Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 1, 2025

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.


This PR contains the following updates:

Package Change Age Confidence
github.com/fxamacker/cbor/v2 v2.2.0 -> v2.9.0 age confidence

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.0

Compare Source

v2.9.0 adds new features, refactors tests, and improves docs. New features improve interoperability/transcoding between CBOR & JSON.

v2.9.0 passed fuzz tests and is production quality. However, the new TextUnmarshaler feature will continue being fuzz tested a bit longer due to recent changes. The recent changes are limited and don't affect other parts of the codec that passed ~2 billion execs fuzzing.

What's Changed

Docs

CI

🔎 Details

Special Thanks

Many thanks to @​benluddy for adding these new features! 🎉

  • Add opt-in support for encoding.TextMarshaler and encoding.TextUnmarshaler to encode and decode from CBOR text string.
  • Add opt-in support for json.Marshaler and json.Unmarshaler via user-provided transcoding function.

New Contributors

Full Changelog: fxamacker/cbor@v2.8.0...v2.9.0

v2.8.0

Compare Source

v2.8.0 adds omitzero struct tag option, fixes and deprecates 3 functions, and bumps requirements to go 1.20+.

Many thanks to @​liggitt for contributing the omitzero support!

The "omitzero" option omits zero values from encoding, matching stdlib encoding/json behavior.
When specified in the cbor tag, the option is always honored.
When specified in the json tag, the option is honored when building with Go 1.24+.

This release fixes 3 functions (when called directly by user apps) to use same error handling on bad input as cbor.Unmarshal():

  • RawTag.UnmarshalCBOR() (thanks @​thomas-fossati for reporting this!)
  • ByteString.UnmarshalCBOR()
  • SimpleValue.UnmarshalCBOR()

This release also deprecates those 3 functions because they were initially created for internal use. Please use Unmarshal() or UnmarshalFirst() instead.

To preserve backward compatibility, the deprecated functions were added to fuzz tests and will not be removed in v2.x.

What's Changed

Other Changes
🔍 Details

New Contributors

Full Changelog: fxamacker/cbor@v2.7.0...v2.8.0

v2.7.1

Compare Source

v2.7.1 fixes 3 functions (when called directly by user apps) to use same error handling on bad inputs as cbor.Unmarshal():

  • ByteString.UnmarshalCBOR()
  • RawTag.UnmarshalCBOR()
  • SimpleValue.UnmarshalCBOR()

The above 3 fixed functions are deprecated because they were initially created for internal use. Please use Unmarshal() or UnmarshalFirst() instead.

To preserve backward compatibility, the deprecated functions were added to fuzz tests and will not be removed in v2.x.

Before Upgrading to v2.7.1

v2.8.0 is being fuzz tested and will be released later today. It adds support for omitzero struct tag option.

v2.7.1 is the last version to support go 1.17-1.19. v2.8.0 and newer releases will require go 1.20+.

What's Changed

Special Thanks

Thanks @​thomas-fossati for reporting the bug in RawTag.UnmarshalCBOR() when it is called directly by user apps providing bad input data!

Full Changelog: fxamacker/cbor@v2.7.0...v2.7.1

v2.7.0

Compare Source

v2.7.0 (June 23, 2024)

v2.7.0 adds features and improvements that help large projects (e.g. Kubernetes) use CBOR as an alternative to JSON and Protocol Buffers. Other improvements include speedups, improved memory use, bug fixes, decoding/encoding options, etc. Passed 5+ billion execs fuzzing.

Special thanks to @​benluddy for contributing features, optimizations, improvements, bug fixes, and discussions! 👍

⭐ Features and Optimizations

🛠 Improvements

Most improvements focused on fixing or updating new features. See 🐞 Bug Fixes section for fixes to features already released.

🐞 Bug Fixes

Other changes

Details

Full Changelog

Full Changelog: fxamacker/cbor@v2.6.0...v2.7.0

v2.6.0

Compare Source

This release adds important new features, optimizations, bug fixes, and 3 new contributors. Fuzz tests passed 5+ billion execs for CBOR encoding and decoding functions. Minimum officially supported Go is bumped to Go 1.17.

⭐ Features and Optimizations

🚀 Notable Optimizations

  • Improve memory allocs 🗜️ and speed 🚀 of encoding maps by using Go 1.18-1.20 features by @​dinhxuanvu in #​468

    📊 Benchmarks

    benchstat results provided by @​dinhxuanvu

    Screenshot of CBOR benchmarks

    NOTE: Go 1.17 is the minimum version supported by v2.6.0. Go 1.20+ will use optimizations introduced by PR 468.

🛠 Improvements

🐞 Bug Fixes

📖 Docs and CI

New Contributors

Full Changelog: fxamacker/cbor@v2.5.0...v2.6.0

v2.5.0

Compare Source

This release adds important new features, optimizations, bug fixes, and 8 new contributors. Fuzz tests passed 5+ billion execs for CBOR encoding and decoding functions.

Notable changes are split into 3 categories.

⭐ Notable Changes to Review Before Upgrading

These new features and bug fixes were cherry-picked to highlight for review (for projects using older version).

  • PR 370: Add SimpleValue type to more fully support CBOR Simple Values, including values not assigned by IANA and...
  • PR 376: Add ByteString type to support CBOR maps with byte string keys because Go doesn't allow []byte as map keys and...
  • PR 379: Make Decoder.Decode() return io.ErrUnexpectedEOF instead of io.EOF on EOF if current CBOR data item is incomplete.
  • PR 380: Make Unmarshal() and Valid() return cbor.ExtraneousDataError (instead of ignoring extraneous data if any remain).
  • PR 387: Retry in Decoder if io.Reader's Read() returns 0 bytes read with nil error. Add tests to get 100% code coverage for stream.go.

⭐ More Notable Changes

  • PR 342: Add DecOptions.UTF8 to decode invalid UTF-8. Default is unchanged (reject invalid UTF-8 and return error).
  • PR 355 Allow MaxNestedLevels setting to be configured up to 65535.
  • PR 352, 377: Add EncOptions.NilContainersMode to encode nil Go maps and slices as either CBOR nil (default) or empty container.
  • PR 381: Add Decoder.Skip() to skip CBOR data item in CBOR Sequences (RFC 8742).
  • PR 386 Add functions for Extended Diagnostic Notation (RFC 8610 Appendix G).
  • PR 398 Add UnmarshalFirst() to decode CBOR data item and also return remaining bytes.
  • PR 400 Deprecate Valid and add Wellformed to replace it.
  • PR 402 Add UnmarshalFirst() to DecMode interface.
  • PR 412 Add Decoder.Buffered to return remaining data in buffer.

🚀 Notable Changes Affecting Speed or Memory Use

  • PR 335: Reuse underlying array if RawMessage has sufficient capacity.
  • PR 382: Return buffer to pool in Encode(). It adds a bit of overhead to Encode() but NewEncoder().Encode() is faster and uses less memory.
Benchmark comparison for PR 382 shows significant improvement in speed and memory use.
🚀 (click to expand) 🚀

Benchmarks provided by @​x448 for NewEncoder().Encode() optimized in PR 382.

$ benchstat bench-v2.4.0.log bench-f9e6291.log 
goos: linux
goarch: amd64
pkg: github.com/fxamacker/cbor/v2
cpu: 12th Gen Intel(R) Core(TM) i7-12700H
                                                     │ bench-v2.4.0.log │  bench-f9e6291.log                  │
                                                     │      sec/op      │   sec/op     vs base                │
NewEncoderEncode/Go_bool_to_CBOR_bool-20                   236.70n ± 2%   58.04n ± 1%  -75.48% (p=0.000 n=10)
NewEncoderEncode/Go_uint64_to_CBOR_positive_int-20         238.00n ± 2%   63.93n ± 1%  -73.14% (p=0.000 n=10)
NewEncoderEncode/Go_int64_to_CBOR_negative_int-20          238.65n ± 2%   64.88n ± 1%  -72.81% (p=0.000 n=10)
NewEncoderEncode/Go_float64_to_CBOR_float-20               242.00n ± 2%   63.00n ± 1%  -73.97% (p=0.000 n=10)
NewEncoderEncode/Go_[]uint8_to_CBOR_bytes-20               245.60n ± 1%   68.55n ± 1%  -72.09% (p=0.000 n=10)
NewEncoderEncode/Go_string_to_CBOR_text-20                 243.20n ± 3%   68.39n ± 1%  -71.88% (p=0.000 n=10)
NewEncoderEncode/Go_[]int_to_CBOR_array-20                 563.0n ± 2%    378.3n ± 0%  -32.81% (p=0.000 n=10)
NewEncoderEncode/Go_map[string]string_to_CBOR_map-20       2.043µ ± 2%    1.906µ ± 2%   -6.75% (p=0.000 n=10)
geomean                                                    349.7n         122.7n       -64.92%

                                                     │ bench-v2.4.0.log │    bench-f9e6291.log                │
                                                     │       B/op       │    B/op     vs base                 │
NewEncoderEncode/Go_bool_to_CBOR_bool-20                     128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_uint64_to_CBOR_positive_int-20           128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_int64_to_CBOR_negative_int-20            128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_float64_to_CBOR_float-20                 128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_[]uint8_to_CBOR_bytes-20                 128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_string_to_CBOR_text-20                   128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_[]int_to_CBOR_array-20                   128.0 ± 0%     0.0 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_map[string]string_to_CBOR_map-20         544.0 ± 0%   416.0 ± 0%   -23.53% (p=0.000 n=10)
geomean                                                      153.4                    ?                       ¹ ²
¹ summaries must be >0 to compute geomean
² ratios must be >0 to compute geomean

                                                     │ bench-v2.4.0.log │    bench-f9e6291.log                │
                                                     │    allocs/op     │ allocs/op   vs base                 │
NewEncoderEncode/Go_bool_to_CBOR_bool-20                     2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_uint64_to_CBOR_positive_int-20           2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_int64_to_CBOR_negative_int-20            2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_float64_to_CBOR_float-20                 2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_[]uint8_to_CBOR_bytes-20                 2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_string_to_CBOR_text-20                   2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_[]int_to_CBOR_array-20                   2.000 ± 0%   0.000 ± 0%  -100.00% (p=0.000 n=10)
NewEncoderEncode/Go_map[string]string_to_CBOR_map-20         28.00 ± 0%   26.00 ± 0%    -7.14% (p=0.000 n=10)
geomean                                                      2.782                    ?                       ¹ ²
¹ summaries must be >0 to compute geomean
² ratios must be >0 to compute geomean

What's Changed

All merged pull requests are listed here (including the already highlighted ones).

(click to expand)
Changes to Code

Most coding changes here were already mentioned.

Changes to CI, Comments, and Docs

New Contributors (alphabetically)

Non-coding contibutions were made by opening notable issues that directly or indirectly improved this release.

  • @​burdiyan opened issue and followups that led to Encode() returning buffer to pool as default behavior.
  • @​espoal opened issue and followups that led to adding Skip() feature for CBOR Sequences (RFC 8742).
  • @​immesys opened multiple issues and provided helpful feedback in addition to merged PRs.
  • @​qmuntal opened issue and @​x448 added feedback that led to improved support for CBOR Simple Values.
  • @​x448 opened multiple issues and provided helpful feedback in addition to merged PRs.
  • @​zensh opened multiple issues and provided helpful feedback in addition to merged PRs.

Full Changelog: fxamacker/cbor@v2.4.0...v2.5.0

v2.4.0: (January 3, 2022)

Compare Source

This release adds two user-requested features to the decoder. It passed 3+ billion execs fuzzing before being tagged.

What's Changed

Special Thanks


Configuration

📅 Schedule: Branch creation - "on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

sonarqubecloud bot commented Jun 1, 2025

@renovate renovate bot force-pushed the renovate/github.com-fxamacker-cbor-v2-2.x branch from 338dc5a to 6998444 Compare July 14, 2025 11:38
@renovate renovate bot changed the title fix(deps): update module github.com/fxamacker/cbor/v2 to v2.8.0 fix(deps): update module github.com/fxamacker/cbor/v2 to v2.9.0 Jul 14, 2025
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants