CVS commit: pkgsrc/devel/libcbor

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Jul 19 10:20:18 UTC 2026

Modified Files:
        pkgsrc/devel/libcbor: Makefile distinfo

Log Message:
libcbor: update to 0.14.0.

0.14.0 (2026-04-07)
---------------------

- [Fix NULL dereference in `cbor_move`, `cbor_serialized_size`, and `cbor_serialize_tag` when a tag has no item set]
- [Document large-allocation risk in `cbor_load` and clarify test-only CMake flags]
- [Fix NULL dereference in `cbor_copy`/`cbor_copy_definite` on allocation failure]
- [Explicitly guard against `size * 2` overflow in `cbor_builder_map_start_callback`]
- [Only generate CMake coverage build targets when explicitly enabled]
- [Fix CMake feature macro names and ensure `_CBOR_NODISCARD` is defined with `[[nodiscard]]`]
- [Fix integer overflow in `cbor_copy_definite()` when accumulating indefinite bytestring/string chunk lengths]
- [Add bounds check in `cbor_array_get()` to return NULL on out-of-bounds access]
- BREAKING: [`cbor_tag_set_item` now releases the reference to the previous tagged item]
  - Previously, replacing the tagged item would leak the old item's reference. If you were manually releasing the old item before calling `cbor_tag_set_item`, you should remove the extra 
`cbor_decref`.
- Potentially BREAKING: [`cbor_tag_item` now returns NULL if the tag has no item set]
  - Previously, this would be undefined behavior (NULL pointer dereference), so no valid clients should be affected.
- Potentially BUILD BREAKING: [CPack Debian package architecture is now detected via `dpkg` instead of being hardcoded to `amd64`]
- BUILD BREAKING: [Remove deprecated `CBOR_CUSTOM_ALLOC` CMake option]
  - The option has been a no-op since 0.10.0. If your build passes `-DCBOR_CUSTOM_ALLOC=ON`, remove it.
- [Modernize CMake build: use `project(VERSION ...)`, replace `add_definitions()` with target-scoped `target_compile_definitions()`, remove redundant `include_directories()`]
- [Replace global `CMAKE_C_FLAGS` mutations with target-scoped `target_compile_options()` via an INTERFACE library, and simplify LTO configuration]
- [Fix Windows CI: propagate `_CRT_SECURE_NO_WARNINGS` to examples/tests, restrict LTO to Release builds, parallelize Windows CI build]
- [Add `cbor_map_get` for key-based map lookup with a caller-supplied equality function]
  - Signature: `cbor_map_get(map, key, eq)` — pass any equality predicate, e.g. `cbor_structurally_equal`
  - Parameterised equality allows type-specific comparators or custom data-model semantics without library changes
  - See also: #96
- [Add `cbor_structurally_equal` for encoding-level item comparison]
  - Compares two items structurally: encoding width, definite-vs-indefinite length, chunk boundaries, and map entry order all count
  - Runs in O(n) time in the encoded byte size with no additional allocations
  - See also: #96
- BREAKING: [Fix NaN encoding in `cbor_encode_half` to preserve sign and payload bits]
  - Previously, all NaN values were encoded as `0x7E00` (positive quiet NaN, zero payload). Now the sign bit and the top 10 mantissa bits are preserved in the half-precision encoding.
  - `_cbor_decode_half` now reconstructs the NaN bit pattern faithfully, enabling encode/decode round-trips. Previously it always returned the C `NAN` constant.
  - Very small normal floats that previously rounded to `+0` now round to `±0` depending on their sign.
  - Clients that relied on all NaNs normalising to `0x7E00` will see different output. See #215.


To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 pkgsrc/devel/libcbor/Makefile
cvs rdiff -u -r1.10 -r1.11 pkgsrc/devel/libcbor/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/libcbor/Makefile
diff -u pkgsrc/devel/libcbor/Makefile:1.16 pkgsrc/devel/libcbor/Makefile:1.17
--- pkgsrc/devel/libcbor/Makefile:1.16  Sun Aug 31 10:09:20 2025
+++ pkgsrc/devel/libcbor/Makefile       Sun Jul 19 10:20:18 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.16 2025/08/31 10:09:20 wiz Exp $
+# $NetBSD: Makefile,v 1.17 2026/07/19 10:20:18 wiz Exp $
 
-DISTNAME=      libcbor-0.13.0
+DISTNAME=      libcbor-0.14.0
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=PJK/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/libcbor/distinfo
diff -u pkgsrc/devel/libcbor/distinfo:1.10 pkgsrc/devel/libcbor/distinfo:1.11
--- pkgsrc/devel/libcbor/distinfo:1.10  Sun Aug 31 10:09:20 2025
+++ pkgsrc/devel/libcbor/distinfo       Sun Jul 19 10:20:18 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.10 2025/08/31 10:09:20 wiz Exp $
+$NetBSD: distinfo,v 1.11 2026/07/19 10:20:18 wiz Exp $
 
-BLAKE2s (libcbor-0.13.0.tar.gz) = fb29ae6690546fbe9e795d3bb47e5fff36f452fda4969edc61efc6c4cb35678b
-SHA512 (libcbor-0.13.0.tar.gz) = 4b41f3c55de0169a60cbd353694c741c3db32d6a173feb1cb14022a7daf8511fc32befbaff7133903ea005df3db02e8ebd67881dff2cfdb89a5e51203b03fe4f
-Size (libcbor-0.13.0.tar.gz) = 299917 bytes
+BLAKE2s (libcbor-0.14.0.tar.gz) = 01a5eebb832e990a5d8df8a0fe6eee2047ec995e5db6544c732bf4a1507a3134
+SHA512 (libcbor-0.14.0.tar.gz) = e580543d9cb567d484e14c3057c5c1672f012879abe3f04ead64bf0f14b95b986fcc26602b0ffc2b247e9bfbd8a914d676c25d4f62230ac8fd5a6727f7d34595
+Size (libcbor-0.14.0.tar.gz) = 317101 bytes