Skip to content

chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.1#2424

Merged
ocmbot[bot] merged 1 commit into
mainfrom
renovate/github.com-fxamacker-cbor-v2-2.9.x
May 4, 2026
Merged

chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.1#2424
ocmbot[bot] merged 1 commit into
mainfrom
renovate/github.com-fxamacker-cbor-v2-2.9.x

Conversation

@ocmbot

@ocmbot ocmbot Bot commented May 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change OpenSSF
github.com/fxamacker/cbor/v2 indirect patch v2.9.0v2.9.1 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.1

Compare Source

This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

🐞 Bug fixes related to the keyasint feature

These changes only affect Go struct fields tagged with keyasint:

  • [Decoding] Reject integer keys that exceed math.MaxInt64 when decoding CBOR map to a struct with keyasint field (PR #​757)
  • [Decoding] Prevent string representation of an integer key from matching the struct field tagged by keyasint (PR #​757)
  • [Encoding & Decoding] Deduplicate struct fields with the same normalized keyasint tag values (PR #​757)
🐞 Other bug fixes and defensive checks

Some of the bugs fixed are related to decoding extreme values that cannot be encoded with this library. For example, the decoder checks if epoch time encoded as CBOR float value representing hundreds of billions of years overflows int64(seconds).

NOTE: It is generally good practice to avoid using floating point to store epoch time (even when not using CBOR).

  • [Decoding] Reject decoding epoch time encoded as floats that overflow int64 (PR #​753)
  • [Encoding] Return a cloned slice for an empty RawMessage from RawMessage.MarshalCBOR (PR #​753)
  • [Encoding] Reject encoding nil inside indefinite-length strings (PR #​750)
  • [Diagnostic] Accept valid U+FFFD replacement character (PR #​753)
What's Changed
CI / GitHub Actions and Docs
🔎 Details...

New Contributors

Full Changelog: fxamacker/cbor@v2.9.0...v2.9.1


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Only on Sunday (* * * * 0)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@ocmbot ocmbot Bot requested a review from a team as a code owner May 3, 2026 00:59
@ocmbot ocmbot Bot enabled auto-merge (squash) May 3, 2026 00:59
@netlify

netlify Bot commented May 3, 2026

Copy link
Copy Markdown

Deploy Preview for ocm-website ready!

Name Link
🔨 Latest commit 67c81ec
🔍 Latest deploy log https://app.netlify.com/projects/ocm-website/deploys/69f69de19cb8fd0008a0b95d
😎 Deploy Preview https://deploy-preview-2424--ocm-website.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions github-actions Bot added kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. size/s Small labels May 3, 2026
@ocmbot ocmbot Bot merged commit ac1b110 into main May 4, 2026
48 checks passed
@ocmbot ocmbot Bot deleted the renovate/github.com-fxamacker-cbor-v2-2.9.x branch May 4, 2026 05:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/chore chore, maintenance, etc. kind/dependency dependency update, etc. size/s Small

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants