaying by @​l46kok in #​530
• Add basic conformance tests for the sets extension by @​jnthntatum in #​533
• Upstream internal fixes by @​jnthntatum in #​534
• Expect an error for IPv4-mapped IPv6 equality in network_ext tests by @​doxxx93 in #​535
• Remove deprecated strong enum sections and unbound function short-circuit by @​maskri17 in #​532
• Align timestamp and duration bounds with protobuf well-known types by @​l46kok in #​536
• Add conformance tests for nested optionals and optional equality by @​l46kok in #​537
• Add conformance tests for NaN and -0.0 comparisons by @​l46kok in #​538

New Contributors

• @​doxxx93 made their first contribution in #​535
• @​maskri17 made their first contribution in #​532

Full Changelog: cel-expr/cel-spec@v0.25.3...v0.26.0

v3.14.0

Compare Source

v2.10.0

Compare Source

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

• CBOR Speedup by Data Type: groups of different benchmarks summarized per row
• CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types

CBOR Speedup by Data Type

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #​870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

• bw_lex = SortBytewiseLexical. Memory improvements are from #​774 and #​860.

Upgrade Notes

• Go 1.24 or newer is required (#​773). All tests (97.7% coverage) pass on Go 1.24-1.27.
• Pointer-receiver marshal methods (user-implemented methods) are called on the original value instead of a copy when the value is addressable (#​866).
• Marshal configured to use TagsForbidden returns an error for a big.Int outside [-2^64, 2^64-1], and EncMode creation returns an error for settings that would emit tags if TagsForbidden is also set (#​868).
• Decoder advances past well-formed data items rejected by DecOptions value or serialization restrictions (e.g. NaN, IndefLength), and Skip skips them without an error (#​872).
• Marshal configured to emit text-based time returns an error for time.Time outside RFC 3339 limits (#​873).

TinyGo (experimental)

TinyGo support for v2.10.0 is available in tag tinygo-beta/v2.10.0-tinygo0.42 (branch feature/cbor-tinygo-beta). It requires TinyGo 0.42.0 or newer. It is experimental and not fuzz tested. For details, see TinyGo (https://github.com/fxamacker/cbor#tinygo) in the README.

What's Changed

⭐ Features

• feat: add toindefarray struct tag option for CBOR indefinite-length arrays by @​tdnguyenND in #​770

🚀 Optimizations

• Optimize encoding speed primarily for slices, maps, and structs by @​fxamacker in #​806
• Reduce decoding time up to 17% for all CBOR data types by @​fxamacker in #​807
• Reduce decoding time by inlining well-formedness checks by @​fxamacker in #​810
• Optimize decoding CBOR byte string by @​fxamacker in #​811
• Optimize decoding CBOR text string by up to 16% by @​fxamacker in #​812
• Reduce allocs and bound memory of keyValue pool by @​fxamacker in #​860
• Reduce allocations when encoding addressable values by @​fxamacker in #​866
• Add reflection-free encoding for common types (up to 2.8x faster) by @​fxamacker in #​870
• Reduce allocs to speed up time.Time, Tag, and big.Int by @​fxamacker in #​886

🛠 Improvements

• Update to require go 1.24 and modernize code by @​fxamacker in #​773
• Refactor to use slices.SortFunc (Go 1.21+) by @​fxamacker in #​774
• Small refactor and cleanups by @​fxamacker in #​815
• Refactor encoding functions to prepare for reflection-free path by @​fxamacker in #​861
• Refactor struct field sorter to use slices.SortFunc by @​fxamacker in #​877

🐞 Bug Fixes

• Enforce TagsForbidden for bignums and ByteSliceLaterFormat by @​fxamacker in #​868
• Advance Decoder past restricted CBOR data items by @​fxamacker in #​872
• Reject marshaling out-of-range time.Time to RFC 3339 by @​fxamacker in #​873
• Fix some error messages returned by EncMode() and DecMode() by @​fxamacker in #​883
• Fix float range check when decoding Unix time by @​fxamacker in #​889

🧪 Testing

• Shorten benchmark names by @​fxamacker in #​816
• Move tests and helpers to new files by @​fxamacker in #​878
• Add checkMarshal test helpers by @​fxamacker in #​879
• Add checkUnmarshal test helpers by @​fxamacker in #​881
• Add test helpers for modes, tags, and round trips by @​fxamacker in #​884
• Refactor invalid option tests to table-driven tests by @​fxamacker in #​885
• Add checkNoError and checkErrorCase test helpers by @​fxamacker in #​887
• Standardize test failure messages and fix several test bugs by @​fxamacker in #​888
• Add more benchmarks by @​fxamacker in #​891

📖 Documentation

• Update comments to use newer terminology by @​fxamacker in #​779
• Update TinyGo section in README.md by @​fxamacker in #​793
• Update doc.go and README.md for v2.10.0 by @​fxamacker in #​890

📖 Contributing Guidelines, Security Policy, and Templates

• Update PR template to clarify approval requirement by @​fxamacker in #​849
• Rewrite security policy and reporting guidelines by @​fxamacker in #​864
• Rewrite PR template to reduce risks from AI and uncoordinated PRs by @​fxamacker in #​865
• Rewrite bug report form to reduce security risks by @​fxamacker in #​867
• Rewrite feature request form to help triage and reduce risks by @​fxamacker in #​869
• Replace docs issue template with an issue form by @​fxamacker in #​874
• Update security policy, PR template, and issue forms by @​fxamacker in #​875
• Update CONTRIBUTING.md to reduce risks by @​fxamacker in #​862
• Improve issue forms for triage and previews by @​fxamacker in #​880

CI / GitHub Actions

Other Changes

• Use a security-hardened .gitignore by @​fxamacker in #​826

Ported from release-2.9

Already released in v2.9.3 through v2.9.6.

Dependabot Updates

New Contributors

• @​tdnguyenND made their first contributihttps://github.com/fxamacker/cbor/pull/770ll/770

Full Changelog: fxamacker/cbor@v2.9.6...v2.10.0

v2.9.6

Compare Source

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

For use cases outside the "not affected by this bug" list below, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #​855 for details.

Not affected by this bug:

• Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
• Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
• Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
• Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #​827), which was not the intended behavior.

🛠 Bug fixes

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

• Skip CBOR data item when destination struct has incorrect tags by @​fxamacker in #​821
• Fix decoding CBOR null/undefined to interface value by @​fxamacker in #​827
• Fix decoding to unaddressable value in interface by @​fxamacker in #​828
• Improve the DefaultByteStringType check by @​fxamacker in #​829
• Fix decodi

[!IMPORTANT]
✂ PR body was truncated to here.