[dependabot]

Bumps the go-minor-patch group with 2 updates in the / directory: github.com/fxamacker/cbor/v2 and google.golang.org/grpc.

Updates github.com/fxamacker/cbor/v2 from 2.9.6 to 2.10.0

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.10.0

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

• CBOR Speedup by Data Type: groups of different benchmarks summarized per row
• CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types

CBOR Speedup by Data Type

Unmarshal	Speedup	ΔSec/op
Single values (bool, int, float, byte string, text string)	1.10× to 1.51×¹	-8.87% to -33.92%¹
Epoch time, bignum, other tags	1.18× to 1.64×	-15.33% to -38.91%
Arrays and maps to non-struct	1.33× to 1.87×	-24.63% to -46.49%
Arrays and maps to structs	1.06× to 1.52×	-5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn)	1.35× to 1.64×	-26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal	Speedup	ΔSec/op
Single values (bool, int, float, byte slice, string)	1.32× to 1.55×	-24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler²	1.15× to 1.63×	-12.94% to -38.84%
Slices and maps	1.35× to 2.88×	-25.97% to -65.26%
Structs	1.57× to 2.17×	-36.37% to -53.96%
Structs with omitempty fields	0.95׳ to 1.35×	+5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn)	1.12× to 1.33×	-10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmarkv2.9.6 → v2.10	Speedup	TimeΔSec/op	MemoryΔB/op	MemoryΔAllocs/op
[]any	2.50×	-607.5 ns (-60.03%)	-	-

... (truncated)

Commits

• cc2e8fb Merge pull request #890 from fxamacker/fxamacker/update-docs-for-v2.10.0
• c3279a6 Update doc.go and README.md for v2.10.0
• 9106688 Merge pull request #891 from fxamacker/fxamacker/add-benchmarks
• 864491f Add more benchmarks
• 49a20b9 Merge pull request #889 from fxamacker/fxamacker/reduce-float64-unix-time-range
• f5fbdcd Fix float range check when decoding Unix time
• 67a9707 Merge pull request #886 from fxamacker/fxamacker/reduce-allocs
• 6567310 Merge pull request #888 from fxamacker/fxamacker/cleanup-tests
• 84ba3bf Fix several test bugs
• 261eb13 Standardize test failure messages
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.