[dependabot]

Bumps github.com/fxamacker/cbor/v2 from 2.9.6 to 2.10.0.

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.10.0

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

• CBOR Speedup by Data Type: groups of different benchmarks summarized per row
• CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types

CBOR Speedup by Data Type

Unmarshal	Speedup	ΔSec/op
Single values (bool, int, float, byte string, text string)	1.10× to 1.51×¹	-8.87% to -33.92%¹
Epoch time, bignum, other tags	1.18× to 1.64×	-15.33% to -38.91%
Arrays and maps to non-struct	1.33× to 1.87×	-24.63% to -46.49%
Arrays and maps to structs	1.06× to 1.52×	-5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn)	1.35× to 1.64×	-26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal	Speedup	ΔSec/op
Single values (bool, int, float, byte slice, string)	1.32× to 1.55×	-24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler²	1.15× to 1.63×	-12.94% to -38.84%
Slices and maps	1.35× to 2.88×	-25.97% to -65.26%
Structs	1.57× to 2.17×	-36.37% to -53.96%
Structs with omitempty fields	0.95׳ to 1.35×	+5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn)	1.12× to 1.33×	-10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmarkv2.9.6 → v2.10	Speedup	TimeΔSec/op	MemoryΔB/op	MemoryΔAllocs/op
[]any	2.50×	-607.5 ns (-60.03%)	-	-

... (truncated)

Commits

• cc2e8fb Merge pull request #890 from fxamacker/fxamacker/update-docs-for-v2.10.0
• c3279a6 Update doc.go and README.md for v2.10.0
• 9106688 Merge pull request #891 from fxamacker/fxamacker/add-benchmarks
• 864491f Add more benchmarks
• 49a20b9 Merge pull request #889 from fxamacker/fxamacker/reduce-float64-unix-time-range
• f5fbdcd Fix float range check when decoding Unix time
• 67a9707 Merge pull request #886 from fxamacker/fxamacker/reduce-allocs
• 6567310 Merge pull request #888 from fxamacker/fxamacker/cleanup-tests
• 84ba3bf Fix several test bugs
• 261eb13 Standardize test failure messages
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: d59449a9-4d8b-403c-bbe0-a37ab6839b05

Commits

Reviewing files that changed from the base of the PR and between ff33824 and 0bcad79.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

Walkthrough

The indirect dependency github.com/fxamacker/cbor/v2 is upgraded from v2.9.6 to v2.10.0.

Changes

CBOR dependency update

Layer / File(s)	Summary
Update CBOR dependency version go.mod	The required version of github.com/fxamacker/cbor/v2 changes from v2.9.6 to v2.10.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: thetechnick

Merge Risk: Minimal · up to 0bcad

No actionable merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description explains the dependency update and includes release notes, but it omits the required Change Type, Check List Before Merging, and Additional Information sections.	Add the required template sections. Select the applicable change type, complete all checklist items, and state any additional testing or documentation details.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the dependency and the exact version change from 2.9.6 to 2.10.0.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR