Changelog

Template:

Next

0.14.0 (2026-04-07)

  • [Fix NULL dereference in cbor_move, cbor_serialized_size, and cbor_serialize_tag when a tag has no item set](https://github.com/PJK/libcbor/pull/420) (reported by [Benjamin608608](https://github.com/Benjamin608608))

  • [Document large-allocation risk in cbor_load and clarify test-only CMake flags](https://github.com/PJK/libcbor/pull/422)

  • [Fix NULL dereference in cbor_copy/cbor_copy_definite on allocation failure](https://github.com/PJK/libcbor/pull/419) (reported by [Benjamin608608](https://github.com/Benjamin608608))

  • [Explicitly guard against size * 2 overflow in cbor_builder_map_start_callback](https://github.com/PJK/libcbor/pull/421) (reported by [Benjamin608608](https://github.com/Benjamin608608))

  • [Only generate CMake coverage build targets when explicitly enabled](https://github.com/PJK/libcbor/issues/383)

  • [Fix CMake feature macro names and ensure _CBOR_NODISCARD is defined with [[nodiscard]]](https://github.com/PJK/libcbor/pull/385)

  • [Fix integer overflow in cbor_copy_definite() when accumulating indefinite bytestring/string chunk lengths](https://github.com/PJK/libcbor/pull/387)

  • [Add bounds check in cbor_array_get() to return NULL on out-of-bounds access](https://github.com/PJK/libcbor/pull/388)

  • BREAKING: [cbor_tag_set_item now releases the reference to the previous tagged item](https://github.com/PJK/libcbor/pull/391) - Previously, replacing the tagged item would leak the old item’s reference. If you were manually releasing the old item before calling cbor_tag_set_item, you should remove the extra cbor_decref.

  • Potentially BREAKING: [cbor_tag_item now returns NULL if the tag has no item set](https://github.com/PJK/libcbor/pull/392) - Previously, this would be undefined behavior (NULL pointer dereference), so no valid clients should be affected.

  • Potentially BUILD BREAKING: [CPack Debian package architecture is now detected via dpkg instead of being hardcoded to amd64](https://github.com/PJK/libcbor/pull/394)

  • BUILD BREAKING: [Remove deprecated CBOR_CUSTOM_ALLOC CMake option](https://github.com/PJK/libcbor/pull/402) - The option has been a no-op since 0.10.0. If your build passes -DCBOR_CUSTOM_ALLOC=ON, remove it.

  • [Modernize CMake build: use project(VERSION …), replace add_definitions() with target-scoped target_compile_definitions(), remove redundant include_directories()](https://github.com/PJK/libcbor/pull/402)

  • [Replace global CMAKE_C_FLAGS mutations with target-scoped target_compile_options() via an INTERFACE library, and simplify LTO configuration](https://github.com/PJK/libcbor/pull/403)

  • [Fix Windows CI: propagate _CRT_SECURE_NO_WARNINGS to examples/tests, restrict LTO to Release builds, parallelize Windows CI build](https://github.com/PJK/libcbor/pull/404)

  • [Add cbor_map_get for key-based map lookup with a caller-supplied equality function](https://github.com/PJK/libcbor/pull/409) - Signature: cbor_map_get(map, key, eq) — pass any equality predicate, e.g. cbor_structurally_equal - Parameterised equality allows type-specific comparators or custom data-model semantics without library changes - See also: #96

  • [Add cbor_structurally_equal for encoding-level item comparison](https://github.com/PJK/libcbor/pull/408) - Compares two items structurally: encoding width, definite-vs-indefinite length, chunk boundaries, and map entry order all count - Runs in O(n) time in the encoded byte size with no additional allocations - See also: #96

  • BREAKING: [Fix NaN encoding in cbor_encode_half to preserve sign and payload bits](https://github.com/PJK/libcbor/pull/412) - Previously, all NaN values were encoded as 0x7E00 (positive quiet NaN, zero payload). Now the sign bit and the top 10 mantissa bits are preserved in the half-precision encoding. - _cbor_decode_half now reconstructs the NaN bit pattern faithfully, enabling encode/decode round-trips. Previously it always returned the C NAN constant. - Very small normal floats that previously rounded to +0 now round to ±0 depending on their sign. - Clients that relied on all NaNs normalising to 0x7E00 will see different output. See #215.

0.13.0 (2025-08-30)

0.12.0 (2025-03-16)

0.11.0 (2024-02-04)

0.10.2 (2023-01-31)

0.10.1 (2022-12-30)

0.10.0 (2022-12-29)

0.9.0 (2021-11-14)

0.8.0 (2020-09-20)

0.7.0 (2020-04-25)

0.6.1 (2020-03-26)

  • [Fix bad shared library version number](https://github.com/PJK/libcbor/pull/131) - Warning: Shared library built from the 0.6.0 release is erroneously marked as version “0.6.0”, which makes it incompatible with future releases including the v0.6.X line even though they may be compatible API/ABI-wise. Refer to the documentation for the new SO versioning scheme.

0.6.0 (2020-03-15)

0.5.0 (2017-02-06)

0.4.0 (2015-12-25)

Breaks build & header compatibility due to:

  • Improved build configuration and feature check macros

  • Endianness configuration fixes (by Erwin Kroon and David Grigsby)

  • pkg-config compatibility (by Vincent Bernat)

  • enable use of versioned SONAME (by Vincent Bernat)

  • better fuzzer (wasn’t random until now, ooops)

0.3.1 (2015-05-21)

  • documentation and comments improvements, mostly for the API reference

0.3.0 (2015-05-21)

  • Fixes, polishing, niceties across the code base

  • Updated examples

  • cbor_copy

  • cbor_build_negint8, 16, 32, 64, matching asserts

  • cbor_build_stringn

  • cbor_build_tag

  • cbor_build_float2, …

0.2.1 (2015-05-17)

  • C99 support

0.2.0 (2015-05-17)

  • cbor_ctrl_bool -> cbor_ctrl_is_bool

  • Added cbor_array_allocated & map equivalent

  • Overhauled endianess conversion - ARM now works as expected

  • ‘sort.c’ example added

  • Significantly improved and doxyfied documentation

0.1.0 (2015-05-06)

The initial release, yay!