CBOR is actively used in the WebAuthN spec (passkeys) so browsers ship with en implementation... And if you intend to support it even via a library you will be shipping an implementation as well.
Disclaimer: I wrote and maintain a MessagePack implementation.
Reading through this, it looks like they toss out indefinite length values, "canonicalization", and tags, making it essentially MP (MP does have extension types, I should say).
https://www.w3.org/TR/webauthn-2/#sctn-conforming-all-classe...