[dependabot]

Bumps github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6.

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

Not affected:

• Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
• Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
• Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
• Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #855 for details.

⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

• Skip CBOR data item when destination struct has incorrect tags by @​fxamacker in fxamacker/cbor#821
• Fix decoding CBOR null/undefined to interface value by @​fxamacker in fxamacker/cbor#827
• Fix decoding to unaddressable value in interface by @​fxamacker in fxamacker/cbor#828
• Improve the DefaultByteStringType check by @​fxamacker in fxamacker/cbor#829
• Fix decoding to self-referencing types by @​fxamacker in fxamacker/cbor#831
• Fix decoding 55799(null) to pointer or interface by @​fxamacker in fxamacker/cbor#851
• Fix stale Go map entry from CBOR null key/value by @​fxamacker in fxamacker/cbor#855

Encoding

• Fix encoding self-referencing types by @​fxamacker in fxamacker/cbor#833
• Fix panic encoding marshaler of unsupported underlying types by @​fxamacker in fxamacker/cbor#834
• Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @​fxamacker in fxamacker/cbor#835
• Fix encoding TimeUnixMicro outside 1677 to 2262 by @​fxamacker in fxamacker/cbor#837
  • Encoded output also changes for some times within one second of either end of that range.
• Reject encoding time.Time when Go formats wrong year by @​fxamacker in fxamacker/cbor#838

CI / GitHub Actions and Docs

• Improve docs related to encoding time.Time by @​fxamacker in fxamacker/cbor#854

Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6

... (truncated)

Commits

• 8604f5f Merge pull request #857 from fxamacker/fxamacker/retract-v2.9.5
• 1e80139 Retract v2.9.5
• a1b077c Merge pull request #855 from fxamacker/fxamacker/release-2.9-fix-nil-map-value
• 0d86c22 Fix stale Go map entry from CBOR null key/value
• dd5dab6 Merge pull request #854 from fxamacker/fxamacker/release-2.9-update-docs
• 599c7c8 Improve docs related to encoding time.Time
• 850c568 Merge pull request #851 from fxamacker/fxamacker/release-2.9-fix-decoding-557...
• c046eed Fix decoding 55799(null) to pointer or interface
• ac3c8da Merge pull request #838 from fxamacker/fxamacker/release-2.9-fix-encoding-rfc...
• 258d49e Merge pull request #837 from fxamacker/fxamacker/release-2.9-fix-encoding-tim...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: db8afbe7-dd45-42d9-8e6e-8db2f0435b62

📥 Commits

Reviewing files that changed from the base of the PR and between 0ea791b and ae1c839.

⛔ Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

📒 Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

Walkthrough

The indirect github.com/fxamacker/cbor/v2 dependency in go.mod is updated from v2.9.4 to v2.9.6.

Changes

CBOR dependency update

Layer / File(s)	Summary
Update CBOR dependency go.mod	The indirect github.com/fxamacker/cbor/v2 dependency changes from v2.9.4 to v2.9.6.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: thetechnick

Merge Risk: ⚪ Minimal · up to ae1c8

No actionable merge-blocking risk is established for this dependency update; it is mergeable after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the dependency update and includes release details, but it does not follow the repository template. The Summary, Change Type, Check List Before Merging, and Additional Informa…	Add the required template sections. Select the applicable change type, complete the pre-merge checklist, and state any relevant testing or documentation updates.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the dependency and version update.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the dependency update and includes release details, but it does not follow the repository template. The Summary, Change Type, Check List Before Merging, and Additional Information sections are missing.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}