Merge tag 'v2.9.1' into fxamacker/update-streammode-to-release-v291

Author: fxamacker

.github/dependabot.yml

@@ -4,7 +4,10 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "friday"
+      time: "12:00"
+      timezone: "UTC"      
 
   - package-ecosystem: "gomod"
     directory: "/"

.github/workflows/ci-go-cover.yml

@@ -40,9 +40,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Install Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
       with:
         go-version: 1.24
         check-latest: true

.github/workflows/ci.yml

@@ -31,16 +31,16 @@ jobs:
     strategy:
       matrix:
         os: [macos-latest, ubuntu-latest, windows-latest]
-        go-version: ['1.20', 1.21, 1.22, 1.23, 1.24]
+        go-version: ['1.20', 1.21, 1.22, 1.23, 1.24, 1.25]
     steps:
     - name: Install Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
       with:
         go-version: ${{ matrix.go-version }}
         check-latest: true
 
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 1
 

.github/workflows/codeql-analysis.yml

@@ -31,11 +31,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+      uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
       with:
         languages: ${{ matrix.language }}
 
@@ -44,7 +44,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+      uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+      uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1

.github/workflows/govulncheck.yml

@@ -28,12 +28,12 @@ jobs:
       contents: read
     steps:
     - name: Checkout source
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 1
 
     - name: Install Go and setup env
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
       with:
         go-version: 1.23
         check-latest: true

.github/workflows/safer-golangci-lint.yml

@@ -16,10 +16,10 @@ on:
     branches: [main, master]
 
 env:
-  GO_VERSION: '1.22'
-  GOLINTERS_VERSION: 1.59.1
+  GO_VERSION: '1.25'
+  GOLINTERS_VERSION: 2.10.1
   GOLINTERS_ARCH: linux-amd64
-  GOLINTERS_TGZ_DGST: c30696f1292cff8778a495400745f0f9c0406a3f38d8bb12cef48d599f6c7791
+  GOLINTERS_TGZ_DGST: dfa775874cf0561b404a02a8f4481fc69b28091da95aa697259820d429b09c99
   GOLINTERS_TIMEOUT: 15m
   OPENSSL_DGST_CMD: openssl dgst -sha256 -r
   CURL_CMD: curl --proto =https --tlsv1.2 --location --silent --show-error --fail
@@ -36,12 +36,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
 
       - name: Setup Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true

.golangci.yml

@@ -1,104 +1,116 @@
-# Do not delete linter settings. Linters like gocritic can be enabled on the command line.
-
-linters-settings:
-  depguard:
-    rules:
-      prevent_unmaintained_packages:
-        list-mode: strict
-        files:
-          - $all
-          - "!$test"
-        allow:
-          - $gostd
-          - github.com/x448/float16
-        deny:
-          - pkg: io/ioutil
-            desc: "replaced by io and os packages since Go 1.16: https://tip.golang.org/doc/go1.16#ioutil"
-  dupl:
-    threshold: 100
-  funlen:
-    lines: 100
-    statements: 50
-  goconst:
-    ignore-tests: true
-    min-len: 2
-    min-occurrences: 3
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - commentedOutCode
-      - dupImport # https://github.com/go-critic/go-critic/issues/845
-      - ifElseChain
-      - octalLiteral
-      - paramTypeCombine
-      - whyNoLint
-  gofmt:
-    simplify: false
-  goimports:
-    local-prefixes: github.com/fxamacker/cbor
-  golint:
-    min-confidence: 0
-  govet:
-    check-shadowing: true
-  lll:
-    line-length: 140
-  maligned:
-    suggest-new: true
-  misspell:
-    locale: US
-  staticcheck:
-    checks: ["all"]
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     - asciicheck
     - bidichk
     - depguard
     - errcheck
-    - exportloopref
+    - forbidigo
     - goconst
     - gocritic
     - gocyclo
-    - gofmt
-    - goimports
     - goprintffuncname
     - gosec
-    - gosimple
     - govet
     - ineffassign
     - misspell
     - nilerr
     - revive
     - staticcheck
-    - stylecheck
-    - typecheck
     - unconvert
     - unused
-
+  settings:
+    depguard:
+      rules:
+        prevent_unmaintained_packages:
+          list-mode: strict
+          files:
+            - $all
+            - '!$test'
+          allow:
+            - $gostd
+            - github.com/x448/float16
+          deny:
+            - pkg: io/ioutil
+              desc: 'replaced by io and os packages since Go 1.16: https://tip.golang.org/doc/go1.16#ioutil'
+    dupl:
+      threshold: 100
+    funlen:
+      lines: 100
+      statements: 50
+    goconst:
+      min-len: 2
+      min-occurrences: 3
+    gocritic:
+      disabled-checks:
+        - commentedOutCode
+        - dupImport
+        - ifElseChain
+        - octalLiteral
+        - paramTypeCombine
+        - whyNoLint
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - performance
+        - style
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 140
+    misspell:
+      locale: US
+    staticcheck:
+      checks:
+        - all
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - path: decode.go
+        text: string ` overflows ` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string ` \(range is \[` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string `, ` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string ` overflows Go's int64` has (\d+) occurrences, make it a constant
+      - path: decode.go
+        text: string `\]\)` has (\d+) occurrences, make it a constant
+      - path: valid.go
+        text: string ` for type ` has (\d+) occurrences, make it a constant
+      - path: valid.go
+        text: 'string `cbor: ` has (\d+) occurrences, make it a constant'
+      - linters:
+          - goconst
+        path: (.+)_test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  # max-issues-per-linter default is 50.  Set to 0 to disable limit.
   max-issues-per-linter: 0
-  # max-same-issues default is 3.  Set to 0 to disable limit.
   max-same-issues: 0
-
-  exclude-rules:
-    - path: decode.go
-      text: "string ` overflows ` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string ` \\(range is \\[` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string `, ` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string ` overflows Go's int64` has (\\d+) occurrences, make it a constant"
-    - path: decode.go
-      text: "string `\\]\\)` has (\\d+) occurrences, make it a constant"
-    - path: valid.go
-      text: "string ` for type ` has (\\d+) occurrences, make it a constant"
-    - path: valid.go
-      text: "string `cbor: ` has (\\d+) occurrences, make it a constant"
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    gofmt:
+      simplify: false
+    goimports:
+      local-prefixes:
+        - github.com/fxamacker/cbor
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

README.md

@@ -702,21 +702,20 @@ Default limits may need to be increased for systems handling very large data (e.
 
 ## Status
 
-[v2.9.0](https://github.com/fxamacker/cbor/releases/tag/v2.9.0) (Jul 13, 2025) improved interoperability/transcoding between CBOR & JSON, refactored tests, and improved docs.
-- Add opt-in support for `encoding.TextMarshaler` and `encoding.TextUnmarshaler` to encode and decode from CBOR text string.
-- Add opt-in support for `json.Marshaler` and `json.Unmarshaler` via user-provided transcoding function.
-- Update docs for TimeMode, Tag, RawTag, and add example for Embedded JSON Tag for CBOR.
+v2.9.1 (Mar 29-30, 2026) includes important bugfixes, defensive checks, improved code quality, and more tests.  Although not public, the fuzzer was also improved by adding more fuzz tests.
 
-v2.9.0 passed fuzz tests and is production quality.
+v2.9.1 passed fuzz tests and is production quality.
 
 The minimum version of Go required to build:
 - v2.8.0 and newer releases require go 1.20+.
 - v2.7.1 and older releases require go 1.17+.
 
-For more details, see [release notes](https://github.com/fxamacker/cbor/releases).
+For more details, see [v2.9.1 release notes](https://github.com/fxamacker/cbor/releases).
 
 ### Prior Releases
 
+[v2.9.0](https://github.com/fxamacker/cbor/releases/tag/v2.9.0) (Jul 13, 2025) improved interoperability/transcoding between CBOR & JSON, refactored tests, and improved docs.   It passed fuzz tests (billions of executions) and is production quality.
+
 [v2.8.0](https://github.com/fxamacker/cbor/releases/tag/v2.8.0) (March 30, 2025) is a small release primarily to add `omitzero` option to struct field tags and fix bugs.   It passed fuzz tests (billions of executions) and is production quality.
 
 [v2.7.0](https://github.com/fxamacker/cbor/releases/tag/v2.7.0) (June 23, 2024) adds features and improvements that help large projects (e.g. Kubernetes) use CBOR as an alternative to JSON and Protocol Buffers. Other improvements include speedups, improved memory use, bug fixes, new serialization options, etc.   It passed fuzz tests (5+ billion executions) and is production quality.

bench_test.go

@@ -192,22 +192,22 @@ var decodeBenchmarks = []struct {
 		decodeToTypes: []reflect.Type{typeIntf, typeFloat64},
 	}, // float64(-4.1)
 	{
-		name:          "bytes",
+		name:          "byte string",
 		data:          mustHexDecode("581a0102030405060708090a0b0c0d0e0f101112131415161718191a"),
 		decodeToTypes: []reflect.Type{typeIntf, typeByteSlice},
 	}, // []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26}
 	{
-		name:          "bytes indef len",
+		name:          "indefinite-length byte string",
 		data:          mustHexDecode("5f410141024103410441054106410741084109410a410b410c410d410e410f4110411141124113411441154116411741184119411aff"),
 		decodeToTypes: []reflect.Type{typeIntf, typeByteSlice},
 	}, // []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26}
 	{
-		name:          "text",
+		name:          "text string",
 		data:          mustHexDecode("782b54686520717569636b2062726f776e20666f78206a756d7073206f76657220746865206c617a7920646f67"),
 		decodeToTypes: []reflect.Type{typeIntf, typeString},
 	}, // "The quick brown fox jumps over the lazy dog"
 	{
-		name:          "text indef len",
+		name:          "indefinite-length text string",
 		data:          mustHexDecode("7f61546168616561206171617561696163616b612061626172616f6177616e61206166616f61786120616a6175616d617061736120616f61766165617261206174616861656120616c6161617a617961206164616f6167ff"),
 		decodeToTypes: []reflect.Type{typeIntf, typeString},
 	}, // "The quick brown fox jumps over the lazy dog"
@@ -217,7 +217,7 @@ var decodeBenchmarks = []struct {
 		decodeToTypes: []reflect.Type{typeIntf, typeIntSlice},
 	}, // []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26}
 	{
-		name:          "array indef len",
+		name:          "indefinite-length array",
 		data:          mustHexDecode("9f0102030405060708090a0b0c0d0e0f101112131415161718181819181aff"),
 		decodeToTypes: []reflect.Type{typeIntf, typeIntSlice},
 	}, // []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26}
@@ -227,7 +227,7 @@ var decodeBenchmarks = []struct {
 		decodeToTypes: []reflect.Type{typeIntf, typeMapStringIntf, typeMapStringString},
 	}, // map[string]string{"a": "A", "b": "B", "c": "C", "d": "D", "e": "E", "f": "F", "g": "G", "h": "H", "i": "I", "j": "J", "l": "L", "m": "M", "n": "N"}}
 	{
-		name:          "map indef len",
+		name:          "indefinite-length map",
 		data:          mustHexDecode("bf616161416162614261636143616461446165614561666146616761476168614861696149616a614a616b614b616c614c616d614d616e614eff"),
 		decodeToTypes: []reflect.Type{typeIntf, typeMapStringIntf, typeMapStringString},
 	}, // map[string]string{"a": "A", "b": "B", "c": "C", "d": "D", "e": "E", "f": "F", "g": "G", "h": "H", "i": "I", "j": "J", "l": "L", "m": "M", "n": "N"}}
@@ -986,13 +986,13 @@ func BenchmarkUnmarshalMapToStruct(b *testing.B) {
 			b.Fatalf("invalid test assumption: ManyFields expected to have no more than 255 fields, has %d", rt.NumField())
 		}
 		buf.WriteByte(0xb8)
-		buf.WriteByte(byte(rt.NumField()))
+		buf.WriteByte(byte(rt.NumField()))        //nolint:gosec
 		for i := rt.NumField() - 1; i >= 0; i-- { // backwards
 			f := rt.Field(i)
 			if len(f.Name) > 23 {
 				b.Fatalf("invalid test assumption: field name %q longer than 23 bytes", f.Name)
 			}
-			buf.WriteByte(byte(0x60 + len(f.Name)))
+			buf.WriteByte(byte(0x60 + len(f.Name))) //nolint:gosec
 			buf.WriteString(f.Name)
 			buf.WriteByte(0xf5) // true
 		}