Skip to content

chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.1 (main)#4110

Closed
elastic-renovate-prod[bot] wants to merge 1 commit into
mainfrom
renovate/main-github.com-fxamacker-cbor-v2-2.x
Closed

chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.1 (main)#4110
elastic-renovate-prod[bot] wants to merge 1 commit into
mainfrom
renovate/main-github.com-fxamacker-cbor-v2-2.x

Conversation

@elastic-renovate-prod
Copy link
Copy Markdown
Contributor

@elastic-renovate-prod elastic-renovate-prod Bot commented Apr 6, 2026

This PR contains the following updates:

Package Type Update Change
github.com/fxamacker/cbor/v2 indirect patch v2.9.0 -> v2.9.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.1

Compare Source

This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

🐞 Bug fixes related to the keyasint feature

These changes only affect Go struct fields tagged with keyasint:

  • [Decoding] Reject integer keys that exceed math.MaxInt64 when decoding CBOR map to a struct with keyasint field (PR #​757)
  • [Decoding] Prevent string representation of an integer key from matching the struct field tagged by keyasint (PR #​757)
  • [Encoding & Decoding] Deduplicate struct fields with the same normalized keyasint tag values (PR #​757)
🐞 Other bug fixes and defensive checks

Some of the bugs fixed are related to decoding extreme values that cannot be encoded with this library. For example, the decoder checks if epoch time encoded as CBOR float value representing hundreds of billions of years overflows int64(seconds).

NOTE: It is generally good practice to avoid using floating point to store epoch time (even when not using CBOR).

  • [Decoding] Reject decoding epoch time encoded as floats that overflow int64 (PR #​753)
  • [Encoding] Return a cloned slice for an empty RawMessage from RawMessage.MarshalCBOR (PR #​753)
  • [Encoding] Reject encoding nil inside indefinite-length strings (PR #​750)
  • [Diagnostic] Accept valid U+FFFD replacement character (PR #​753)

What's Changed

CI / GitHub Actions and Docs
🔎 Details...

New Contributors

Full Changelog: fxamacker/cbor@v2.9.0...v2.9.1


Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@elastic-renovate-prod elastic-renovate-prod Bot requested a review from a team as a code owner April 6, 2026 22:08
@elastic-renovate-prod elastic-renovate-prod Bot enabled auto-merge (squash) April 8, 2026 19:50
@olegsu olegsu closed this Apr 9, 2026
auto-merge was automatically disabled April 9, 2026 12:20

Pull request was closed

@elastic-renovate-prod elastic-renovate-prod Bot deleted the renovate/main-github.com-fxamacker-cbor-v2-2.x branch April 9, 2026 19:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant