Skip to content

Repository navigation

fix(deps): update module github.com/fxamacker/cbor/v2 to v2.10.0 - #76

Merged
guided-traffic-automation[bot] merged 1 commit into
mainfrom
renovate/github.com-fxamacker-cbor-v2-2.x
Oct 29, 2026
Merged

fix(deps): update module github.com/fxamacker/cbor/v2 to v2.10.0#76
guided-traffic-automation[bot] merged 1 commit into
mainfrom
renovate/github.com-fxamacker-cbor-v2-2.x

Conversation

@guided-traffic-automation

@guided-traffic-automation guided-traffic-automation Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/fxamacker/cbor/v2 v2.9.6 → v2.10.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.10.0

Compare Source

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

These gains come without using Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended.

Performance and Benchmarks

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

  • CBOR Speedup by Data Type: groups of different benchmarks summarized per row
  • CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types
CBOR Speedup by Data Type
Decoding Speedup ΔSec/op
Single values (bool, int, float, byte string, text string) 1.10× to 1.51×¹ -8.87% to -33.92%¹
Epoch time, bignum, other tags 1.18× to 1.64× -15.33% to -38.91%
Arrays and maps to non-struct 1.33× to 1.87× -24.63% to -46.49%
Arrays and maps to structs 1.06× to 1.52× -5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn) 1.35× to 1.64× -26.06% to -39.19%

¹ -60.64% (2.54× speedup) when decoding into a named []byte type that has methods.

Encoding Speedup ΔSec/op
Single values (bool, int, float, byte slice, string) 1.32× to 1.55× -24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler² 1.15× to 1.63× -12.94% to -38.84%
Slices and maps 1.35× to 2.88× -25.97% to -65.26%
Structs 1.57× to 2.17× -36.37% to -53.96%
Structs with omitempty fields 0.95׳ to 1.35× +5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn) 1.12× to 1.33× -10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #​870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmark
v2.9.6 → v2.10		 Speedup Time
ΔSec/op		 Memory
ΔB/op		 Memory
ΔAllocs/op
[]any 2.50× -607.5 ns (-60.03%) - -
map[string]any 2.60× -821.9 ns (-61.47%) - -
map[string]string 2.59× -335.9 ns (-61.34%) - -
nested_map[any]any 2.88× -16.542 µs (-65.26%) - -
nested_map[string]any 2.78× -14.201 µs (-64.01%) - -
nested_map[any]any, bw_lex 2.53× -22.36 µs (-60.54%) -3314 (-44.72%) -69 (-98.57%)
nested_map[string]any, bw_lex 2.41× -19.52 µs (-58.54%) -3323 (-44.79%) -69 (-98.57%)
  • bw_lex = SortBytewiseLexical. Memory improvements are from #​774 and #​860.

Upgrade Notes

  • Go 1.24 or newer is required (#​773).
  • Pointer-receiver marshal methods (user-implemented methods) are called on the original value instead of a copy when the value is addressable (#​866).
  • Marshal configured to use TagsForbidden returns an error for a big.Int outside [-2^64, 2^64-1], and EncMode creation returns an error for settings that would emit tags if TagsForbidden is also set (#​868).
  • Decoder advances past well-formed data items rejected by DecOptions value or serialization restrictions (e.g. NaN, IndefLength), and Skip skips them without an error (#​872).
  • Marshal configured to emit text-based time returns an error for time.Time outside RFC 3339 limits (#​873).

TinyGo (experimental)

TinyGo support for v2.10.0 is available in tag tinygo-beta/v2.10.0-tinygo0.42 (branch feature/cbor-tinygo-beta). It requires TinyGo 0.42.0 or newer. It is experimental and not fuzz tested. For details, see TinyGo (https://github.com/fxamacker/cbor#tinygo) in the README.

What's Changed

⭐ Features
  • feat: add toindefarray struct tag option for CBOR indefinite-length arrays by @​tdnguyenND in #​770
🚀 Optimizations
🛠 Improvements
🐞 Bug Fixes
🧪 Testing
📖 Documentation
📖 Contributing Guidelines, Security Policy, and Templates
CI / GitHub Actions
🔎 Details
Other Changes
Ported from release-2.9

Already released in v2.9.3 through v2.9.6.

🔎 Details
Dependabot Updates
🔎 Details

New Contributors

Full Changelog: fxamacker/cbor@v2.9.6...v2.10.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@guided-traffic-automation
guided-traffic-automation Bot enabled auto-merge (squash) October 29, 2026 06:47
@guided-traffic-automation
guided-traffic-automation Bot merged commit b95a119 into main Oct 29, 2026
15 checks passed
@guided-traffic-automation
guided-traffic-automation Bot deleted the renovate/github.com-fxamacker-cbor-v2-2.x branch October 29, 2026 08:39
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

📊 Combined Test Coverage Report

Current Coverage: 82.6%
Main Branch Coverage: 82.6%
Difference: ➡️ 0.0%

📁 Coverage by package
Package Coverage Statements
github.com/guided-traffic/mosquitto-operator/api/v1 70.1% 124/177
github.com/guided-traffic/mosquitto-operator/cmd 52.0% 26/50
github.com/guided-traffic/mosquitto-operator/cmd/exporter 0.0% 0/1
github.com/guided-traffic/mosquitto-operator/internal/auth 96.0% 120/125
github.com/guided-traffic/mosquitto-operator/internal/builder 100.0% 107/107
github.com/guided-traffic/mosquitto-operator/internal/common 100.0% 57/57
github.com/guided-traffic/mosquitto-operator/internal/controller 88.1% 288/327
github.com/guided-traffic/mosquitto-operator/internal/exporter 60.2% 77/128
github.com/guided-traffic/mosquitto-operator/internal/reloader 85.1% 114/134
github.com/guided-traffic/mosquitto-operator/test/testimages 100.0% 3/3

Unit and integration tests combined. The full per-function report is in this
job's summary and in the coverage-combined artifact — it is deliberately not
inlined here, because a with: input travels to the action as one environment
variable and Linux caps that at 131072 bytes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants