-
Notifications
You must be signed in to change notification settings - Fork 41
Update module github.com/labstack/echo/v4 to v4.15.0 #47
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/github.com-labstack-echo-v4-4.x
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
e693c9d to
3810fef
Compare
3810fef to
879a43d
Compare
879a43d to
0c23eb8
Compare
0c23eb8 to
b5d6bed
Compare
Contributor
Author
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
b5d6bed to
aa7d932
Compare
aa7d932 to
15238e8
Compare
15238e8 to
80ac719
Compare
80ac719 to
69b89a2
Compare
69b89a2 to
ae9abbc
Compare
ae9abbc to
a10b64f
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
a10b64f to
ebc9e13
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.2.0→v4.15.0Release Notes
labstack/echo (github.com/labstack/echo/v4)
v4.15.0Compare Source
Security
NB: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production
The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF
protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.
How it works:
Modern browsers automatically send the
Sec-Fetch-Siteheader with all requests, indicating the relationshipbetween the request origin and the target. The middleware uses this to make security decisions:
same-originornone: Requests are allowed (exact origin match or direct user navigation)same-site: Falls back to token validation (e.g., subdomain to main domain)cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)For browsers that don't send this header (older browsers), the middleware seamlessly falls back to
traditional token-based CSRF protection.
New Configuration Options:
TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validationExample:
PR: #2858
Type-Safe Generic Parameter Binding
Added generic functions for type-safe parameter extraction and context access by @aldas in #2856
Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion,
eliminating manual string parsing and type assertions.
New Functions:
PathParam[T],PathParamOr[T]QueryParam[T],QueryParamOr[T],QueryParams[T],QueryParamsOr[T]FormParam[T],FormParamOr[T],FormParams[T],FormParamsOr[T]ContextGet[T],ContextGetOr[T]Supported Types:
Primitives (
bool,string,int/uintvariants,float32/float64),time.Duration,time.Time(with custom layouts and Unix timestamp support), and custom types implementing
BindUnmarshaler,TextUnmarshaler, orJSONUnmarshaler.Example:
PR: #2856
DEPRECATION NOTICE Timeout Middleware Deprecated - Use ContextTimeout Instead
The
middleware.Timeoutmiddleware has been deprecated due to fundamental architectural issues that causedata races. Use
middleware.ContextTimeoutormiddleware.ContextTimeoutWithConfiginstead.Why is this being deprecated?
The Timeout middleware manipulates response writers across goroutine boundaries, which causes data races that
cannot be reliably fixed without a complete architectural redesign. The middleware:
http.TimeoutHandlerWhat should you use instead?
The
ContextTimeoutmiddleware (available since v4.12.0) provides timeout functionality using Go's standardcontext mechanism. It is:
Migration Guide:
Important Behavioral Differences:
Handler cooperation required: With ContextTimeout, your handlers must check
context.Done()for cooperativecancellation. The old Timeout middleware would send a 503 response regardless of handler cooperation, but had
data race issues.
Error handling: ContextTimeout returns errors through the standard error handling flow. Handlers that receive
context.DeadlineExceededshould handle it appropriately:Enhancements
v4.14.0Compare Source
middleware.Loggerhas been deprecated. For request logging, usemiddleware.RequestLoggerormiddleware.RequestLoggerWithConfig.middleware.RequestLoggerreplacesmiddleware.Logger, offering comparable configuration while relying on theGo standard library’s new
sloglogger.The previous default output format was JSON. The new default follows the standard
sloglogger settings.To continue emitting request logs in JSON, configure
slogaccordingly:Security
Enhancements
v4.13.4Compare Source
Enhancements
Security
v4.13.3Compare Source
Security
v4.13.2Compare Source
Security
v4.13.1Compare Source
Fixes
Transfer-Encoding: chunkedrequests by @178inaba in #2717v4.13.0Compare Source
BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead
The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.
Important: Direct assignments like
token := c.Get("user").(*jwt.Token)will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from"github.com/golang-jwt/jwt"in your handlers to the new middleware version using"github.com/golang-jwt/jwt/v5".Background:
The version of
golang-jwt/jwt(v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in PR #1946.JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.
We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.
Enhancements
MultipartFormtest by @martinyonatann in #2682bind: add support of multipart multi files by @martinyonatann in #2684html/templateandtext/templatepackages. by @aldas in #2690v4.12.0Compare Source
Security
Enhancements
UnmarshalParams(params []string) errorinter… by @aldas in #2607*[]stringby @aldas in #2608/. by @aldas in #2616v4.11.4Compare Source
Security
Enhancements
v4.11.3Compare Source
Security
Enhancements
v4.11.2Compare Source
Security
Enhancements
v4.11.1Compare Source
Fixes
Gzipmiddleware not sending response code for no content responses (404, 301/302 redirects etc) #2481v4.11.0Compare Source
Fixes
group.RouteNotFoundnot working when group has attached middlewares #2411Enhancements
strings.ReplaceAlldirectly #2424http.rwUnwrapperto Response struct #2425echo.Reversemethod #2416v4.10.2Compare Source
Security
filepath.Cleanbehaviour has changed in Go 1.20 - adapt to it #2406middleware.CORSConfig.UnsafeWildcardOriginWithAllowCredentialsto make UNSAFE usages of wildcard origin + allow cretentials less likely #2405Enhancements
v4.10.1Compare Source
Security
Enhancements
v4.10.0Compare Source
Security
We are deprecating JWT middleware in this repository. Please use https://github.com/labstack/echo-jwt instead.
JWT middleware is moved to separate repository to allow us to bump/upgrade version of JWT implementation (
github.com/golang-jwt/jwt) we are usingwhich we can not do in Echo core because this would break backwards compatibility guarantees we try to maintain.
This minor version bumps minimum Go version to 1.17 (from 1.16) due
golang.org/x/packages we depend on. There areseveral vulnerabilities fixed in these libraries.
Echo still tries to support last 4 Go versions but there are occasions we can not guarantee this promise.
Enhancements
middleware.CreateExtractorsfunction so we can use it from echo-contrib repository #2338e.Routes()work and introducee.OnAddRouteHandlercallback #2337v4.9.1Compare Source
Fixes
Enhancements
v4.9.0Compare Source
Security
Enhancements
v4.8.0Compare Source
Most notable things
You can now add any arbitrary HTTP method type as a route #2237
You can add custom 404 handler for specific paths #2217
Enhancements
v4.7.2Compare Source
Fixes
Enhancements
v4.7.1Compare Source
Fixes
e.Static,.File(),c.Attachment()being picky with paths starting with./,../and/after 4.7.0 introduced echo.Filesystem support (Go1.16+) #2123Enhancements
v4.7.0Compare Source
Enhancements
Fixes
General
godirective ingo.modto 1.17 #2049v4.6.3Compare Source
Fixes
4.6.2#2066v4.6.2Compare Source
Fixes
Enhancements
v4.6.1Compare Source
Enhancements
v4.6.0Compare Source
Introduced a new request logger middleware
to help with cases when you want to use some other logging library in your application.
Fixes
Enhancements
v4.5.0Compare Source
Important notes
A BREAKING CHANGE is introduced for JWT middleware users.
The JWT library used for the JWT middleware had to be changed from github.com/dgrijalva/jwt-go to
github.com/golang-jwt/jwt due former library being unmaintained and affected by security
issues.
The github.com/golang-jwt/jwt project is a drop-in replacement, but supports only the latest 2 Go versions.
So for JWT middleware users Go 1.15+ is required. For detailed information please read #1940
To change the library imports in all .go files in your project replace all occurrences of
dgrijalva/jwt-gowithgolang-jwt/jwt.For Linux CLI you can use:
Fixes
github.com/golang-jwt/jwt#1946v4.4.0Compare Source
Fixes
Enhancements
v4.3.0Compare Source
Important notes
Fixes
Enhancements
v4.2.2Compare Source
Fixes
v4.2.1Compare Source
Important notes
Due to a datarace the config parameters for the newly added timeout middleware required a change.
See the docs.
A performance regression has been fixed, even bringing better performance than before for some routing scenarios.
Fixes
This release was made possible by our contributors:
aldas, clwluvw, lammel, Le0tk0k, maciej-jezierski, rkilingr, stffabi, withshubh
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.