Update go updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/fxamacker/cbor/v2	v2.9.1 → v2.9.6
golang.org/x/sys	v0.43.0 → v0.49.0
golang.org/x/term	v0.42.0 → v0.47.0

---

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.6

Compare Source

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

Not affected:

• Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
• Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
• Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
• Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #​855 for details.

⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #​827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

• Skip CBOR data item when destination struct has incorrect tags by @​fxamacker in #​821
• Fix decoding CBOR null/undefined to interface value by @​fxamacker in #​827
• Fix decoding to unaddressable value in interface by @​fxamacker in #​828
• Improve the DefaultByteStringType check by @​fxamacker in #​829
• Fix decoding to self-referencing types by @​fxamacker in #​831
• Fix decoding 55799(null) to pointer or interface by @​fxamacker in #​851
• Fix stale Go map entry from CBOR null key/value by @​fxamacker in #​855

Encoding

• Fix encoding self-referencing types by @​fxamacker in #​833
• Fix panic encoding marshaler of unsupported underlying types by @​fxamacker in #​834
• Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @​fxamacker in #​835
• Fix encoding TimeUnixMicro outside 1677 to 2262 by @​fxamacker in #​837
  • Encoded output also changes for some times within one second of either end of that range.
• Reject encoding time.Time when Go formats wrong year by @​fxamacker in #​838

CI / GitHub Actions and Docs

• Improve docs related to encoding time.Time by @​fxamacker in #​854

Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6

v2.9.5

Compare Source

This version was tagged from the wrong branch by mistake and is retracted.

Use v2.9.6 (https://github.com/fxamacker/cbor/releases/tag/v2.9.6) instead.

v2.9.4

Compare Source

This release fixes potential panics when decoding a CBOR map whose key decodes to an uncomparable Go value under certain conditions.

Not affected: user apps that don't register tag types and don't use map key types that are either named empty interfaces (e.g. type MyAny any) or contain interfaces.

These potential panics can be encountered when one of these two conditions is met:

• user application registers a tag type (via TagSet interface) that is an array or struct with uncomparable or interface{} element or field type, or
• user application specifies a destination Go map whose key type is a named empty interface type or a type containing an interface.

This was identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended to cover this bug.

Upgrading to v2.9.4 is recommended.

What's Changed

• Fix panic decoding uncomparable map keys under certain conditions by @​fxamacker in #​817

Full Changelog: fxamacker/cbor@v2.9.3...v2.9.4

v2.9.3

Compare Source

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

• Skip data item when decoding to time.Time fails under certain conditions by @​fxamacker in #​803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

v2.9.2

Compare Source

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

• Reject encoding indefinite-length map with odd item count by @​fxamacker in #​764
• Reject encoding indefinite-length data item as a chunk inside indefinite-length byte string or text string by @​fxamacker in #​765
• Make TagSet.Remove a no-op when contentType is nil by @​fxamacker in #​766
• Refactor indefinite-length encoding and improve chunk validation during encoding by @​fxamacker in #​767
• Add more tests, fix a nit in unreachable panic message, update docs & ci by @​fxamacker in #​768

CI / GitHub Actions and Docs

🔎 Details...

• Bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​760
• Bump github/codeql-action from 4.34.1 to 4.35.1 by @​dependabot[bot] in #​761
• Bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​763
• Update README for v2.9.2 release by @​fxamacker in #​769

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
go	1.25.0 -> 1.26.0