Skip to content

chore(deps): bump the go-dependencies group across 2 directories with 5 updates - #485

Merged
vishr merged 1 commit into
masterfrom
dependabot/go_modules/go-dependencies-52893e0061
Nov 5, 2026
Merged

chore(deps): bump the go-dependencies group across 2 directories with 5 updates#485
vishr merged 1 commit into
masterfrom
dependabot/go_modules/go-dependencies-52893e0061

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 5 updates in the / directory:

Package From To
github.com/labstack/echo/v5 5.4.2 5.4.4
github.com/lestrrat-go/jwx/v3 3.3.0 3.4.0
github.com/prometheus/client_golang 1.24.1 1.25.0
golang.org/x/crypto 0.57.0 0.58.0
golang.org/x/net 0.59.0 0.60.0
github.com/labstack/echo/v5 5.4.2 5.4.4

Bumps the go-dependencies group with 1 update in the /reference directory: github.com/labstack/echo/v5.

Updates github.com/labstack/echo/v5 from 5.4.2 to 5.4.4

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.4

Proxy identity hardening

The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs.

The same captured identity is preserved across retries and balancer request replacement, and the protection applies to WebSocket upgrades. Default and custom transports and extractors remain supported.

Released v5.4.3 can omit the identity header for those requests. Identity spoofing additionally depends on an upstream that falls back to an untrusted source when the header is absent. This release does not change v5’s direct-peer default or the affected ranges of the earlier default-IP CVEs.

No new client-IP migration is required for v5. Applications behind proxies should continue using an extractor that trusts their own proxies. No public API, dependency, or minimum Go-version changes.

Validation

The implementation passed fresh independent Claude review, full race tests on Go 1.25 and 1.27, vet, staticcheck, golint, and govulncheck. Permanent tests cover HTTP/default/custom transports, raw WebSocket negotiation, duplicate/mixed-case header nominations, and a stateful extractor across request-swapping retries.

Implementation: #3200. This ports the additional proxy identity protection released in v4.16.3.

Full Changelog: labstack/echo@v5.4.3...v5.4.4

v5.4.3

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

  • Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
  • Correct UseEscapedPathForMatching documentation without changing its behavior.
  • Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

  • Publish v4 support dates and the Echo Support offer (#3193).
  • Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

v5.4.4 - 2026-10-29

Proxy identity hardening

  • Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
  • Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
  • Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

v5.4.0 - 2026-09-27

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

  • Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
  • Proxy middleware: always sets X-Real-IP from Context.RealIP(), so a client can no longer pass a spoofed X-Real-IP to the upstream. GHSA-99jh-6h7p-pp36
  • JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
  • MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
  • Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
  • Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr

Behavior changes to check before upgrading

  • Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges: 
    _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
_, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
    Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
  • Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
  • Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
  • Proxy middleware headers. X-Real-IP sent to the upstream is now always Context.RealIP(). In a chain like nginx → Echo Proxy → upstream, configure Echo#IPExtractor (for example echo.ExtractIPFromRealIPHeader()) to pass the client address on. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded; X-Forwarded-Proto carries the scheme.
  • MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
  • Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v5.2.1. With StaticConfig.EnablePathUnescaping or Config.EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
  • JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

  • IPExtractor docs: corrected the description of the default (the direct peer address has been used since v5.1.0).
  • Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

v5.3.1 - 2026-07-21

Fixes

... (truncated)

Commits
  • a45c7bb chore: prepare v5.4.4 proxy hardening release (#3201)
  • b118d3d fix: preserve v5 proxy client identity after hop header stripping (#3200)
  • 9489424 docs: record v4 client IP security release and migration (#3199)
  • 6e06e88 chore: prepare v5.4.3 release (#3196)
  • 078efa6 Merge commit from fork
  • 4deac5d docs: publish v4 support dates and the Echo Support offer (#3193)
  • 9adc7a8 docs: mention Echo Pro in the Sponsors section (#3192)
  • See full diff in compare view

Updates github.com/lestrrat-go/jwx/v3 from 3.3.0 to 3.4.0

Release notes

Sourced from github.com/lestrrat-go/jwx/v3's releases.

v3.4.0

For more detailed release notes, see Changes.

What's Changed

Full Changelog: lestrrat-go/jwx@v3.3.0...v3.4.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v3's changelog.

v3.4.0 23 Oct 2026

  • [jwe] jwe.Decrypt now tries each key provider in turn and moves on to the next one when a provider returns an error, as jws.Verify does. For example, jwe.WithKeySet with a set that has no usable key, followed by a working jwe.WithKey, decrypts with the working key. If no key works, the returned error wraps the last failure, so errors.Is can find it. (#2385)

  • [jwe] JSON serialization of a JWE now always includes the ciphertext member, jwe.Parse now accepts an empty ciphertext, and jwe.Decrypt now returns an empty payload for it. A JWE that encrypts an empty plaintext with AES-GCM therefore round-trips through jwe.Encrypt(..., jwe.WithJSON()), jwe.Parse, json.Marshal, and jwe.Decrypt. A missing, null, or non-string ciphertext is still rejected, and the iv and tag members must still be non-empty. (#2387)

  • [jwe] jwe.Decrypt now rejects a message whose tag or iv is not exactly the length the content encryption algorithm uses. Bytes can no longer be moved between ciphertext and tag to produce a different message that still decrypts. (#2387)

  • [jwe] JSON serialization of a JWE now writes the shared unprotected header as a JSON object, as RFC 7516 requires. A JWE with a shared unprotected header therefore round-trips through jwe.Parse, json.Marshal, jwe.Parse, and jwe.Decrypt. (#2389)

  • [jwt] jwt.WithNumericDateFormatPrecision now applies when a token is serialized. It covers the exp, iat, and nbf claims of jwt.Token, and those claims plus updated_at in openid.Token. Previously the option never had any effect on serialized tokens, which always wrote these claims as whole seconds.

    With a precision above 0, a date that has a fraction is written as a JSON number with up to that many fractional digits. Extra digits are rounded down, toward the earlier time, and trailing zeros are removed. At precision 3, an iat of 2000000000.123456789 is written as 2000000000.123, and 2000000000.1 as 2000000000.1. A date with no fraction is written as an integer, and output at the default precision of 0 is unchanged. Callers who set a precision above 0 will see fractional dates in their tokens, in the bytes jwt.Sign signs, and in what jwt.Equal compares. (#2410)

  • [jwt] NumericDate claims such as exp, iat, and nbf now parse negative values, which are dates before 1970, with or without jwt.WithNumericDateParsePedantic(true). The sign covers the fraction too, so -1.5 is one and a half seconds before the epoch. Fractional digits beyond jwt.WithNumericDateParsePrecision are rounded down, toward the earlier time, the same way serialization rounds: at the default precision of 0, -1.5 parses as -2. Positive values parse as before.

... (truncated)

Commits
  • 86f71b2 Merge pull request #2449 from lestrrat-go/chore-v3-release-3.4.0
  • c22fdc8 release v3.4.0
  • eff2810 jws: fix signature index comment in header example (#2447)
  • 4aa8e99 Merge pull request #2441 from lestrrat-go/docs-v3-jwe-per-recipient-headers
  • 0b44bc9 Merge pull request #2437 from lestrrat-go/docs-v3-jws-crit-extension
  • ac1ed67 merge develop/v3
  • 33bd92f Merge pull request #2440 from lestrrat-go/feat-v3-jwe-decrypted-recipient
  • a99856c merge develop/v3
  • 9853f21 merge develop/v3
  • 102b593 Merge pull request #2436 from lestrrat-go/feat-v3-jws-verified-signature
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits
  • 8fdf07b go.mod: update golang.org/x dependencies
  • 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
  • c3db4df acme: prefer test log helpers in test contexts
  • 4e01a84 acme: adds support for profiles draft
  • 8f0f111 ssh: check that no Unicode-aware string function is used
  • b39ff6d ssh: add certificate algorithms for ML-DSA keys
  • 4465db3 ssh: add the ML-DSA public key algorithms
  • 83e695b ssh: implement ETM mode for CBC ciphers
  • 946083a ssh: only drop a trailing carriage return
  • 543dde9 ssh: accept known_hosts entries with a multi-word comment
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.59.0 to 0.60.0

Commits
  • 18ece0c http2: prevent crash due to HPACK encoder race
  • 2d03f9d http2: avoid 2x refund on stream close with buffered data
  • cc7d34f http2: avoid excessive work on initial window changes
  • 57f4235 http2: apply header limits to Trailer headers too
  • 01e3d03 http2: coalesce dials via wrapped Transport.RoundTrip
  • 2824783 http2: delete malformed framing-related headers
  • b13c0c1 internal/http3: delete HTTP/3 package
  • 520c891 quic: off-path support in loss/congestion/rtt
  • 656874f quic: determine local address for connections
  • a818e16 quic: add a pathAddrs type, holding a local/peer address pair
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.2 to 5.4.4

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.4

Proxy identity hardening

The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs.

The same captured identity is preserved across retries and balancer request replacement, and the protection applies to WebSocket upgrades. Default and custom transports and extractors remain supported.

Released v5.4.3 can omit the identity header for those requests. Identity spoofing additionally depends on an upstream that falls back to an untrusted source when the header is absent. This release does not change v5’s direct-peer default or the affected ranges of the earlier default-IP CVEs.

No new client-IP migration is required for v5. Applications behind proxies should continue using an extractor that trusts their own proxies. No public API, dependency, or minimum Go-version changes.

Validation

The implementation passed fresh independent Claude review, full race tests on Go 1.25 and 1.27, vet, staticcheck, golint, and govulncheck. Permanent tests cover HTTP/default/custom transports, raw WebSocket negotiation, duplicate/mixed-case header nominations, and a stateful extractor across request-swapping retries.

Implementation: #3200. This ports the additional proxy identity protection released in v4.16.3.

Full Changelog: labstack/echo@v5.4.3...v5.4.4

v5.4.3

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

  • Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
  • Correct UseEscapedPathForMatching documentation without changing its behavior.
  • Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

  • Publish v4 support dates and the Echo Support offer (#3193).
  • Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

v5.4.4 - 2026-10-29

Proxy identity hardening

  • Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
  • Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
  • Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

v5.4.0 - 2026-09-27

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

  • Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
  • Proxy middleware: always sets X-Real-IP from Context.RealIP(), so a client can no longer pass a spoofed X-Real-IP to the upstream. GHSA-99jh-6h7p-pp36
  • JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
  • MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
  • Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
  • Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr

Behavior changes to check before upgrading

  • Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges: 
    _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
_, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
    Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
  • Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
  • Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
  • Proxy middleware headers. X-Real-IP sent to the upstream is now always Context.RealIP(). In a chain like nginx → Echo Proxy → upstream, configure Echo#IPExtractor (for example echo.ExtractIPFromRealIPHeader()) to pass the client address on. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded; X-Forwarded-Proto carries the scheme.
  • MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
  • Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v5.2.1. With StaticConfig.EnablePathUnescaping or Config.EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
  • JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

  • IPExtractor docs: corrected the description of the default (the direct peer address has been used since v5.1.0).
  • Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

v5.3.1 - 2026-07-21

Fixes

... (truncated)

Commits
  • a45c7bb chore: prepare v5.4.4 proxy hardening release (#3201)
  • b118d3d fix: preserve v5 proxy client identity after hop header stripping (#3200)
  • 9489424 docs: record v4 client IP security release and migration (#3199)
  • 6e06e88 chore: prepare v5.4.3 release (#3196)
  • 078efa6 Merge commit from fork
  • 4deac5d docs: publish v4 support dates and the Echo Support offer (#3193)
  • 9adc7a8 docs: mention Echo Pro in the Sponsors section (#3192)
  • See full diff in

@dependabot
chore(deps): bump the go-dependencies group across 2 directories with…
dedbfad 
… 5 updates

Bumps the go-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/labstack/echo/v5](https://github.com/labstack/echo) | `5.4.2` | `5.4.4` |
| [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `3.3.0` | `3.4.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.60.0` |
| [github.com/labstack/echo/v5](https://github.com/labstack/echo) | `5.4.2` | `5.4.4` |

Bumps the go-dependencies group with 1 update in the /reference directory: [github.com/labstack/echo/v5](https://github.com/labstack/echo).


Updates `github.com/labstack/echo/v5` from 5.4.2 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.2...v5.4.4)

Updates `github.com/lestrrat-go/jwx/v3` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/v3.4.0/Changes)
- [Commits](lestrrat-go/jwx@v3.3.0...v3.4.0)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.59.0 to 0.60.0
- [Commits](golang/net@v0.59.0...v0.60.0)

Updates `github.com/labstack/echo/v5` from 5.4.2 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.2...v5.4.4)

Updates `github.com/labstack/echo/v5` from 5.4.2 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.2...v5.4.4)

Updates `github.com/labstack/echo/v5` from 5.4.2 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.2...v5.4.4)

---
updated-dependencies:
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/lestrrat-go/jwx/v3
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 2, 2026
@vishr
vishr merged commit fd44efd into master Nov 5, 2026
1 check passed
@vishr
vishr deleted the dependabot/go_modules/go-dependencies-52893e0061 branch November 5, 2026 04:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vishr