v3.2.0

Require Go 1.24

What's Changed

• Potential fix for code scanning alert no. 1: Workflow does not contain permissions by @shamaton in #75
• Bump actions/upload-artifact from 5.0.0 to 7.0.1 by @dependabot[bot] in #77
• Bump securego/gosec from de65614d10a6b84029e3e1215567b8ce7e490f23 to 6351b0c6fcc7d75acb230a9be7f9047aada322ae by @dependabot[bot] in #78
• Bump actions/download-artifact from 5.0.0 to 8.0.1 by @dependabot[bot] in #79
• ci: update some workflows by @shamaton in #84
• Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #80
• Bump Songmu/tagpr from 1.19.0 to 1.20.0 by @dependabot[bot] in #81
• Bump securego/gosec from 6351b0c6fcc7d75acb230a9be7f9047aada322ae to 9addc97cefc9460a114e3c36f536b935da3b98c9 by @dependabot[bot] in #85
• chore: update README by @shamaton in #86
• Bump securego/gosec from 9addc97cefc9460a114e3c36f536b935da3b98c9 to f1c81de5fcdf7b466b229fb24ca02d1a8406dd09 by @dependabot[bot] in #87
• Bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #88
• Bump securego/gosec from f1c81de5fcdf7b466b229fb24ca02d1a8406dd09 to caf8857bbd3276599d0176b0528e9712bb0b5bec by @dependabot[bot] in #89
• Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #90
• Bump securego/gosec from caf8857bbd3276599d0176b0528e9712bb0b5bec to 11023e51e1f46c4ea63315bdb7670f073442168f by @dependabot[bot] in #94
• Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #91
• Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #93
• Bump securego/gosec from 11023e51e1f46c4ea63315bdb7670f073442168f to 849570622f56a251c015c0e2417aebafc0216e17 by @dependabot[bot] in #95
• Bump actions/labeler from 6.1.0 to 6.2.0 by @dependabot[bot] in #96
• Require Go 1.24 by @shamaton in #97

Full Changelog: v3.1.2...v3.2.0

v3.1.2

What's Changed

• chore: clean up and pin GitHub Actions workflows by @shamaton in #71
• Bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in #73
• fix: harden numeric conversions for gosec by @shamaton in #74

New Contributors

• @dependabot[bot] made their first contribution in #73

Full Changelog: v3.1.1...v3.1.2

v2.4.1

What's Changed

fix CVE-2022-41719 @ v2

Fixes

• Backport ext frame bounds validation to v2 by @shamaton in #66
  • Validates ext frame bounds before invoking custom ext decoders.
  • Adds regression tests for truncated ext and timestamp payloads.

Maintenance

• Add tagpr configuration for the v2 release line by @shamaton in #67

v3.1.1

What's Changed

fix CVE-2022-41719 @ v3

• chore: isolate formatting cleanup from #60 by @shamaton in #61
• Add tagpr configuration by @shamaton in #63
• fix: validate ext frame bounds before byte-slice decode by @hyp3rd in #60

New Contributors

• @hyp3rd made their first contribution in #60

Full Changelog: v3.1.0...v3.1.1

v3.1.0

Summary

This release adds full support for embedded (anonymous) structs with an optimized fast path when embedding is not used, aligning struct field promotion and conflict resolution with encoding/json.

Highlights

• Added embedded struct field collection and promotion, including tag-aware precedence and ambiguity handling.
• Preserved a fast path for non-embedded structs; uses path-based access only when embedding is present.
• Added omitempty handling on embedded parents, omitting promoted fields when the parent is zero or nil.
• Added decoding support for embedded pointer structs with allocation when needed.

Behavior Changes

• Embedded struct fields are now promoted by default (unless the embedded field is tagged).
• Ambiguous field names from multiple embedded structs are omitted (matching encoding/json behavior).
• omitempty on an embedded parent can suppress all promoted fields when the parent is zero or nil.

Tests

• Added comprehensive tests for embedded structs, tag behavior, shadowing, ambiguity, pointer embedding, and omitempty.

Full Changelog: https://github.com/shamaton/msgpack/commits/v3.1.0

v3.0.0

Breaking Changes

• Module path changed to github.com/shamaton/msgpack/v3 (update imports and go get)
• Default time.Time decoding is now UTC (use msgpack.SetDecodedTimeAsLocal() to keep v2 behavior)

Upgrade Guide

1. Update module path: go get -u github.com/shamaton/msgpack/v3
2. Replace imports from github.com/shamaton/msgpack/v2 to github.com/shamaton/msgpack/v3
3. If you rely on local time decoding, call: msgpack.SetDecodedTimeAsLocal()

Compatibility

• Go version updated to go 1.23

Documentation

• README updated with v3 install and v2 upgrade guidance

Full Changelog: v2.4.0...v3.0.0

v2.4.0

Highlights

• New global switches to control the timezone used when decoding MessagePack Timestamp into Go’s time.Time.
• No breaking changes in v2.4.0. The default behavior remains Local.
• Heads-up for v3: default decoded time.Time will change to UTC (instant unchanged).

Added

• msgpack.SetDecodedTimeAsUTC() — forces decoded time.Time to use UTC.
• msgpack.SetDecodedTimeAsLocal() — forces decoded time.Time to use Local (mirrors current default in v2.x).

These functions allow you to preview and standardize your runtime behavior before upgrading to v3.

Why this matters

MessagePack’s Timestamp represents an instant (epoch seconds + nanoseconds) and does not carry timezone info. Historically, decoding to Local could lead to environment-dependent differences across hosts. Many distributed systems and APIs prefer UTC for predictability.

Usage

// Opt in to UTC decoding on v2.x (recommended for distributed systems/APIs)
msgpack.SetDecodedTimeAsUTC()

// Restore/keep Local decoding explicitly
msgpack.SetDecodedTimeAsLocal()

Note: v2.4.0 still defaults to Local unless you call SetDecodedTimeAsUTC().

What’s next (v3 heads-up)

In v3.0.0, the default decoded time.Time location will change from Local to UTC.
The encoded/decoded instant is unchanged; only time.Time.Location() differs.
If you rely on local display, you’ll be able to call msgpack.SetDecodedTimeAsLocal() to keep the old behavior.

Migration tips

• If your UI expects local time, call msgpack.SetDecodedTimeAsLocal() at startup.
• For logs/APIs/DBs, consider standardizing on UTC now via msgpack.SetDecodedTimeAsUTC() to smooth the v3 upgrade.
• Tests that assert string forms of time.Time may need to normalize to UTC or set the desired location explicitly.

Links

• Issue: #51
• PR: #52

Full Changelog: v2.3.1...v2.4.0

v2.3.1

What's Changed

• Fix calcuration size of Ext format by @shamaton in #48

Full Changelog: v2.3.0...v2.3.1

v2.3.0

What's Changed

• support for omitempty in tag by @shamaton in #47

Full Changelog: v2.2.3...v2.3.0

v2.2.3

What's Changed

• Fix UnmarshalRead binary slice case by @shamaton in #45

Full Changelog: v2.2.2...v2.2.3