CHANGELOG.md

Template:

• Fix issue X in feature Y (by YYY)

Next

0.14.0 (2026-04-07)

• Fix NULL dereference in cbor_move, cbor_serialized_size, and cbor_serialize_tag when a tag has no item set (reported by Benjamin608608)
• Document large-allocation risk in cbor_load and clarify test-only CMake flags
• Fix NULL dereference in cbor_copy/cbor_copy_definite on allocation failure (reported by Benjamin608608)
• Explicitly guard against size * 2 overflow in cbor_builder_map_start_callback (reported by Benjamin608608)
• Only generate CMake coverage build targets when explicitly enabled
• Fix CMake feature macro names and ensure _CBOR_NODISCARD is defined with [[nodiscard]]
• Fix integer overflow in cbor_copy_definite() when accumulating indefinite bytestring/string chunk lengths
• Add bounds check in cbor_array_get() to return NULL on out-of-bounds access
• BREAKING: cbor_tag_set_item now releases the reference to the previous tagged item
  • Previously, replacing the tagged item would leak the old item's reference. If you were manually releasing the old item before calling cbor_tag_set_item, you should remove the extra cbor_decref.
• Potentially BREAKING: cbor_tag_item now returns NULL if the tag has no item set
  • Previously, this would be undefined behavior (NULL pointer dereference), so no valid clients should be affected.
• Potentially BUILD BREAKING: CPack Debian package architecture is now detected via dpkg instead of being hardcoded to amd64
• BUILD BREAKING: Remove deprecated CBOR_CUSTOM_ALLOC CMake option
  • The option has been a no-op since 0.10.0. If your build passes -DCBOR_CUSTOM_ALLOC=ON, remove it.
• Modernize CMake build: use project(VERSION ...), replace add_definitions() with target-scoped target_compile_definitions(), remove redundant include_directories()
• Replace global CMAKE_C_FLAGS mutations with target-scoped target_compile_options() via an INTERFACE library, and simplify LTO configuration
• Fix Windows CI: propagate _CRT_SECURE_NO_WARNINGS to examples/tests, restrict LTO to Release builds, parallelize Windows CI build
• Add cbor_map_get for key-based map lookup with a caller-supplied equality function
  • Signature: cbor_map_get(map, key, eq) — pass any equality predicate, e.g. cbor_structurally_equal
  • Parameterised equality allows type-specific comparators or custom data-model semantics without library changes
  • See also: #96
• Add cbor_structurally_equal for encoding-level item comparison
  • Compares two items structurally: encoding width, definite-vs-indefinite length, chunk boundaries, and map entry order all count
  • Runs in O(n) time in the encoded byte size with no additional allocations
  • See also: #96
• BREAKING: Fix NaN encoding in cbor_encode_half to preserve sign and payload bits
  • Previously, all NaN values were encoded as 0x7E00 (positive quiet NaN, zero payload). Now the sign bit and the top 10 mantissa bits are preserved in the half-precision encoding.
  • _cbor_decode_half now reconstructs the NaN bit pattern faithfully, enabling encode/decode round-trips. Previously it always returned the C NAN constant.
  • Very small normal floats that previously rounded to +0 now round to ±0 depending on their sign.
  • Clients that relied on all NaNs normalising to 0x7E00 will see different output. See #215.

0.13.0 (2025-08-30)

• Fix cbor_is_null, cbor_is_undef, cbor_is_bool assertion failing on non-ctrl floats in debug mode (bug discovered by https://github.com/psturm-swift)
• Add an example for handling of CBOR Sequences
• Use C23/c2x if available
  • libcbor remains C99 compatible
  • When the compiler does not support new standard, C99 will be used, so the change should be backwards compatible
• Improved introduction documentation and examples
• Add cbor_copy_definite to turn indefinite items into definite equivalents (proposed by Jacob Teplitsky)
• BUILD BREAKING: Minimum CMake version set to 3.5 to be compatible with CMake 4 (suggestion by https://github.com/hnyman)
  • See https://repology.org/project/cmake/versions for support; the vast majority of users should not be affected.

0.12.0 (2025-03-16)

• BUILD BREAKING: Respect INTERPROCEDURAL_OPTIMIZATION and use the default value
• BREAKING: Changes to NaN encoding
  • Fix NaN encoding on Windows
  • Fix NaN encoding on mips/mipsel
  • Signaling NaNs will from now on be encoded as canonical quiet NaNs. This was already the existing behavior for half-precision floats
  • Decoding is unchanged
  • Please note that this is an intermediate state and likely to be revisited (#336)
• Make build compatible with CMake FetchContent (by Jan200101)
• Support Bzlmod for Bazel builds
  • This should significantly simplify including libcbor as a dependency/module in Bazel projects, see https://bazel.build/external/migration
• Code quality improvements
  • Fix compiler pragmas (by brooksdavis)
  • Fix code style issues
• Fixed bug in cbor2cjson example (by whitehse)

0.11.0 (2024-02-04)

• Updated documentation to refer to RFC 8949
• Improvements to cbor_describe
  • Bytestring data will now be printed as well by akallabeth
  • Formatting consistency and clarity improvements
• Fix cbor_string_set_handle not setting the codepoint count
• BREAKING: cbor_load will no longer fail on input strings that are well-formed but not valid UTF-8
  • If you were relying on the validation, please check the result using cbor_string_codepoint_count instead
• BREAKING: All decoders like cbor_load and cbor_stream_decode will accept all well-formed tag values (bug discovered by dskern-github)
  • Previously, decoding of certain values would fail with CBOR_ERR_MALFORMATED or CBOR_DECODER_ERROR
  • This also makes decoding symmetrical with serialization, which already accepts all values

0.10.2 (2023-01-31)

• Fixed minor test bug causing failures for x86 Linux (discovered by trofi)
  • Actual libcbor functionality not affected, bug was in the test suite
• Made tests platform-independent

0.10.1 (2022-12-30)

• Fix a regression in cbor_serialize_alloc that caused serialization of zero-length strings and bytestrings or byte/strings with zero-length chunks to fail (discovered by martelletto)

0.10.0 (2022-12-29)

• Make the buffer_size optional in cbor_serialize_alloc [#205] (by hughsie)
• BREAKING: Improved half-float encoding for denormalized numbers. [#208] (by ranvis)
  • Denormalized half-floats will now preserve data in the mantissa
  • Note: Half-float NaNs still lose data (#215)
• BUILD BREAKING: Minimum CMake version is 3.0 [#201] (by thewtex@)
  • See https://repology.org/project/cmake/versions for support; the vast majority of users should not be affected.
• Fix a potential memory leak when the allocator fails during array or map decoding [#224] (by James-ZHANG)
• Fix a memory leak when the allocator fails when adding chunks to indefinite bytestrings. (discovered by James-ZHANG)
• Fix a memory leak when the allocator fails when adding chunks to indefinite strings
• Potentially BUILD BREAKING: Add nodiscard attributes to most functions
  • Warning: This may cause new build warnings and (in rare cases, depending on your configuration) errors
• BREAKING: Fix cbor_copy leaking memory and creating invalid items when the allocator fails.
  • Previously, the failures were not handled in the interface. Now, cbor_copy may return NULL upon failure; clients should check the return value
• Fix cbor_build_tag illegal memory behavior when the allocator fails
• Add a new cbor_serialized_size API
• Reworked cbor_serialize_alloc to allocate the exact amount of memory necessary upfront
  • This should significantly speed up cbor_serialize_alloc for large items by avoiding multiple reallocation iterations
  • Clients should not use the return value of cbor_serialize_alloc. It may be removed in the future.
• BUILD BREAKING: Deprecate CBOR_CUSTOM_ALLOC
  • cbor_set_allocs will always be enabled from now on
  • Note: The flag will be kept as a no-op triggering a warning when used for one version and then removed completely

0.9.0 (2021-11-14)

• Improved pkg-config paths handling [#164] (by jtojnar@)
• Use explicit math.h linkage [#170]
• BREAKING: Fixed handling of items that exceed the host size_t range [#186]
  • Callbacks for bytestrings, strings, arrays, and maps use uint64_t instead of size_t to allow handling of large items that exceed size_t even if size_t < uint64_t
  • cbor_decode explicitly checks size to avoid overflows (previously broken, potentially resulting in erroneous decoding on affected systems)
  • The change should be a noop for 64b systems
• Added a Bazel build example [#196] (by andyjgf@)

0.8.0 (2020-09-20)

• BUILD BREAKING: Use BUILD_SHARED_LIBS to determine how to build libraries (fixed Windows linkage) [#148] (by intelligide@)
• BREAKING: Fix cbor_tag_item not increasing the reference count on the tagged item reference it returns [Fixes #109] (discovered bt JohnGilmour)
  • If you have previously relied on the broken behavior, you can use cbor_move to emulate as long as the returned handle is an "rvalue"
• BREAKING: CBOR_DECODER_EBUFFER removed from cbor_decoder_status
  • cbor_stream_decode will set CBOR_DECODER_NEDATA instead if the input buffer is empty
• Fix cbor_stream_decode to set cbor_decoder_result.required to the minimum number of input bytes necessary to receive the next callback (as long as at least one byte was passed) (discovered by woefulwabbit)
• Fixed several minor manpage issues [#159] (discovered by kloczek@)

0.7.0 (2020-04-25)

• Fix bad encoding of NaN half-floats [Fixes #53] (discovered by BSipos-RKF)
  • Warning: Previous versions encoded NaNs as 0xf9e700 instead of 0xf97e00; if you rely on the broken behavior, this will be a breaking change
• Fix potentially bad encoding of negative half-float with exponent < -14 [Fixes #112] (discovered by yami36)
• BREAKING: Improved bool support [Fixes #63]
  • Rename cbor_ctrl_is_bool to cbor_get_bool and fix the behavior
  • Add cbor_set_bool
• Fix memory_allocation_test breaking the build without CBOR_CUSTOM_ALLOC [Fixes #128] (by panlinux)
• Fix a potential build issue where cJSON includes may be misconfigured
• Breaking: Add a limit on the size of the decoding context stack (by James-ZHANG)
  • If your usecase requires parsing very deeply nested structures, you might need to increase the default 2k limit via CBOR_MAX_STACK_SIZE
• Enable LTO/IPO based on CheckIPOSupported [#143] (by xanderlent)
  • If you rely on LTO being enabled and use CMake version older than 3.9, you will need to re-enable it manually or upgrade your CMake

0.6.1 (2020-03-26)

• Fix bad shared library version number
  • Warning: Shared library built from the 0.6.0 release is erroneously marked as version "0.6.0", which makes it incompatible with future releases including the v0.6.X line even though they may be compatible API/ABI-wise. Refer to the documentation for the new SO versioning scheme.

0.6.0 (2020-03-15)

• Correctly set .so version [Fixes #52].
  • Warning: All previous releases will be identified as 0.0 by the linker.
• Fix & prevent heap overflow error in example code [#74] [#76] (by @nevun)
• Correctly set OSX dynamic library version [Fixes #75]
• Fix misplaced 0xFF bytes in maps possibly causing memory corruption
• BREAKING: Fix handling & cleanup of failed memory allocation in constructor and builder helper functions [Fixes #84]
  • All cbor_new_and cbor_build_ functions will now explicitly return NULL when memory allocation fails
  • It is up to the client to handle such cases
• Globally enforced code style [Fixes #83]
• Fix issue possible memory corruption bug on repeated cbor_(byte)string_add_chunk calls with intermittently failing realloc calls
• Fix possibly misaligned reads and writes when endian.h is uses or when running on a big-endian machine [Fixes #99, #100]
• Improved CI setup with Travis-native arm64 support
• Docs migrated to Sphinx 2.4 and Python3

0.5.0 (2017-02-06)

• Remove cmocka from the subtree (always rely on system or user-provided version)
• Windows CI
• Only build tests if explicitly enabled (-DWITH_TESTS=ON)
• Fixed static header declarations (by cedric-d)
• Improved documentation (by Michael Richardson)
• Improved examples/readfile.c
• Reworked (re)allocation to handle huge inputs and overflows in size_t [Fixes #16]
• Improvements to C++ linkage (corrected cbor_empty_callbacks, fixed restrict pointers) (by Dennis Bijwaard)
• Fixed Linux installation directory depending on architecture [Fixes #34] (by jvymazal)
• Improved 32-bit support [Fixes #35]
• Fixed MSVC compatibility [Fixes #31]
• Fixed and improved half-float encoding [Fixes #5, #11]

0.4.0 (2015-12-25)

Breaks build & header compatibility due to:

• Improved build configuration and feature check macros
• Endianness configuration fixes (by Erwin Kroon and David Grigsby)
• pkg-config compatibility (by Vincent Bernat)
• enable use of versioned SONAME (by Vincent Bernat)
• better fuzzer (wasn't random until now, ooops)

0.3.1 (2015-05-21)

• documentation and comments improvements, mostly for the API reference

0.3.0 (2015-05-21)

• Fixes, polishing, niceties across the code base
• Updated examples
• cbor_copy
• cbor_build_negint8, 16, 32, 64, matching asserts
• cbor_build_stringn
• cbor_build_tag
• cbor_build_float2, ...

0.2.1 (2015-05-17)

• C99 support

0.2.0 (2015-05-17)

• cbor_ctrl_bool -> cbor_ctrl_is_bool
• Added cbor_array_allocated & map equivalent
• Overhauled endianess conversion - ARM now works as expected
• 'sort.c' example added
• Significantly improved and doxyfied documentation

0.1.0 (2015-05-06)

The initial release, yay!