[dependabot]

Bumps github.com/oschwald/maxminddb-golang/v2 from 2.5.0 to 2.7.0.

Release notes

Sourced from github.com/oschwald/maxminddb-golang/v2's releases.

2.7.0

• Go 1.26 or later is now required. CI now tests Go 1.26 and 1.27.
• Fixed Reader.Verify() rejecting a search-tree record that points to a value nested in another data record. The MaxMind DB spec permits this, and mmdbwriter can write such databases. GitHub #250.
• Decoding now rejects extended type bytes 0 and 250 through 255, which the MaxMind DB spec does not define. Before, they decoded as other types. For example, 0x00 0xfb decoded as a string.
• Reader.Verify() now rejects a data pointer that points into the middle of a field.
• Reader.Verify() now also checks the metadata section. Its pointers must point to the start of a field, and all data after the metadata map must be valid values.

2.6.0

• Fixed a denial-of-service issue where a crafted database could use repeated pointers to cause excessive CPU and memory use during reflection decoding. The decoder now limits decoding work and decoded payload size.
• Made search-tree verification visit shared subtrees only once, bounding work while still rejecting cycles and overlong paths.
• Added the maxsize:N struct-tag option to limit maps, arrays, strings, and bytes in reflection and generated decoders, plus bounded cursor reads. Field names containing commas must now be single-quoted.
• Made generated decoders reject duplicate recognized map keys.
• Added mmdbdata.Cursor.Offset() to retrieve a value's resolved control-byte offset for caching within a database. It returns an error when resolution fails; the legacy Decoder.Offset() retains its original-offset fallback.
• Improved performance:
  • Reduced 28-bit search-tree lookup overhead with single-word node reads.
  • Extended bounded cursor string fast paths to wider data pointers.
  • Avoided repeated reflection dispatch for pointer-backed strings.
  • Inlined compact header reads when skipping values during budgeted decoding.
  • Avoided repeated type dispatch for unsigned integers decoded into any.
  • Cached validated struct-field matches to speed up repeated decoding.

Changelog

Sourced from github.com/oschwald/maxminddb-golang/v2's changelog.

2.7.0 - 2026-09-29

• Go 1.26 or later is now required. CI now tests Go 1.26 and 1.27.
• Fixed Reader.Verify() rejecting a search-tree record that points to a value nested in another data record. The MaxMind DB spec permits this, and mmdbwriter can write such databases. GitHub #250.
• Decoding now rejects extended type bytes 0 and 250 through 255, which the MaxMind DB spec does not define. Before, they decoded as other types. For example, 0x00 0xfb decoded as a string.
• Reader.Verify() now rejects a data pointer that points into the middle of a field.
• Reader.Verify() now also checks the metadata section. Its pointers must point to the start of a field, and all data after the metadata map must be valid values.

2.6.0 - 2026-09-07

• Fixed a denial-of-service issue where a crafted database could use repeated pointers to cause excessive CPU and memory use during reflection decoding. The decoder now limits decoding work and decoded payload size.
• Made search-tree verification visit shared subtrees only once, bounding work while still rejecting cycles and overlong paths.
• Added the maxsize:N struct-tag option to limit maps, arrays, strings, and bytes in reflection and generated decoders, plus bounded cursor reads. Field names containing commas must now be single-quoted.
• Made generated decoders reject duplicate recognized map keys.
• Added mmdbdata.Cursor.Offset() to retrieve a value's resolved control-byte offset for caching within a database. It returns an error when resolution fails; the legacy Decoder.Offset() retains its original-offset fallback.
• Improved performance:
  • Reduced 28-bit search-tree lookup overhead with single-word node reads.
  • Extended bounded cursor string fast paths to wider data pointers.
  • Avoided repeated reflection dispatch for pointer-backed strings.
  • Inlined compact header reads when skipping values during budgeted decoding.
  • Avoided repeated type dispatch for unsigned integers decoded into any.
  • Cached validated struct-field matches to speed up repeated decoding.

Commits

• e228017 Set release date and set version in doc
• faf39ba Merge pull request #247 from oschwald/dependabot/go_modules/golang.org/x/tool...
• 8002482 Merge pull request #249 from database64128/v6-zone
• 737b5b3 Merge pull request #254 from oschwald/dependabot/github_actions/github/codeql...
• 5de4d13 Merge pull request #255 from oschwald/greg/stf-1863
• 1167020 Check metadata pointers and the values after the metadata map
• 6c3604e Reject data pointers that point into the middle of a field
• 7e05d3d Reject extended type bytes outside the spec
• 00b036c Accept search-tree records that point to nested fields
• 731ece0 Bump github/codeql-action from 4.37.9 to 4.38.2
• Additional commits viewable in compare view

[dependabot]

Superseded by #104.