Update non-major

[1bsv-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@types/node (source)	24.19.1 → 24.19.2			devDependencies	patch
github.com/fxamacker/cbor/v2	v2.9.4 → v2.9.6			require	patch
github.com/lightwebinc/bcommon	v0.21.0 → v0.23.0			require	minor	v0.24.0
github/codeql-action	v4.38.2 → v4.38.3			action	patch

---

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.9.6

Compare Source

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

Not affected:

• Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.
• Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.
• Decoding CBOR maps into structs (struct fields of map type follow the bullet above).
• Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #​855 for details.

⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #​827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

• Skip CBOR data item when destination struct has incorrect tags by @​fxamacker in #​821
• Fix decoding CBOR null/undefined to interface value by @​fxamacker in #​827
• Fix decoding to unaddressable value in interface by @​fxamacker in #​828
• Improve the DefaultByteStringType check by @​fxamacker in #​829
• Fix decoding to self-referencing types by @​fxamacker in #​831
• Fix decoding 55799(null) to pointer or interface by @​fxamacker in #​851
• Fix stale Go map entry from CBOR null key/value by @​fxamacker in #​855

Encoding

• Fix encoding self-referencing types by @​fxamacker in #​833
• Fix panic encoding marshaler of unsupported underlying types by @​fxamacker in #​834
• Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @​fxamacker in #​835
• Fix encoding TimeUnixMicro outside 1677 to 2262 by @​fxamacker in #​837
  • Encoded output also changes for some times within one second of either end of that range.
• Reject encoding time.Time when Go formats wrong year by @​fxamacker in #​838

CI / GitHub Actions and Docs

• Improve docs related to encoding time.Time by @​fxamacker in #​854

Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6

v2.9.5

Compare Source

This version was tagged from the wrong branch by mistake and is retracted.

Use v2.9.6 (https://github.com/fxamacker/cbor/releases/tag/v2.9.6) instead.

lightwebinc/bcommon (github.com/lightwebinc/bcommon)

v0.23.0

Compare Source

Full Changelog: v0.22.0...v0.23.0

v0.22.0

Compare Source

Full Changelog: v0.21.0...v0.22.0

github/codeql-action (github/codeql-action)

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 PM and 11:59 PM, only on Tuesday and Friday (* 12-23 * * 2,5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.