Bump github.com/oschwald/maxminddb-golang/v2 from 2.4.1 to 2.5.0

[dependabot]

Bumps github.com/oschwald/maxminddb-golang/v2 from 2.4.1 to 2.5.0.

Release notes

Sourced from github.com/oschwald/maxminddb-golang/v2's releases.

2.5.0

• Deprecated the legacy mmdbdata.Unmarshaler callback, UnmarshalMaxMindDB(*mmdbdata.Decoder) error. It remains supported throughout v2, but new handwritten decoders should implement mmdbdata.CursorUnmarshaler so nested decoding can return a proven successor without rescanning the value. When a type implements both interfaces, the cursor callback takes precedence. Removal is planned for v3. GitHub #224. Legacy callbacks must not retain the supplied decoder or its iterators after returning; decoder instances may now be pooled and reused.
• Added the optional maxminddb-gen command for reproducible generation of reflection-free decoders for application-owned types, together with cursor primitives that avoid rescanning completely consumed containers and a pool-free cursor unmarshaling interface whose opaque successor supports single-pass nested custom decoding. The command discovers exported structs in its input source file and writes a matching <source>_maxminddb.go file by default while preserving build constraints and recognized filename build suffixes. Generated struct decoders use lightweight counted map traversal and compact pointer-string fast paths. Output-path migrations ignore superseded generated methods while analyzing replacements, MaxMind tag validation remains isolated from unrelated tags, and output replacement requires an exact generated ownership marker.
• Fixed valid four-byte data pointers whose ignored high address bits produce control values 29 through 31 so they are not misread as extended value sizes.
• Fixed the string cache so overlapping string encodings that share a payload offset remain distinct and cannot return the wrong cached string or map key.
• Fixed nested struct fields containing a non-map value so decoding reports the correct type error at the field offset instead of retrying from the record root.
• Reduced IPv4 and IPv6 lookup time for databases with 28-bit search-tree records.
• Reduced allocations when recurring decoded strings share a primary cache slot.
• Reduced struct decoding time by using compact field-name fingerprints before falling back to full string hashing.
• Rejected impossible or malformed large container sizes before allocating destination maps and slices, while reducing preflight overhead for common strings and booleans and avoiding preflight when caller-provided slice capacity already prevents an allocation.
• Kept readers reachable through memory-mapped lookup, decode, and iteration operations so runtime cleanup cannot unmap active data.
• Reduced opening memory by decoding metadata without a string cache and added DisableStringCache for readers that favor lower memory over repeated-decode allocation savings.
• Released decoder-owned data and cache references when a reader is closed.
• Rejected invalid netip.Addr lookup values.
• Made verification reject invalid UTF-8 strings and made empty-value filtering reject pointer-to-pointer records consistently with other decoder paths.
• Corrected cold-cache and concurrent-lookup benchmarks so they measure steady cache misses and lookup work rather than warm caches and goroutine setup.

Changelog

Sourced from github.com/oschwald/maxminddb-golang/v2's changelog.

2.5.0 - 2026-08-08

• Deprecated the legacy mmdbdata.Unmarshaler callback, UnmarshalMaxMindDB(*mmdbdata.Decoder) error. It remains supported throughout v2, but new handwritten decoders should implement mmdbdata.CursorUnmarshaler so nested decoding can return a proven successor without rescanning the value. When a type implements both interfaces, the cursor callback takes precedence. Removal is planned for v3. GitHub #224. Legacy callbacks must not retain the supplied decoder or its iterators after returning; decoder instances may now be pooled and reused.
• Added the optional maxminddb-gen command for reproducible generation of reflection-free decoders for application-owned types, together with cursor primitives that avoid rescanning completely consumed containers and a pool-free cursor unmarshaling interface whose opaque successor supports single-pass nested custom decoding. The command discovers exported structs in its input source file and writes a matching <source>_maxminddb.go file by default while preserving build constraints and recognized filename build suffixes. Generated struct decoders use lightweight counted map traversal and compact pointer-string fast paths. Output-path migrations ignore superseded generated methods while analyzing replacements, MaxMind tag validation remains isolated from unrelated tags, and output replacement requires an exact generated ownership marker.
• Fixed valid four-byte data pointers whose ignored high address bits produce control values 29 through 31 so they are not misread as extended value sizes.
• Fixed the string cache so overlapping string encodings that share a payload offset remain distinct and cannot return the wrong cached string or map key.
• Fixed nested struct fields containing a non-map value so decoding reports the correct type error at the field offset instead of retrying from the record root.
• Reduced IPv4 and IPv6 lookup time for databases with 28-bit search-tree records.
• Reduced allocations when recurring decoded strings share a primary cache slot.
• Reduced struct decoding time by using compact field-name fingerprints before falling back to full string hashing.
• Rejected impossible or malformed large container sizes before allocating destination maps and slices, while reducing preflight overhead for common strings and booleans and avoiding preflight when caller-provided slice capacity already prevents an allocation.
• Kept readers reachable through memory-mapped lookup, decode, and iteration operations so runtime cleanup cannot unmap active data.
• Reduced opening memory by decoding metadata without a string cache and added DisableStringCache for readers that favor lower memory over repeated-decode allocation savings.
• Released decoder-owned data and cache references when a reader is closed.
• Rejected invalid netip.Addr lookup values.
• Made verification reject invalid UTF-8 strings and made empty-value filtering reject pointer-to-pointer records consistently with other decoder paths.
• Corrected cold-cache and concurrent-lookup benchmarks so they measure steady cache misses and lookup work rather than warm caches and goroutine setup.

Commits

• 6d08cba Merge pull request #221 from oschwald/greg/generator-improvement-plan-7
• 8b77c1a docs: clarify cursor unmarshaling behavior
• 57b8ec9 Deprecate legacy custom unmarshaling API
• 714bdbc Harden cursor container validation
• a52b8ac Add generated MaxMind DB decoders
• 91542f2 Merge pull request #220 from oschwald/greg/package-robustness-performance
• acf0eda Reduce struct field lookup hashing
• 830fb53 Reduce recurring string cache collisions
• c113048 Optimize 28-bit tree traversal
• 567cbf2 Correct cache and concurrency benchmarks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)