Skip to content

chore(deps): Bump the dependencies group with 2 updates - #336

Merged
ainsleyclark merged 1 commit into
mainfrom
dependabot/go_modules/dependencies-823aabc68a
Oct 26, 2026
Merged

chore(deps): Bump the dependencies group with 2 updates#336
ainsleyclark merged 1 commit into
mainfrom
dependabot/go_modules/dependencies-823aabc68a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 2 updates: github.com/getkin/kin-openapi and github.com/labstack/echo/v4.

Updates github.com/getkin/kin-openapi from 0.149.0 to 0.152.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.152.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.151.0...v0.152.0

v0.151.0

What's Changed

... (truncated)

Commits
  • 2420538 changelog: fixup rebased messes (#1372)
  • 52aade8 openapi3: test $ref siblings with the cases of #1271
  • 98fd8d4 openapi3: internalize, version and locate the keywords next to a schema $ref
  • c59eda0 openapi3: merge the fields next to a path item's $ref with the item it points to
  • 11caa38 openapi3: tell apart a $ref being resolved as different kinds of objects
  • cb14646 openapi3: marshal the fields written next to a $ref
  • 0375a5d openapi3: apply a 3.1 schema's $ref siblings alongside the referenced schema
  • 79ac3c4 openapi3: ignore the fields next to a Reference Object's $ref in every version
  • 35b08af openapi3filter: honor ExcludeRequestQueryParams for path item parameters (#1365)
  • 1b2754d openapi3filter: validate response headers described with content (#1358)
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.16.0 to 4.16.2

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.2

Fixes

  • Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
  • Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
  • Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

  • Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
  • Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
  • Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
  • Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
  • Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
  • Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

... (truncated)

Commits
  • 679c415 chore: prepare v4.16.2 release (#3191)
  • 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
  • 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
  • ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
  • 600b985 chore: prepare v4.16.1 security release (#3186)
  • 3fb0ba7 Merge commit from fork
  • be08005 fix(router): grow param values for contexts created before a route with more ...
  • 320fe67 fix(bind): honor OpenAPI date, date-time and date-time-local format tags (v4)...
  • f085ffb fix(router): handle escaped colons and inline verbs in v4 (#3132)
  • 5440f99 fix(middleware): prevent BodyLimit bypass in v4 (#3131)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the dependencies group with 2 updates
d764545 
Bumps the dependencies group with 2 updates: [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) and [github.com/labstack/echo/v4](https://github.com/labstack/echo).


Updates `github.com/getkin/kin-openapi` from 0.149.0 to 0.152.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.149.0...v0.152.0)

Updates `github.com/labstack/echo/v4` from 4.16.0 to 4.16.2
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.16.0...v4.16.2)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.152.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
website Ready Ready Preview Oct 26, 2026 5:14pm UTC
2 Skipped Deployments
Project Deployment Actions Updated
ainsleyclark.com Ignored Ignored Preview Oct 26, 2026 5:14pm UTC
ainsleydev Ignored Ignored Preview Oct 26, 2026 5:14pm UTC

Request Review

@dependabot dependabot Bot added the go Pull requests that update Go code label Oct 26, 2026
@ainsleyclark
ainsleyclark merged commit 0db3e0d into main Oct 26, 2026
9 checks passed
@ainsleyclark
ainsleyclark deleted the dependabot/go_modules/dependencies-823aabc68a branch October 26, 2026 18:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ainsleyclark