Skip to content

chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2#1069

Open
red-hat-konflux[bot] wants to merge 1 commit intomainfrom
konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x
Open

chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2#1069
red-hat-konflux[bot] wants to merge 1 commit intomainfrom
konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x

Conversation

@red-hat-konflux
Copy link
Copy Markdown
Contributor

@red-hat-konflux red-hat-konflux Bot commented Apr 1, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
github.com/fxamacker/cbor/v2 v2.9.0 → v2.9.2 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.2

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

  • Reject encoding indefinite-length map with odd item count by @​fxamacker in #​764
  • Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @​fxamacker in #​765
  • Make TagSet.Remove a no-op when contentType is nil by @​fxamacker in #​766
  • Refactor indefinite-length encoding and improve chunk validation during encoding by @​fxamacker in #​767
  • Add more tests, fix a nit in unreachable panic message, update docs & ci by @​fxamacker in #​768
CI / GitHub Actions and Docs
🔎 Details...

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

v2.9.1

Compare Source

This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

🐞 Bug fixes related to the keyasint feature

These changes only affect Go struct fields tagged with keyasint:

  • [Decoding] Reject integer keys that exceed math.MaxInt64 when decoding CBOR map to a struct with keyasint field (PR #​757)
  • [Decoding] Prevent string representation of an integer key from matching the struct field tagged by keyasint (PR #​757)
  • [Encoding & Decoding] Deduplicate struct fields with the same normalized keyasint tag values (PR #​757)
🐞 Other bug fixes and defensive checks

Some of the bugs fixed are related to decoding extreme values that cannot be encoded with this library. For example, the decoder checks if epoch time encoded as CBOR float value representing hundreds of billions of years overflows int64(seconds).

NOTE: It is generally good practice to avoid using floating point to store epoch time (even when not using CBOR).

  • [Decoding] Reject decoding epoch time encoded as floats that overflow int64 (PR #​753)
  • [Encoding] Return a cloned slice for an empty RawMessage from RawMessage.MarshalCBOR (PR #​753)
  • [Encoding] Reject encoding nil inside indefinite-length strings (PR #​750)
  • [Diagnostic] Accept valid U+FFFD replacement character (PR #​753)
What's Changed
CI / GitHub Actions and Docs
🔎 Details...

New Contributors

Full Changelog: fxamacker/cbor@v2.9.0...v2.9.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Apr 1, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign rcampos2029 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 1, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci Bot commented Apr 1, 2026

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift-online member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 1, 2026 •
edited
Loading

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: bea2e95e-0830-4d4a-b01f-1cdf431289f9

📥 Commits

Reviewing files that changed from the base of the PR and between 382e8cd and b2828ac.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • go.mod
✅ Files skipped from review due to trivial changes (1)
  • go.mod

Summary by CodeRabbit

  • Chores
    • Updated an indirect dependency to a newer patch release to improve stability and compatibility.
    • Applied a patch-level maintenance update addressing minor edge cases and reducing regression risk.
    • No functional or public API changes; this is an internal maintenance update with no user-facing impact.

Walkthrough

Updated an indirect Go module dependency in go.mod: github.com/fxamacker/cbor/v2 bumped from v2.9.0 to v2.9.2. No other files, code, or module directives were changed.

Changes

Dependency Update

Layer / File(s) Summary
Data Shape / Manifest
go.mod		 Indirect require entry for github.com/fxamacker/cbor/v2 changed from v2.9.0 to v2.9.2.
Tests / Docs
none changed		 No test or documentation changes in this PR.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically describes the main change: updating the cbor/v2 module from v2.9.0 to v2.9.2.
Description check ✅ Passed The description is directly related to the changeset, providing detailed release notes, version information, and context for the dependency update.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x

Comment @coderabbitai help to get the list of available commands and usage tips.

@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x branch from 8c7ae48 to 99fad8e Compare April 2, 2026 22:03
@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x branch 2 times, most recently from 9fa2300 to 382e8cd Compare May 4, 2026 22:10
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.1 chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2 May 4, 2026
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2 chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2 - autoclosed May 6, 2026
@red-hat-konflux red-hat-konflux Bot closed this May 6, 2026
@red-hat-konflux red-hat-konflux Bot deleted the konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x branch May 6, 2026 23:52
@red-hat-konflux
chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2
b2828ac 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2 - autoclosed chore(deps): update module github.com/fxamacker/cbor/v2 to v2.9.2 May 7, 2026
@red-hat-konflux red-hat-konflux Bot reopened this May 7, 2026
@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main/github.com-fxamacker-cbor-v2-2.x branch 2 times, most recently from 382e8cd to b2828ac Compare May 7, 2026 02:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@miguelhbrito miguelhbrito Awaiting requested review from miguelhbrito

@rcampos2029 rcampos2029 Awaiting requested review from rcampos2029

Assignees

No one assigned

Labels

needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants