v4 from 4.12.0 to 4.13.3 #520

New issue

Closed

opened 2026-03-04 00:26:23 +03:00 by kerem · 0 comments

kerem commented

2026-03-04 00:26:23 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/SignTools/SignTools/pull/509
Author: @dependabot[bot]
Created: 12/20/2024
Status: ❌ Closed

Base: master ← Head: dependabot/go_modules/github.com/labstack/echo/v4-4.13.3

📝 Commits (1)

503717c fix(deps): bump github.com/labstack/echo/v4 from 4.12.0 to 4.13.3

📊 Changes

2 files changed (+21 additions, -23 deletions)

View changed files

📝 go.mod (+7 -8)
📝 go.sum (+14 -15)

📄 Description

Bumps github.com/labstack/echo/v4 from 4.12.0 to 4.13.3.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.13.3

Security

Update golang.org/x/net dependency GO-2024-3333 in labstack/echo#2722

Full Changelog: https://github.com/labstack/echo/compare/v4.13.2...v4.13.3

v4.13.2 - update dependencies

Security

Update dependencies (dependabot reports https://pkg.go.dev/vuln/GO-2024-3321 by @aldas in labstack/echo#2721

Full Changelog: https://github.com/labstack/echo/compare/v4.13.1...v4.13.2

v4.13.1

Fixes

Fix BindBody ignoring Transfer-Encoding: chunked requests (introduced in #2710) by @178inaba in labstack/echo#2717

Full Changelog: https://github.com/labstack/echo/compare/v4.13.0...v4.13.1

JWT Middleware Removed

BREAKING CHANGE: JWT Middleware Removed from Core

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository or see alternative implementation

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

remove jwt middleware by @stevenwhitehead in labstack/echo#2701

optimization: struct alignment by @behnambm in labstack/echo#2636

bind: Maintain backwards compatibility for map[string]interface{} binding by @thesaltree in labstack/echo#2656

Add Go 1.23 to CI by @aldas in labstack/echo#2675

improve MultipartForm test by @martinyonatann in labstack/echo#2682

bind : add support of multipart multi files by @martinyonatann in labstack/echo#2684

Add TemplateRenderer struct to ease creating renderers for html/template and text/template packages. by @aldas in labstack/echo#2690

Refactor TestBasicAuth to utilize table-driven test format by @ErikOlson in labstack/echo#2688

Remove broken header by @aldas in labstack/echo#2705

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.13.3 - 2024-12-19

Security

Update golang.org/x/net dependency GO-2024-3333 in labstack/echo#2722

v4.13.2 - 2024-12-12

Security

Update dependencies (dependabot reports GO-2024-3321) in labstack/echo#2721

v4.13.1 - 2024-12-11

Fixes

Fix BindBody ignoring Transfer-Encoding: chunked requests by @178inaba in labstack/echo#2717

v4.13.0 - 2024-12-04

BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

remove jwt middleware by @stevenwhitehead in labstack/echo#2701

optimization: struct alignment by @behnambm in labstack/echo#2636

bind: Maintain backwards compatibility for map[string]interface{} binding by @thesaltree in labstack/echo#2656

Add Go 1.23 to CI by @aldas in labstack/echo#2675

improve MultipartForm test by @martinyonatann in labstack/echo#2682

bind : add support of multipart multi files by @martinyonatann in labstack/echo#2684

Add TemplateRenderer struct to ease creating renderers for html/template and text/template packages. by @aldas in labstack/echo#2690

Refactor TestBasicAuth to utilize table-driven test format by @ErikOlson in labstack/echo#2688

Remove broken header by @aldas in labstack/echo#2705

fix(bind body): content-length can be -1 by @phamvinhdat in labstack/echo#2710

... (truncated)

Commits

45524e3 Update golang.org/x/net dependency [GO-2024-3333](https://pkg.go.dev/vuln/GO-...
692bc2a Update dependencies (dependabot reports https://pkg.go.dev/vuln/GO-2024-3321)...
fd3f074 Changelog for v4.13.1 (#2719)
0368ed8 Add Conditions to Ensure Bind Succeeds with Transfer-Encoding: chunked (#2717)
3b01785 Changelog for 4.13.0 (#2712)
fe26277 remove jwt middleware
9e73691 Shorten Github issue template and add test example
118c163 CORS middleware should compile allowOrigin regexp at creation.
a973e3b add unit-test
c4410fe fix(bind body): content-length can be -1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/SignTools/SignTools/pull/509 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 12/20/2024 **Status:** ❌ Closed **Base:** `master` ← **Head:** `dependabot/go_modules/github.com/labstack/echo/v4-4.13.3` --- ### 📝 Commits (1) - [`503717c`](https://github.com/SignTools/SignTools/commit/503717cfbdc12ad72b0eb37a9b4bcf31f62ad92a) fix(deps): bump github.com/labstack/echo/v4 from 4.12.0 to 4.13.3 ### 📊 Changes **2 files changed** (+21 additions, -23 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+7 -8) 📝 `go.sum` (+14 -15) </details> ### 📄 Description Bumps [github.com/labstack/echo/v4](https://github.com/labstack/echo) from 4.12.0 to 4.13.3. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/labstack/echo/releases">github.com/labstack/echo/v4's releases</a>. <blockquote> <h2>v4.13.3</h2> Security <ul> <li>Update golang.org/x/net dependency <a href="https://pkg.go.dev/vuln/GO-2024-3333">GO-2024-3333</a> in <a href="https://redirect.github.com/labstack/echo/pull/2722">labstack/echo#2722</a></li> </ul> Full Changelog: <a href="https://github.com/labstack/echo/compare/v4.13.2...v4.13.3">https://github.com/labstack/echo/compare/v4.13.2...v4.13.3</a> <h2>v4.13.2 - update dependencies</h2> Security <ul> <li>Update dependencies (dependabot reports <a href="https://pkg.go.dev/vuln/GO-2024-3321">https://pkg.go.dev/vuln/GO-2024-3321</a> by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2721">labstack/echo#2721</a></li> </ul> Full Changelog: <a href="https://github.com/labstack/echo/compare/v4.13.1...v4.13.2">https://github.com/labstack/echo/compare/v4.13.1...v4.13.2</a> <h2>v4.13.1</h2> Fixes <ul> <li>Fix BindBody ignoring <code>Transfer-Encoding: chunked</code> requests (introduced in <a href="https://redirect.github.com/labstack/echo/pull/2710">#2710</a>) by <a href="https://github.com/178inaba"><code>@178inaba</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2717">labstack/echo#2717</a></li> </ul> Full Changelog: <a href="https://github.com/labstack/echo/compare/v4.13.0...v4.13.1">https://github.com/labstack/echo/compare/v4.13.0...v4.13.1</a> <h2>JWT Middleware Removed</h2> <h2>BREAKING CHANGE: JWT Middleware Removed from Core</h2> The JWT middleware has been removed from Echo core due to another security vulnerability, <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-51744">CVE-2024-51744</a>. For more details, refer to issue <a href="https://redirect.github.com/labstack/echo/issues/2699">#2699</a>. A drop-in replacement is available in the <a href="https://github.com/labstack/echo-jwt">labstack/echo-jwt</a> repository or see <a href="https://github.com/labstack/echo-jwt/discussions/29">alternative implementation</a> Important: Direct assignments like <code>token := c.Get("user").(*jwt.Token)</code> will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from <code>"github.com/golang-jwt/jwt"</code> in your handlers to the new middleware version using <code>"github.com/golang-jwt/jwt/v5"</code>. Background: The version of <code>golang-jwt/jwt</code> (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR <a href="https://redirect.github.com/labstack/echo/issues/1946">#1946</a>](<a href="https://redirect.github.com/labstack/echo/pull/1946">labstack/echo#1946</a>). JWT middleware was marked as deprecated in Echo core as of <a href="https://github.com/labstack/echo/releases/tag/v4.10.0">v4.10.0</a> on 2022-12-27. If you did not notice that, consider leveraging tools like <a href="https://staticcheck.dev/">Staticcheck</a> to catch such deprecations earlier in you dev/CI flow. For bonus points - check out <a href="https://github.com/securego/gosec">gosec</a>. We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision. Enhancements <ul> <li>remove jwt middleware by <a href="https://github.com/stevenwhitehead"><code>@stevenwhitehead</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2701">labstack/echo#2701</a></li> <li>optimization: struct alignment by <a href="https://github.com/behnambm"><code>@behnambm</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2636">labstack/echo#2636</a></li> <li>bind: Maintain backwards compatibility for map[string]interface{} binding by <a href="https://github.com/thesaltree"><code>@thesaltree</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2656">labstack/echo#2656</a></li> <li>Add Go 1.23 to CI by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2675">labstack/echo#2675</a></li> <li>improve <code>MultipartForm</code> test by <a href="https://github.com/martinyonatann"><code>@martinyonatann</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2682">labstack/echo#2682</a></li> <li><code>bind</code> : add support of multipart multi files by <a href="https://github.com/martinyonatann"><code>@martinyonatann</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2684">labstack/echo#2684</a></li> <li>Add TemplateRenderer struct to ease creating renderers for <code>html/template</code> and <code>text/template</code> packages. by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2690">labstack/echo#2690</a></li> <li>Refactor TestBasicAuth to utilize table-driven test format by <a href="https://github.com/ErikOlson"><code>@ErikOlson</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2688">labstack/echo#2688</a></li> <li>Remove broken header by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2705">labstack/echo#2705</a></li> </ul>  </blockquote> ... (truncated) </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/labstack/echo/blob/master/CHANGELOG.md">github.com/labstack/echo/v4's changelog</a>. <blockquote> <h2>v4.13.3 - 2024-12-19</h2> Security <ul> <li>Update golang.org/x/net dependency <a href="https://pkg.go.dev/vuln/GO-2024-3333">GO-2024-3333</a> in <a href="https://redirect.github.com/labstack/echo/pull/2722">labstack/echo#2722</a></li> </ul> <h2>v4.13.2 - 2024-12-12</h2> Security <ul> <li>Update dependencies (dependabot reports <a href="https://pkg.go.dev/vuln/GO-2024-3321">GO-2024-3321</a>) in <a href="https://redirect.github.com/labstack/echo/pull/2721">labstack/echo#2721</a></li> </ul> <h2>v4.13.1 - 2024-12-11</h2> Fixes <ul> <li>Fix BindBody ignoring <code>Transfer-Encoding: chunked</code> requests by <a href="https://github.com/178inaba"><code>@178inaba</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2717">labstack/echo#2717</a></li> </ul> <h2>v4.13.0 - 2024-12-04</h2> BREAKING CHANGE JWT Middleware Removed from Core use <a href="https://github.com/labstack/echo-jwt">labstack/echo-jwt</a> instead The JWT middleware has been removed from Echo core due to another security vulnerability, <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-51744">CVE-2024-51744</a>. For more details, refer to issue <a href="https://redirect.github.com/labstack/echo/issues/2699">#2699</a>. A drop-in replacement is available in the <a href="https://github.com/labstack/echo-jwt">labstack/echo-jwt</a> repository. Important: Direct assignments like <code>token := c.Get("user").(*jwt.Token)</code> will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from <code>"github.com/golang-jwt/jwt"</code> in your handlers to the new middleware version using <code>"github.com/golang-jwt/jwt/v5"</code>. Background: The version of <code>golang-jwt/jwt</code> (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR <a href="https://redirect.github.com/labstack/echo/issues/1946">#1946</a>](<a href="https://redirect.github.com/labstack/echo/pull/1946">labstack/echo#1946</a>). JWT middleware was marked as deprecated in Echo core as of <a href="https://github.com/labstack/echo/releases/tag/v4.10.0">v4.10.0</a> on 2022-12-27. If you did not notice that, consider leveraging tools like <a href="https://staticcheck.dev/">Staticcheck</a> to catch such deprecations earlier in you dev/CI flow. For bonus points - check out <a href="https://github.com/securego/gosec">gosec</a>. We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision. Enhancements <ul> <li>remove jwt middleware by <a href="https://github.com/stevenwhitehead"><code>@stevenwhitehead</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2701">labstack/echo#2701</a></li> <li>optimization: struct alignment by <a href="https://github.com/behnambm"><code>@behnambm</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2636">labstack/echo#2636</a></li> <li>bind: Maintain backwards compatibility for map[string]interface{} binding by <a href="https://github.com/thesaltree"><code>@thesaltree</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2656">labstack/echo#2656</a></li> <li>Add Go 1.23 to CI by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2675">labstack/echo#2675</a></li> <li>improve <code>MultipartForm</code> test by <a href="https://github.com/martinyonatann"><code>@martinyonatann</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2682">labstack/echo#2682</a></li> <li><code>bind</code> : add support of multipart multi files by <a href="https://github.com/martinyonatann"><code>@martinyonatann</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2684">labstack/echo#2684</a></li> <li>Add TemplateRenderer struct to ease creating renderers for <code>html/template</code> and <code>text/template</code> packages. by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2690">labstack/echo#2690</a></li> <li>Refactor TestBasicAuth to utilize table-driven test format by <a href="https://github.com/ErikOlson"><code>@ErikOlson</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2688">labstack/echo#2688</a></li> <li>Remove broken header by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2705">labstack/echo#2705</a></li> <li>fix(bind body): content-length can be -1 by <a href="https://github.com/phamvinhdat"><code>@phamvinhdat</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2710">labstack/echo#2710</a></li> </ul>  </blockquote> ... (truncated) </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/labstack/echo/commit/45524e39d60d424d8ac175001eed70d6ace92930"><code>45524e3</code></a> Update golang.org/x/net dependency [GO-2024-3333](<a href="https://pkg.go.dev/vuln/GO-">https://pkg.go.dev/vuln/GO-</a>...</li> <li><a href="https://github.com/labstack/echo/commit/692bc2abb6e83be2efe45f89f142f59dbca3a6d9"><code>692bc2a</code></a> Update dependencies (dependabot reports <a href="https://pkg.go.dev/vuln/GO-2024-3321">https://pkg.go.dev/vuln/GO-2024-3321</a>)...</li> <li><a href="https://github.com/labstack/echo/commit/fd3f07447eddb53e096b0df3be38bbf79123d605"><code>fd3f074</code></a> Changelog for v4.13.1 (<a href="https://redirect.github.com/labstack/echo/issues/2719">#2719</a>)</li> <li><a href="https://github.com/labstack/echo/commit/0368ed87f28eb07e7c5cca2dbff5585a019b4fa1"><code>0368ed8</code></a> Add Conditions to Ensure Bind Succeeds with <code>Transfer-Encoding: chunked</code> (<a href="https://redirect.github.com/labstack/echo/issues/2717">#2717</a>)</li> <li><a href="https://github.com/labstack/echo/commit/3b017855b4d331002e2b8b28e903679b875ae3e9"><code>3b01785</code></a> Changelog for 4.13.0 (<a href="https://redirect.github.com/labstack/echo/issues/2712">#2712</a>)</li> <li><a href="https://github.com/labstack/echo/commit/fe2627778114fc774a1b10920e1cd55fdd97cf00"><code>fe26277</code></a> remove jwt middleware</li> <li><a href="https://github.com/labstack/echo/commit/9e73691837f52c7fdf4898cbe5bf1d157387bdb0"><code>9e73691</code></a> Shorten Github issue template and add test example</li> <li><a href="https://github.com/labstack/echo/commit/118c1632f274a400fd4ba168c7a789950b3c35a2"><code>118c163</code></a> CORS middleware should compile allowOrigin regexp at creation.</li> <li><a href="https://github.com/labstack/echo/commit/a973e3bc431e157c190c9e5e0764fb22fedf4407"><code>a973e3b</code></a> add unit-test</li> <li><a href="https://github.com/labstack/echo/commit/c4410fe0b88ee0d395e23ba8b0fdfcfbce18a7ca"><code>c4410fe</code></a> fix(bind body): content-length can be -1</li> <li>Additional commits viewable in <a href="https://github.com/labstack/echo/compare/v4.12.0...v4.13.3">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/labstack/echo/v4&package-manager=go_modules&previous-version=4.12.0&new-version=4.13.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- 🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.