[dependabot]

Bumps the go-security-dependencies group with 1 update in the /reference directory: github.com/labstack/echo/v5.
Bumps the go-security-dependencies group with 1 update in the / directory: github.com/labstack/echo/v5.

Updates github.com/labstack/echo/v5 from 5.4.0 to 5.4.1

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.1

Security fixes

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

Behavior to review when upgrading

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

Other changes

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @​rm-Umar, @​Duodum, @​irisitymichaelgrundberg, @​Hama1cco, @​jakezwang, @​Shubham-Padkonde and @​rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: labstack/echo@v5.4.0...v5.4.1

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

Changelog

Commits

• a6a9673 chore: prepare v5.4.1 security release (#3185)
• 1855061 Merge commit from fork
• 8fd0e18 feat(context): add ValidateCtx (#3152)
• 3882266 docs: move support terms to .github/SUPPORT.md (#3165)
• 1836fed docs: refresh README badges (#3164)
• f098cb2 docs: add Support sponsorship terms (#3163)
• 199f7d8 docs: add Used by section, ADOPTERS.md and tidy README (#3161)
• 2968240 fix(router): removing a route with a custom method panics (#3160)
• 4f7bea5 fix(router): grow PathValues for contexts created before a route with more pa...
• 40c22f4 docs(group): explain how group catch-all NotFound routes replace RouteNotFoun...
• Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.0 to 5.4.1

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.1

Security fixes

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

Behavior to review when upgrading

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

Other changes

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @​rm-Umar, @​Duodum, @​irisitymichaelgrundberg, @​Hama1cco, @​jakezwang, @​Shubham-Padkonde and @​rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: labstack/echo@v5.4.0...v5.4.1

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

Changelog

Commits

• a6a9673 chore: prepare v5.4.1 security release (#3185)
• 1855061 Merge commit from fork
• 8fd0e18 feat(context): add ValidateCtx (#3152)
• 3882266 docs: move support terms to .github/SUPPORT.md (#3165)
• 1836fed docs: refresh README badges (#3164)
• f098cb2 docs: add Support sponsorship terms (#3163)
• 199f7d8 docs: add Used by section, ADOPTERS.md and tidy README (#3161)
• 2968240 fix(router): removing a route with a custom method panics (#3160)
• 4f7bea5 fix(router): grow PathValues for contexts created before a route with more pa...
• 40c22f4 docs(group): explain how group catch-all NotFound routes replace RouteNotFoun...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.