Skip to content

Sync feature/stream-mode to release v2.9.1#759

Merged
fxamacker merged 95 commits intofeature/stream-modefrom
fxamacker/update-streammode-to-release-v291
Mar 31, 2026
Merged

Sync feature/stream-mode to release v2.9.1#759
fxamacker merged 95 commits intofeature/stream-modefrom
fxamacker/update-streammode-to-release-v291

Conversation

@fxamacker
Copy link
Copy Markdown
Owner

@fxamacker fxamacker commented Mar 30, 2026

This PR merges v2.9.1 into feature/stream-mode branch. v2.9.1 was tagged on Monday morning, March 30, 2026.

v2.9.1 includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

See v2.9.1 release notes for more details.

Conflict Resolution
commit 6fc4b610f8f69a74d3ce9e1539ffa1172ddc475d
Merge: 39888e6 63d1c66
Author: Faye Amacker <33205765+fxamacker@users.noreply.github.com>
Date:   Mon Mar 30 12:25:16 2026 -0500

    Merge tag 'v2.9.1' into fxamacker/update-streammode-to-release-v291

diff --git a/decode_test.go b/decode_test.go
remerge CONFLICT (content): Merge conflict in decode_test.go
index 8be9555..8f66eb7 100644
--- a/decode_test.go
+++ b/decode_test.go
@@ -3500,28 +3500,27 @@ var invalidCBORUnmarshalTestCases = []struct {
 		data:         mustHexDecode("00830102"),
 		wantErrorMsg: "cbor: 3 bytes of extraneous data starting at index 1",
 	},
-<<<<<<< 39888e6 (Merge pull request #715 from fxamacker/fxamacker/sync-stream-mode-branch-with-master)
-	// more
+	// End of input
 	{
-		name:         "End of input in a head",
+		name:         "end of input in a head",
 		data:         mustHexDecode("59"),
 		wantErrorMsg: "unexpected EOF",
 	},
 	{
-		name:         "End of input in a head",
+		name:         "end of input in a head",
 		data:         mustHexDecode("5b"),
 		wantErrorMsg: "unexpected EOF",
 	},
 	{
-		name:         "End of input in a head",
+		name:         "end of input in a head",
 		data:         mustHexDecode("d8"),
 		wantErrorMsg: "unexpected EOF",
 	},
 	{
-		name:         "End of input in a head",
+		name:         "end of input in a head",
 		data:         mustHexDecode("d9"),
 		wantErrorMsg: "unexpected EOF",
-=======
+	},
 	// Indefinite-length map
 	{
 		name:         "indefinite-length map with one key and no value",
@@ -3532,7 +3531,6 @@ var invalidCBORUnmarshalTestCases = []struct {
 		name:         "indefinite-length map with two keys and one value",
 		data:         []byte{0xbf, 0x61, 'a', 0x01, 0x61, 'b', 0xff},
 		wantErrorMsg: `cbor: unexpected "break" code`,
->>>>>>> 63d1c66 (Merge pull request #758 from fxamacker/fxamacker/update-readme-for-release)
 	},
 }
 
diff --git a/stream.go b/stream.go
remerge CONFLICT (content): Merge conflict in stream.go
index 6c48b46..a61928b 100644
--- a/stream.go
+++ b/stream.go
@@ -175,9 +175,8 @@ func NewEncoder(w io.Writer) *Encoder {
 	return defaultEncMode.NewEncoder(w)
 }
 
-<<<<<<< 39888e6 (Merge pull request #715 from fxamacker/fxamacker/sync-stream-mode-branch-with-master)
 func (enc *Encoder) checkIndefiniteLengthDataItemTypeIfNeeded(v interface{}) error {
-	if len(enc.indefTypes) == 0 || v == nil {
+	if len(enc.indefTypes) == 0 {
 		return nil
 	}
 
@@ -187,15 +186,6 @@ func (enc *Encoder) checkIndefiniteLengthDataItemTypeIfNeeded(v interface{}) err
 
 func checkIndefiniteLengthDataItemType(indefType cborType, v interface{}) error {
 	switch indefType {
-	case cborTypeTextString:
-		k := reflect.TypeOf(v).Kind()
-		if k != reflect.String {
-			return errors.New("cbor: cannot encode item type " + k.String() + " for indefinite-length text string")
-=======
-// Encode writes the CBOR encoding of v.
-func (enc *Encoder) Encode(v any) error {
-	if len(enc.indefTypes) > 0 {
-		switch enc.indefTypes[len(enc.indefTypes)-1] {
 	case cborTypeTextString:
 		if v == nil {
 			return errors.New("cbor: cannot encode nil for indefinite-length text string")
@@ -204,6 +194,7 @@ func (enc *Encoder) Encode(v any) error {
 		if k != reflect.String {
 			return errors.New("cbor: cannot encode item type " + k.String() + " for indefinite-length text string")
 		}
+
 	case cborTypeByteString:
 		if v == nil {
 			return errors.New("cbor: cannot encode nil for indefinite-length byte string")
@@ -213,15 +204,6 @@ func (enc *Encoder) Encode(v any) error {
 		if (k != reflect.Array && k != reflect.Slice) || t.Elem().Kind() != reflect.Uint8 {
 			return errors.New("cbor: cannot encode item type " + k.String() + " for indefinite-length byte string")
 		}
->>>>>>> 63d1c66 (Merge pull request #758 from fxamacker/fxamacker/update-readme-for-release)
-		}
-
-	case cborTypeByteString:
-		t := reflect.TypeOf(v)
-		k := t.Kind()
-		if (k != reflect.Array && k != reflect.Slice) || t.Elem().Kind() != reflect.Uint8 {
-			return errors.New("cbor: cannot encode item type " + k.String() + " for indefinite-length byte string")
-		}
 	}
 
 	return nil

fxamacker and others added 30 commits July 19, 2025 20:30
This commit adds TimeMode encoding option TimeRFC3339NanoUTC which
causes time.Time to encode to a CBOR time (tag 0) with a text string
content representing UTC time using nanosecond precision in RFC3339
format.
…TC-option

Add TimeMode encoding option TimeRFC3339NanoUTC
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.2 to 3.29.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@181d5ee...4e828ff)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-3.29.4

Bump github/codeql-action from 3.29.2 to 3.29.4
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.4 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@4e828ff...51f7732)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-3.29.5

Bump github/codeql-action from 3.29.4 to 3.29.5
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.7 to 3.29.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@51f7732...df55935)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ons/checkout-5.0.0

Bump actions/checkout from 4.2.2 to 5.0.0
…ub/codeql-action-3.29.9

Bump github/codeql-action from 3.29.7 to 3.29.9
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.9 to 3.29.11.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@df55935...3c3833e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-3.29.11

Bump github/codeql-action from 3.29.9 to 3.29.11
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.11 to 3.30.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@3c3833e...2d92b76)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.5.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@d35c59a...4469467)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-3.30.0

Bump github/codeql-action from 3.29.11 to 3.30.0
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.0 to 3.30.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2d92b76...192325c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ons/setup-go-6.0.0

Bump actions/setup-go from 5.5.0 to 6.0.0
…ub/codeql-action-3.30.3

Bump github/codeql-action from 3.30.0 to 3.30.3
Signed-off-by: Cole Anthony Capilongo cole@hypha.coop
Use actual negative zero in tests
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.3 to 3.30.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@192325c...303c0ae)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-3.30.4

Bump github/codeql-action from 3.30.3 to 3.30.4
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.4 to 3.30.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@303c0ae...64d10c1)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-3.30.6

Bump github/codeql-action from 3.30.4 to 3.30.6
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.6 to 4.30.7.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@64d10c1...e296a93)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.30.7
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-4.30.7

Bump github/codeql-action from 3.30.6 to 4.30.7
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.30.7 to 4.30.8.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e296a93...f443b60)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.30.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-4.30.8

Bump github/codeql-action from 4.30.7 to 4.30.8
dependabot bot and others added 21 commits March 27, 2026 12:03
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.34.0 to 4.34.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c6f9311...3869755)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.34.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…ub/codeql-action-4.34.1

Bump github/codeql-action from 4.34.0 to 4.34.1
This commit improves consistency, readability, etc. and
does not affect the behavior of the codec.
This issue doesn't affect CBOR encoding or decoding.

Previously, the diagnostic functions which are used
to translate CBOR into Extended Diagnostic Notation
(human readable text for debugging) were rejecting
valid U+FFFD character.

This commit fixes Diagnose() and DiagnoseFirst() to
no longer reject valid U+FFFD character.
This refactor does not change actual behavior of the CBOR codec,
but it improves conformance to Go's sort.Interface.

This commit does not change behavior because:
- sort is used to deduplicate struct fields and fields with
  identical index are deduplicated
- sort is used to order struct fields after deduplication and
  we don't expect identical fields after deduplication
- sort is used to order map keys for encoding and we don't expect
  identical Go map keys
This commit adds a bounds check when decoding floating-point epoch time,
because extreme values (hundreds of billions of years) can exceed
the range of int64(seconds) if it was encoded using a different library.
This commit always returns a copy of cborNil slice when RawMessage
is empty.

Previously, RawMessage.MarshalCBOR() returned an internal cborNil
slice when RawMessage is empty.  This did not prevent the possibility
of external callers accidentally mutating the internal cborNil slice.

This issue only affects external direct call of RawMessage.MarshalCBOR.

The Marhsal() and Encode() functions already return a copy of data, so
they were not affected by this issue.
This commit refactors parseMapToStruct by:
- extracting helper functions that can be inlined
- refactoring and simplifying control flow

This refactor does not change encoding or decoding behavior.
Small bugfixes, defensive checks, and improvements
…truct-etc

Refactor parseMapToStruct(), getDecodingStructType(), getEncodingStructType(), and field struct
This commit fixes several issues related to keyasint.

These issues were identified and fixed while refactoring code
and tests related to keyasint.

1. DECODING: Previously, decoding a CBOR map integer key to a
   Go struct field using keyasint could overflow if the value
   is greater than math.MaxInt64.

   This commit rejects CBOR map integer keys that exceed
   math.MaxInt64 when decoding to a struct field using keyasint.

2. DECODING: Previously, decoding a CBOR map’s string key can match
   a Go struct field with the keyasint option if the text key matches
   the string representation of the integer key.  For example, CBOR
   map key "1" can match a struct field with tag `cbor:"1,keyasint"`.

   This commit prevents the string representation of an integer from
   matching the Go struct field tagged by keyasint by separating the
   keyasint field name and non-keyasint into separate namespaces.
   CBOR map integer keys are matched to struct fields with the keyasint
   option, and CBOR map string keys are matched to struct fields without
   the keyasint option.

3. ENCODING & DECODING: Previously, integer keys specified by keyasint
   tags were normalized after deduplication, allowing fields with the
   same normalized integer keys.  As a result, the CBOR map integer
   key matched the first field with the same normalized value.  Also,
   it was possible to encode duplicate keys with the same normalized values.

   This commit prevents duplicate integer keys by normalizing keyasint
   tag values before deduplication, and normalized duplicate keyasint
   fields are ignored.  This is the same way we currently handle
   duplicate string-key fields, which matches the behavior of encoding/json.
Fix several issues related to keyasint tag option
@fxamacker fxamacker self-assigned this Mar 30, 2026
@fxamacker fxamacker added enhancement New feature or request bugfix improvement improvement that does not add new feature labels Mar 30, 2026
@fxamacker fxamacker changed the title Sync fxamacker/stream-mode to release v2.9.1 Sync feature/stream-mode to release v2.9.1 Mar 30, 2026
Copy link
Copy Markdown
Contributor

@turbolent turbolent left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@fxamacker fxamacker merged commit a78e92e into feature/stream-mode Mar 31, 2026
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix enhancement New feature or request improvement improvement that does not add new feature

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants