Bump github.com/oschwald/maxminddb-golang/v2 from 2.5.0 to 2.6.0

[dependabot]

Bumps github.com/oschwald/maxminddb-golang/v2 from 2.5.0 to 2.6.0.

Release notes

Sourced from github.com/oschwald/maxminddb-golang/v2's releases.

2.6.0

• Fixed a denial-of-service issue where a crafted database could use repeated pointers to cause excessive CPU and memory use during reflection decoding. The decoder now limits decoding work and decoded payload size.
• Made search-tree verification visit shared subtrees only once, bounding work while still rejecting cycles and overlong paths.
• Added the maxsize:N struct-tag option to limit maps, arrays, strings, and bytes in reflection and generated decoders, plus bounded cursor reads. Field names containing commas must now be single-quoted.
• Made generated decoders reject duplicate recognized map keys.
• Added mmdbdata.Cursor.Offset() to retrieve a value's resolved control-byte offset for caching within a database. It returns an error when resolution fails; the legacy Decoder.Offset() retains its original-offset fallback.
• Improved performance:
  • Reduced 28-bit search-tree lookup overhead with single-word node reads.
  • Extended bounded cursor string fast paths to wider data pointers.
  • Avoided repeated reflection dispatch for pointer-backed strings.
  • Inlined compact header reads when skipping values during budgeted decoding.
  • Avoided repeated type dispatch for unsigned integers decoded into any.
  • Cached validated struct-field matches to speed up repeated decoding.

Changelog

Sourced from github.com/oschwald/maxminddb-golang/v2's changelog.

2.6.0 - 2026-09-07

• Fixed a denial-of-service issue where a crafted database could use repeated pointers to cause excessive CPU and memory use during reflection decoding. The decoder now limits decoding work and decoded payload size.
• Made search-tree verification visit shared subtrees only once, bounding work while still rejecting cycles and overlong paths.
• Added the maxsize:N struct-tag option to limit maps, arrays, strings, and bytes in reflection and generated decoders, plus bounded cursor reads. Field names containing commas must now be single-quoted.
• Made generated decoders reject duplicate recognized map keys.
• Added mmdbdata.Cursor.Offset() to retrieve a value's resolved control-byte offset for caching within a database. It returns an error when resolution fails; the legacy Decoder.Offset() retains its original-offset fallback.
• Improved performance:
  • Reduced 28-bit search-tree lookup overhead with single-word node reads.
  • Extended bounded cursor string fast paths to wider data pointers.
  • Avoided repeated reflection dispatch for pointer-backed strings.
  • Inlined compact header reads when skipping values during budgeted decoding.
  • Avoided repeated type dispatch for unsigned integers decoded into any.
  • Cached validated struct-field matches to speed up repeated decoding.

Commits

• cd80b4a Update version in docs
• 647d571 Set release date
• 41e1090 Merge pull request #228 from oschwald/dependabot/go_modules/golang.org/x/tool...
• e06eb33 Bump golang.org/x/tools from 0.48.0 to 0.49.0
• 679a845 Merge pull request #231 from oschwald/dependabot/go_modules/github.com/stretc...
• 1c0e35c Merge pull request #234 from oschwald/dependabot/github_actions/github/codeql...
• 8bc1a80 Merge pull request #237 from oschwald/greg/cursor-offset
• 22d177a Separate expected pointees in maxsize mutation tests
• d50cadc Avoid shadowing types in generated duplicate-key tracking
• 485c7b8 Allow metadata pointers to follow the root map
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)