chore(deps): update indirect go modules - #3302

v3.14.0

Compare Source

v2.9.6

Compare Source

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

Not affected:

• Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
• Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
• Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
• Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #​855 for details.

⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #​827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

• Skip CBOR data item when destination struct has incorrect tags by @​fxamacker in #​821
• Fix decoding CBOR null/undefined to interface value by @​fxamacker in #​827
• Fix decoding to unaddressable value in interface by @​fxamacker in #​828
• Improve the DefaultByteStringType check by @​fxamacker in #​829
• Fix decoding to self-referencing types by @​fxamacker in #​831
• Fix decoding 55799(null) to pointer or interface by @​fxamacker in #​851
• Fix stale Go map entry from CBOR null key/value by @​fxamacker in #​855

Encoding

• Fix encoding self-referencing types by @​fxamacker in #​833
• Fix panic encoding marshaler of unsupported underlying types by @​fxamacker in #​834
• Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @​fxamacker in #​835
• Fix encoding TimeUnixMicro outside 1677 to 2262 by @​fxamacker in #​837
  • Encoded output also changes for some times within one second of either end of that range.
• Reject encoding time.Time when Go formats wrong year by @​fxamacker in #​838

CI / GitHub Actions and Docs

• Improve docs related to encoding time.Time by @​fxamacker in #​854

Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6

v2.9.5

Compare Source

This version was tagged from the wrong branch by mistake and is retracted.

Use v2.9.6 (https://github.com/fxamacker/cbor/releases/tag/v2.9.6) instead.

v1.0.2

Compare Source

1.0.2 - 2026-09-24

Full Changelog: go-openapi/jsonpointer@v1.0.1...v1.0.2

7 commits in this release.

Fixed bugs

• fix: panics in Pointer.Get, Pointer.Set and json name resolution by @​fredbi ...

Documentation

• docs: correct the agent instruction files by @​fredbi ...

Code quality

• chore: fix linting issue (redundant loop index copy) by @​fredbi ...
• chore: linting config by @​fredbi ...

Updates

• build(deps): bump github.com/go-openapi/testify/v2 from 2.7.0 to 2.8.0 in the go-openapi-dependencies group by @​dependabot[bot] in #​157 ...
• build(deps): bump the development-dependencies group with 9 updates by @​dependabot[bot] in #​156 ...

Other (technical)

• Copilot/fix nil pointer dereference by @​fredbi in #​158 ...

People who contributed to this release

• @​fredbi

jsonpointer license terms

v1.0.3

Compare Source

1.0.3 - 2026-09-25

Full Changelog: go-openapi/jsonreference@v1.0.2...v1.0.3

4 commits in this release.

Fixed bugs

• fix: remove repeated default ports from a URL host in linear time by @​fredbi in #​123 ...

Security

• chore(security): upgraded go-openapi/jsonpointer by @​fredbi ...

Updates

• build(deps): bump github.com/go-openapi/testify/v2 from 2.7.0 to 2.8.0 in the go-openapi-dependencies group by @​dependabot[bot] in #​122 ...
• build(deps): bump the development-dependencies group with 9 updates by @​dependabot[bot] in #​121 ...

People who contributed to this release

• @​fredbi

jsonreference license terms

v0.11.2

Compare Source

What's Changed

• Trust the marshalers and the unmarshalers of the standard library by @​goccy in #​675
• Encoder: escape and check strings faster by @​goccy in #​676
• Encoder: range over larger map values as words, and write the entries of a sorted map directly by @​goccy in #​677
• Encoder: write the digits of an integer where they go in the buffer by @​goccy in #​679
• Look the methods of the marshalers up by their names as constants by @​goccy in #​680
• Encoder: sort the keys of a map with the comparisons inlined by @​goccy in #​681
• Encoder: write integers of up to sixteen digits by the lookups of their digits by @​goccy in #​682
• Encoder: find the quotes of a marshaler output in memory order on big-endian machines by @​goccy in #​683
• CI: run the tests on a big-endian machine (s390x under QEMU) by @​goccy in #​684
• Encoder: look at a short string and write it in one pass by @​goccy in #​685
• Encoder: escape strings of characters which are not ASCII faster when UTF-8 is normalized by @​goccy in #​686
• Raise the Go version of the module to 1.23 by @​goccy in #​687

Full Changelog: goccy/go-json@v0.11.1...v0.11.2

v0.11.1

Compare Source

What's Changed

• Handle the reported pull requests: omitzero, nil TextMarshaler pointers, the generated-code marker and a godoc fix by @​goccy in #​671
• Encoder: jump to one code of a large struct which is a value in many places by @​goccy in #​672

Full Changelog: goccy/go-json@v0.11.0...v0.11.1

v0.11.0

Compare Source

Highlights

• Compatible with encoding/json of the Go version in use: values are decoded and encoded, and errors are reported (their types, messages and offsets), as encoding/json does, including Go 1.27, whose encoding/json is built on encoding/json/v2. Many reported compatibility issues are fixed.
• Much faster: with the same behavior as encoding/json ( a live heap of 64 MB, geometric mean over the payloads of the report ), go-json decodes about 4.2–4.4x and encodes about 2.7–2.8x as fast as encoding/json, on amd64 and arm64 ( the results of this release are at https://goccy.github.io/go-json/ ).
• A benchmark report of the JSON libraries of Go, measured on GitHub Actions for every change and published at https://goccy.github.io/go-json/: the libraries are compared by category of behavior ( the behavior of encoding/json, of encoding/json/v2, without HTML escaping, key sorting and string copying, and every library at its fastest ), which every run checks, and the result files are attested with GitHub Artifact Attestations.
• No more go:linkname: go-json no longer links to the internals of the runtime or of reflect, so it builds with the restrictions of newer Go versions on go:linkname.

New APIs

• MarshalOf[T]: encodes a value of type T without copying it to the heap ( #​632 ).
• UnmarshalOf[T]: decodes into a *T which may stay on the stack of the caller, without an allocation for the argument ( #​658 ).
• OptimizeFieldOrder(): lets the encoder order the fields of a struct as it encodes them fastest, when the order of the keys doesn't matter ( #​646 ).
• DecodeNoCopyString(): lets the decoded strings refer to the input instead of copying them ( #​658 ).

Changes of behavior

These follow encoding/json, and may change what a program which relied on the previous behavior gets:

• The values of the keys which match no field are validated: invalid JSON anywhere in the input is a syntax error, as with encoding/json ( #​664 ).
• Syntax errors and type errors are reported as encoding/json of the Go version reports them: their types, messages and offsets ( #​661, #​664 ).
• A decoded string is a copy of its bytes, and doesn't keep the input alive; short strings share buffers of up to 16 KB ( #​658 ). Use DecodeNoCopyString() to refer to the input instead.
• The elements of an array are decoded into the existing elements of a slice, including the ones after its length within its capacity, as encoding/json does ( #​666 ).
• MarshalNoEscape and UnmarshalNoEscape are deprecated: use Marshal and UnmarshalOf ( #​631, #​658 ).
• DecodeFieldPriorityFirstWin() no longer allocates for each object, and is as fast as the default decode or faster ( #​668 ).

What's Changed

Decoder

• Decoder: decode a stream by the byte slice decoders, compare the decoder with sonic by @​goccy in #​656
• Decoder: allocate and assign through reflect instead of go:linkname by @​goccy in #​657
• Decoder: UnmarshalOf, copies of the decoded strings, recent decoders of a context by @​goccy in #​658
• Decoder and encoder: struct keys by a table, numbers in one pass, strings by AVX2, benchmarks of real APIs by @​goccy in #​659
• Decoder: allocate the value of a pointer by new of its kind by @​goccy in #​660
• Decoder: report the type errors as encoding/json of the Go version does by @​goccy in #​661
• Decoder: decode a value of interface{} without reflect by @​goccy in #​662
• Decoder: decode the values held by interface values by their type, as encoding/json does by @​goccy in #​663
• Decoder: fix the reported decoder issues, as encoding/json of the Go version decodes by @​goccy in #​664
• Decoder: narrow the gaps to sonic on escaped strings, and compare with sonic as a real program runs by @​goccy in #​665
• Decoder: narrow the gaps to sonic at its fastest: slices, maps, long escaped strings and interface values by @​goccy in #​666
• Decoder: remember the decoded fields of DecodeFieldPriorityFirstWin in a bit set by @​goccy in #​668
• Decoder: narrow the gap to sonic on interface{} values and string fields by @​goccy in #​670

Encoder

• Remove go:linkname to reflect.(*rtype) methods by @​goccy in #​624
• Remove runtime.Type and go:linkname to reflect.ifaceIndir by @​goccy in #​625
• Always give the address of the value to the encoder VM by @​goccy in #​626
• Fix the encoding of recursive structs and omitempty with a pointer receiver marshaler by @​goccy in #​628
• Fix the indent of deep recursive structs, marshalers of empty values and embedded structs by @​goccy in #​630
• Carry the values of the encoder VM as unsafe.Pointer and remove KeepRefs by @​goccy in #​631
• Add MarshalOf, which encodes a value without copying it to the heap by @​goccy in #​632
• Speed up the encoder: a hash table for the cache of a type, a lighter VM and a faster AppendString by @​goccy in #​634
• Encode a scalar held by an interface value without a frame by @​goccy in #​635
• Scan a string for a byte to escape by SIMD by @​goccy in #​637
• Call the method of a marshaler directly by its code by @​goccy in #​638
• Copy the output of a marshaler as it is if it is compact and valid by @​goccy in #​639
• Encoder: inline the helpers of the VM, and shorter paths for strings and maps by @​goccy in #​640
• Write the key of a map of strings by the opcode of the map entry by @​goccy in #​641
• Encoder: encode fields of the same kind in a row without a dispatch between them by @​goccy in #​643
• Encode a list of values of a recursive type in one frame by @​goccy in #​645
• Add the option to let the encoder order the fields of a struct by @​goccy in #​646
• Read the entries of a map without a linkname of the runtime by @​goccy in #​647
• Encoder: compare the keys of a map by their first bytes as a number first by @​goccy in #​649
• Encoder: cheaper frames of interface values by @​goccy in #​650
• Encoder: write the scalar entries of an unordered map of interface values as the map is read by @​goccy in #​651
• Write null for an interface value which holds nothing without a call by @​goccy in #​652
• Encoder: encode a field of interface{} by an opcode of its own by @​goccy in #​653
• Test the cases of the reported issues of the encoder by @​goccy in #​655

Other fixes

• Fix encode/decoder compile data race by @​TelpeNight in #​567

Benchmarks, documents and CI

• Fix CI failures on master caused by outdated Go versions by @​goccy in #​594
• Add bench-check task to fail CI on performance degradation by @​goccy in #​623
• Judge the benchmarks by the mean and by the fastest results by @​goccy in #​629
• Benchmarks: add the benchmarks of sonic's encoder, with go-json beside it by @​goccy in #​648
• Modernize the code: any, unsafe.Add, slices.Contains, min, max, bytes.Cut by @​goccy in #​654
• Publish a benchmark report of the JSON libraries by category of behavior, describe the decoder as it is now in the README, and run no CI for documents alone by @​goccy in #​667
• Benchmarks: color the bars of the summary by library by @​goccy in #​669

New Contributors

• @​TelpeNight made their first contribution in #​567

Full Changelog: goccy/go-json@v0.10.6...v0.11.0

v1.1.1

What's Changed

• fix(prometheus): count only successful message operations by @​janisz in #​826
• Fix pre-registration of handled metrics with context labels by @​t-bowcock in #​810
• feat(prometheus): add ContextLabels to ClientMetrics by @​ArtARTs36 in #​798

Full Changelog: grpc-ecosystem/go-grpc-middleware@providers/prometheus/v1.1.0...providers/prometheus/v1.1.1

v2.31.0

Compare Source

What's Changed

• Update minimum Go version from 1.25.0 to 1.26.0 by @​johanbrandhorst in #​7269
• fix(openapiv2): omit oneof siblings of path parameters from query parameters by @​hsdfat in #​7207
• fix: import response type package when response_body is set by @​MicBun in #​7225
• openapiv3: add extension (x-*) support by @​Abmun in #​7237
• docs: add a security considerations page by @​cleitonaugusto in #​7282
• fix(openapiv2): emit map key type in query parameter names by @​iamrajiv in #​7307
• Fix template_test format strings by @​skitt in #​7323
• Add edition 2026 support by @​printfn in #​7352
• fix(openapiv2): emit a primitive type for well-known object query parameters by @​iamrajiv in #​7351
• reject out-of-range numeric enum query values in parseField by @​itecz26 in #​7369
• feat(protoc-gen-openapiv3): support response_body binding by @​tobiaskohlbau in #​7371
• clamp overflowing grpc-timeout to max duration by @​itecz26 in #​7382
• validate forwarded header values before adding to grpc metadata by @​itecz26 in #​7390
• reject out-of-range enum numbers in jsonpb non-proto decoder by @​itecz26 in #​7397
• fix(openapiv2): emit minItems and maxItems on query parameters by @​wofiporia in #​7389
• reject grpc-metadata headers mapping into reserved grpcgateway- namespace by @​itecz26 in #​7401
• parse integer and enum path params as base 10 in convert.go by @​itecz26 in #​7405
• protoc-gen-openapiv2: allow proto files without a go_package option by @​cipherprofessor in #​7409
• runtime: deep wildcard (**) must not match zero segments after a preceding literal by @​cipherprofessor in #​7412

New Contributors

• @​MicBun made their first contribution in #​7225
• @​Abmun made their first contribution in #​7237
• @​cleitonaugusto made their first contribution in #​7282
• @​skitt made their first contribution in #​7323
• @​itecz26 made their first contribution in #​7369
• @​tobiaskohlbau made their first contribution in #​7371
• @​wofiporia made their first contribution in #​7389
• @​cipherprofessor made their first contribution in #​7409

Full Changelog: grpc-ecosystem/grpc-gateway@v2.30.0...v2.31.0

v1.20.3

Compare Source

What's Changed

• zstd: two-pass decode with match-source prefetch on arm64 (largest win decoding SpeedBestCompression-class data) by @​lizthegrey in #​1212
• zstd: speed up better encoder hashing, primes in registers on arm64 by @​lizthegrey in #​1230
• zstd: reuse dictionary sequence tables in the encoder by @​lizthegrey in #​1233
• zstd: close most of the decode gap to libzstd on real corpora by @​lizthegrey in #​1232
• huff0: align the decode inner loops to 64 bytes by @​lizthegrey in #​1236
• zstd: keep default-encoder hash primes in registers on arm64 by @​lizthegrey in #​1241
• zstd: align the sequence decode and execute loops to 64 bytes by @​lizthegrey in #​1240
• zstd, huff0: cheaper per-block table setup by @​lizthegrey in #​1234
• zstd, s2, flate: smoke-test Silesia in CI, add real-corpus benchmarks by @​lizthegrey in #​1237
• zip: reject entries named "." in ReadDir to stop infinite fs.WalkDir by @​Raghuvardhan-Reddy78 in #​1249
• zstd: decode at full speed into exact-size destinations by @​lizthegrey in #​1246
• s2: Reject short index chunk in RemoveIndexHeaders by @​Raghuvardhan-Reddy78 in #​1254
• zstd, huff0: keep the encoder bit writers in registers by @​lizthegrey in #​1245
• huff0: reuse Scratch across inputs in the fuzzers by @​lizthegrey in #​1257

New Contributors

• @​Raghuvardhan-Reddy78 made their first contribution in #​1235
• @​SulimanAbdulrazzaq made their first contribution in #​1255

Full Changelog: klauspost/compress@v1.20.1...v1.20.3

v1.20.2

Compare Source

• zstd: Fix DecodeAll crash on specially crafted input. GHSA-fpmh-frq8-7rj8.
• s2: fix LZ4 block conversion writing past dst by @​klauspost in #​1244
• dict: Stricter input validation by @​klauspost in #​1250
• zstd: reject snappy copy shorter than minimum match by @​Raghuvardhan-Reddy78 in #​1235

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

v1.20.1

Compare Source

What's Changed

• zstd: apply reset options to reused frame decoders by @​pellared in #​1226
• flate: Report unexpected EOF for truncated Huffman extra bits by @​rupayon123 in #​1229
• flate: avoid FMA in EstimatedBits for portable rounding by @​malt3 in #​1224
• gzhttp: preserve caller request headers in Transport by @​jakezwang in #​1225
• gzhttp: only decompress a request when gzip is the outermost coding by @​youdie006 in #​1223
• zstd/huff0: Optimizations by @​lizthegrey in #​1203 #​1205 #​1207 #​1204 #​1208 #​1211 #​1209 #​1210
• flate: Speed improvements by @​alex in #​1220 #​1218 #​1216 #​1215 #​1214 [#​1217](https://redirect.github

❗ Important

✂ PR body was truncated to here.