v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

:lady_beetle: Important Fix

Not affected:

• Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
• Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
• Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
• Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #855 for details.

:warning: Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

• Skip CBOR data item when destination struct has incorrect tags by @fxamacker in https://github.com/fxamacker/cbor/pull/821
• Fix decoding CBOR null/undefined to interface value by @fxamacker in https://github.com/fxamacker/cbor/pull/827
• Fix decoding to unaddressable value in interface by @fxamacker in https://github.com/fxamacker/cbor/pull/828
• Improve the DefaultByteStringType check by @fxamacker in https://github.com/fxamacker/cbor/pull/829
• Fix decoding to self-referencing types by @fxamacker in https://github.com/fxamacker/cbor/pull/831
• Fix decoding 55799(null) to pointer or interface by @fxamacker in https://github.com/fxamacker/cbor/pull/851
• Fix stale Go map entry from CBOR null key/value by @fxamacker in https://github.com/fxamacker/cbor/pull/855

Encoding

• Fix encoding self-referencing types by @fxamacker in https://github.com/fxamacker/cbor/pull/833
• Fix panic encoding marshaler of unsupported underlying types by @fxamacker in https://github.com/fxamacker/cbor/pull/834
• Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @fxamacker in https://github.com/fxamacker/cbor/pull/835
• Fix encoding TimeUnixMicro outside 1677 to 2262 by @fxamacker in https://github.com/fxamacker/cbor/pull/837
  • Encoded output also changes for some times within one second of either end of that range.
• Reject encoding time.Time when Go formats wrong year by @fxamacker in https://github.com/fxamacker/cbor/pull/838

CI / GitHub Actions and Docs

• Improve docs related to encoding time.Time by @fxamacker in https://github.com/fxamacker/cbor/pull/854

Full Changelog: https://github.com/fxamacker/cbor/compare/v2.9.4...v2.9.6