[chore]: Bump github.com/gin-contrib/cors from 1.5.0 to 1.7.0 (#2745)

vendor/github.com/ugorji/go/codec/cbor.go

@@ -123,6 +123,11 @@ type cborEncDriver struct {
 	encDriverNoopContainerWriter
 	h *CborHandle
 
+	// scratch buffer for: encode time, numbers, etc
+	//
+	// RFC3339Nano uses 35 chars: 2006-01-02T15:04:05.999999999Z07:00
+	b [40]byte
+
 	e Encoder
 }
 
@@ -204,7 +209,7 @@ func (e *cborEncDriver) EncodeTime(t time.Time) {
 		e.EncodeNil()
 	} else if e.h.TimeRFC3339 {
 		e.encUint(0, cborBaseTag)
-		e.encStringBytesS(cborBaseString, t.Format(time.RFC3339Nano))
+		e.encStringBytesS(cborBaseString, stringView(fmtTime(t, time.RFC3339Nano, e.b[:0])))
 	} else {
 		e.encUint(1, cborBaseTag)
 		t = t.UTC().Round(time.Microsecond)
@@ -427,12 +432,13 @@ func (d *cborDecDriver) decLen() int {
 	return int(d.decUint())
 }
 
-func (d *cborDecDriver) decAppendIndefiniteBytes(bs []byte) []byte {
+func (d *cborDecDriver) decAppendIndefiniteBytes(bs []byte, major byte) []byte {
 	d.bdRead = false
 	for !d.CheckBreak() {
-		if major := d.bd >> 5; major != cborMajorBytes && major != cborMajorString {
-			d.d.errorf("invalid indefinite string/bytes %x (%s); got major %v, expected %v or %v",
-				d.bd, cbordesc(d.bd), major, cborMajorBytes, cborMajorString)
+		chunkMajor := d.bd >> 5
+		if chunkMajor != major {
+			d.d.errorf("malformed indefinite string/bytes %x (%s); contains chunk with major type %v, expected %v",
+				d.bd, cbordesc(d.bd), chunkMajor, major)
 		}
 		n := uint(d.decLen())
 		oldLen := uint(len(bs))
@@ -445,6 +451,9 @@ func (d *cborDecDriver) decAppendIndefiniteBytes(bs []byte) []byte {
 			bs = bs[:newLen]
 		}
 		d.d.decRd.readb(bs[oldLen:newLen])
+		if d.h.ValidateUnicode && major == cborMajorString && !utf8.Valid(bs[oldLen:newLen]) {
+			d.d.errorf("indefinite-length text string contains chunk that is not a valid utf-8 sequence: 0x%x", bs[oldLen:newLen])
+		}
 		d.bdRead = false
 	}
 	d.bdRead = false
@@ -580,9 +589,9 @@ func (d *cborDecDriver) DecodeBytes(bs []byte) (bsOut []byte) {
 		d.bdRead = false
 		if bs == nil {
 			d.d.decByteState = decByteStateReuseBuf
-			return d.decAppendIndefiniteBytes(d.d.b[:0])
+			return d.decAppendIndefiniteBytes(d.d.b[:0], d.bd>>5)
 		}
-		return d.decAppendIndefiniteBytes(bs[:0])
+		return d.decAppendIndefiniteBytes(bs[:0], d.bd>>5)
 	}
 	if d.bd == cborBdIndefiniteArray {
 		d.bdRead = false

vendor/github.com/ugorji/go/codec/decode.go

@@ -1399,6 +1399,10 @@ func NewDecoderString(s string, h Handle) *Decoder {
 	return NewDecoderBytes(bytesView(s), h)
 }
 
+func (d *Decoder) HandleName() string {
+	return d.hh.Name()
+}
+
 func (d *Decoder) r() *decRd {
 	return &d.decRd
 }
@@ -1580,14 +1584,9 @@ func (d *Decoder) MustDecode(v interface{}) {
 	d.calls--
 }
 
-// Release releases shared (pooled) resources.
+// Release is a no-op.
 //
-// It is important to call Release() when done with a Decoder, so those resources
-// are released instantly for use by subsequently created Decoders.
-//
-// By default, Release() is automatically called unless the option ExplicitRelease is set.
-//
-// Deprecated: Release is a no-op as pooled resources are not used with an Decoder.
+// Deprecated: Pooled resources are not used with a Decoder.
 // This method is kept for compatibility reasons only.
 func (d *Decoder) Release() {
 }

vendor/github.com/ugorji/go/codec/encode.go

@@ -984,6 +984,10 @@ func NewEncoderBytes(out *[]byte, h Handle) *Encoder {
 	return e
 }
 
+func (e *Encoder) HandleName() string {
+	return e.hh.Name()
+}
+
 func (e *Encoder) init(h Handle) {
 	initHandle(h)
 	e.err = errEncoderNotInitialized
@@ -1150,12 +1154,9 @@ func (e *Encoder) MustEncode(v interface{}) {
 	}
 }
 
-// Release releases shared (pooled) resources.
+// Release is a no-op.
 //
-// It is important to call Release() when done with an Encoder, so those resources
-// are released instantly for use by subsequently created Encoders.
-//
-// Deprecated: Release is a no-op as pooled resources are not used with an Encoder.
+// Deprecated: Pooled resources are not used with an Encoder.
 // This method is kept for compatibility reasons only.
 func (e *Encoder) Release() {
 }

vendor/github.com/ugorji/go/codec/gen.go

@@ -8,7 +8,7 @@ package codec
 
 import (
 	"bytes"
-	"encoding/base64"
+	"encoding/base32"
 	"errors"
 	"fmt"
 	"go/format"
@@ -190,7 +190,11 @@ var (
 	errGenExpectArrayOrMap       = errors.New("unexpected type - expecting array/map/slice")
 	errGenUnexpectedTypeFastpath = errors.New("fast-path: unexpected type - requires map or slice")
 
-	genBase64enc  = base64.NewEncoding("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__")
+	// don't use base64, only 63 characters allowed in valid go identifiers
+	// ie ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
+	//
+	// don't use numbers, as a valid go identifer must start with a letter.
+	genTypenameEnc  = base32.NewEncoding("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef")
 	genQNameRegex = regexp.MustCompile(`[A-Za-z_.]+`)
 )
 
@@ -2303,8 +2307,6 @@ func genMethodNameT(t reflect.Type, tRef reflect.Type) (n string) {
 				}
 			} else {
 				// best way to get the package name inclusive
-				// return ptrPfx + strings.Replace(tstr, ".", "_", 1000)
-				// return ptrPfx + genBase64enc.EncodeToString([]byte(tstr))
 				if t.Name() != "" && genQNameRegex.MatchString(tstr) {
 					return ptrPfx + strings.Replace(tstr, ".", "_", 1000)
 				} else {
@@ -2315,12 +2317,12 @@ func genMethodNameT(t reflect.Type, tRef reflect.Type) (n string) {
 	}
 }
 
-// genCustomNameForType base64encodes the t.String() value in such a way
+// genCustomNameForType base32 encodes the t.String() value in such a way
 // that it can be used within a function name.
 func genCustomTypeName(tstr string) string {
-	len2 := genBase64enc.EncodedLen(len(tstr))
+	len2 := genTypenameEnc.EncodedLen(len(tstr))
 	bufx := make([]byte, len2)
-	genBase64enc.Encode(bufx, []byte(tstr))
+	genTypenameEnc.Encode(bufx, []byte(tstr))
 	for i := len2 - 1; i >= 0; i-- {
 		if bufx[i] == '=' {
 			len2--

vendor/github.com/ugorji/go/codec/helper.go

@@ -110,8 +110,7 @@ package codec
 //
 // ------------------------------------------
 // Bounds Checking
-//    - Allow bytesDecReader to incur "bounds check error", and
-//      recover that as an io.EOF.
+//    - Allow bytesDecReader to incur "bounds check error", and recover that as an io error.
 //      This allows the bounds check branch to always be taken by the branch predictor,
 //      giving better performance (in theory), while ensuring that the code is shorter.
 //
@@ -857,26 +856,10 @@ type BasicHandle struct {
 	// Once a Handle has been initialized (used), do not modify this option. It will be ignored.
 	TimeNotBuiltin bool
 
-	// ExplicitRelease configures whether Release() is implicitly called after an encode or
-	// decode call.
+	// ExplicitRelease is ignored and has no effect.
 	//
-	// If you will hold onto an Encoder or Decoder for re-use, by calling Reset(...)
-	// on it or calling (Must)Encode repeatedly into a given []byte or io.Writer,
-	// then you do not want it to be implicitly closed after each Encode/Decode call.
-	// Doing so will unnecessarily return resources to the shared pool, only for you to
-	// grab them right after again to do another Encode/Decode call.
-	//
-	// Instead, you configure ExplicitRelease=true, and you explicitly call Release() when
-	// you are truly done.
-	//
-	// As an alternative, you can explicitly set a finalizer - so its resources
-	// are returned to the shared pool before it is garbage-collected. Do it as below:
-	//    runtime.SetFinalizer(e, (*Encoder).Release)
-	//    runtime.SetFinalizer(d, (*Decoder).Release)
-	//
-	// Deprecated: This is not longer used as pools are only used for long-lived objects
-	// which are shared across goroutines.
-	// Setting this value has no effect. It is maintained for backward compatibility.
+	// Deprecated: Pools are only used for long-lived objects shared across goroutines.
+	// It is maintained for backward compatibility.
 	ExplicitRelease bool
 
 	// ---- cache line
@@ -2489,7 +2472,7 @@ func panicValToErr(h errDecorator, v interface{}, err *error) {
 	case runtime.Error:
 		d, dok := h.(*Decoder)
 		if dok && d.bytes && isSliceBoundsError(xerr.Error()) {
-			*err = io.EOF
+			*err = io.ErrUnexpectedEOF
 		} else {
 			h.wrapErr(xerr, err)
 		}
@@ -2803,7 +2786,7 @@ func freelistCapacity(length int) (capacity int) {
 // bytesFreelist is a list of byte buffers, sorted by cap.
 //
 // In anecdotal testing (running go test -tsd 1..6), we couldn't get
-// the length ofthe list > 4 at any time. So we believe a linear search
+// the length of the list > 4 at any time. So we believe a linear search
 // without bounds checking is sufficient.
 //
 // Typical usage model:
@@ -2821,7 +2804,7 @@ func freelistCapacity(length int) (capacity int) {
 //	v1 := v0
 //	... use v1 ...
 //	blist.put(v1)
-//	if byteSliceAddr(v0) != byteSliceAddr(v1) {
+//	if !byteSliceSameData(v0, v1) {
 //	  blist.put(v0)
 //	}
 type bytesFreelist [][]byte

vendor/github.com/ugorji/go/codec/json.go

@@ -1301,6 +1301,9 @@ func (d *jsonDecDriver) DecodeNaked() {
 // Note also that the float values for NaN, +Inf or -Inf are encoded as null,
 // as suggested by NOTE 4 of the ECMA-262 ECMAScript Language Specification 5.1 edition.
 // see http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-262.pdf .
+//
+// Note the following behaviour differences vs std-library encoding/json package:
+//   - struct field names matched in case-sensitive manner
 type JsonHandle struct {
 	textEncodingType
 	BasicHandle

vendor/github.com/ugorji/go/codec/msgpack.go

@@ -1174,7 +1174,7 @@ func (c *msgpackSpecRpcCodec) ReadRequestBody(body interface{}) error {
 
 func (c *msgpackSpecRpcCodec) parseCustomHeader(expectTypeByte byte, msgid *uint64, methodOrError *string) (err error) {
 	if cls := c.cls.load(); cls.closed {
-		return io.EOF
+		return io.ErrUnexpectedEOF
 	}
 
 	// We read the response header by hand

vendor/github.com/ugorji/go/codec/reader.go

@@ -350,9 +350,9 @@ func (z *ioDecReader) unreadn1() {
 
 // bytesDecReader is a decReader that reads off a byte slice with zero copying
 //
-// Note: we do not try to convert index'ing out of bounds to an io.EOF.
+// Note: we do not try to convert index'ing out of bounds to an io error.
 // instead, we let it bubble up to the exported Encode/Decode method
-// and recover it as an io.EOF.
+// and recover it as an io error.
 //
 // Every function here MUST defensively check bounds either explicitly
 // or via a bounds check.