v4 from 4.15.0 to 4.15.1 #645

New issue

Open

opened 2026-03-04 00:27:00 +03:00 by kerem · 0 comments

kerem commented

2026-03-04 00:27:00 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/SignTools/SignTools/pull/646
Author: @dependabot[bot]
Created: 2/23/2026
Status: 🔄 Open

Base: master ← Head: dependabot/go_modules/github.com/labstack/echo/v4-4.15.1

📝 Commits (1)

a06f7c8 fix(deps): bump github.com/labstack/echo/v4 from 4.15.0 to 4.15.1

📊 Changes

2 files changed (+3 additions, -3 deletions)

View changed files

📝 go.mod (+1 -1)
📝 go.sum (+2 -2)

📄 Description

Bumps github.com/labstack/echo/v4 from 4.15.0 to 4.15.1.

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

Changelog

v5.0.4 - 2026-02-15

Enhancements

Remove unused import 'errors' from README example by @kumapower17 in labstack/echo#2889

Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @aldas in labstack/echo#2898

Update location of oapi-codegen in README by @mromaszewicz in labstack/echo#2896

Add Go 1.26 to CI flow by @aldas in labstack/echo#2899

Add new function echo.StatusCode by @suwakei in labstack/echo#2892

CSRF: support older token-based CSRF protection handler that want to render token into template by @aldas in labstack/echo#2894

Add echo.ResolveResponseStatus function to help middleware/handlers determine HTTP status code and echo.Response by @aldas in labstack/echo#2900

v5.0.3 - 2026-02-06

Security

Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @shblue21.

This applies to cases when:

Windows is used as OS

middleware.StaticConfig.Filesystem is nil (default)

echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

v5.0.2 - 2026-02-02

Security

Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in labstack/echo#2887

v5.0.1 - 2026-01-28

Panic MW: will now return a custom PanicStackError with stack trace by @aldas in labstack/echo#2871

Docs: add missing err parameter to DenyHandler example by @cgalibern in labstack/echo#2878

improve: improve websocket checks in IsWebSocket() [per RFC 6455] by @raju-mechatronics in labstack/echo#2875

fix: Context.Json() should not send status code before serialization is complete by @aldas in labstack/echo#2877

v5.0.0 - 2026-01-18

Echo v5 is maintenance release with major breaking changes

Context is now struct instead of interface and we can add method to it in the future in minor versions.

Adds new Router interface for possible new routing implementations.

Drops old logging interface and uses moderm log/slog instead.

... (truncated)

Commits

6f3a84a Merge pull request #2905 from aldas/v4_crsf_token_fallback
24fa4d0 CSRF: support older token-based CSRF protection handler that want to render t...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/SignTools/SignTools/pull/646 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 2/23/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `dependabot/go_modules/github.com/labstack/echo/v4-4.15.1` --- ### 📝 Commits (1) - [`a06f7c8`](https://github.com/SignTools/SignTools/commit/a06f7c873d71c1d6a245387d077f9b3dd04669b0) fix(deps): bump github.com/labstack/echo/v4 from 4.15.0 to 4.15.1 ### 📊 Changes **2 files changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+1 -1) 📝 `go.sum` (+2 -2) </details> ### 📄 Description Bumps [github.com/labstack/echo/v4](https://github.com/labstack/echo) from 4.15.0 to 4.15.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/labstack/echo/blob/master/CHANGELOG.md">github.com/labstack/echo/v4's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v5.0.4 - 2026-02-15</h2> <p><strong>Enhancements</strong></p> <ul> <li>Remove unused import 'errors' from README example by <a href="https://github.com/kumapower17"><code>@kumapower17</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2889">labstack/echo#2889</a></li> <li>Fix Graceful shutdown: after <code>http.Server.Serve</code> returns we need to wait for graceful shutdown goroutine to finish by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2898">labstack/echo#2898</a></li> <li>Update location of oapi-codegen in README by <a href="https://github.com/mromaszewicz"><code>@mromaszewicz</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2896">labstack/echo#2896</a></li> <li>Add Go 1.26 to CI flow by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2899">labstack/echo#2899</a></li> <li>Add new function <code>echo.StatusCode</code> by <a href="https://github.com/suwakei"><code>@suwakei</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2892">labstack/echo#2892</a></li> <li>CSRF: support older token-based CSRF protection handler that want to render token into template by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2894">labstack/echo#2894</a></li> <li>Add <code>echo.ResolveResponseStatus</code> function to help middleware/handlers determine HTTP status code and echo.Response by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2900">labstack/echo#2900</a></li> </ul> <h2>v5.0.3 - 2026-02-06</h2> <p><strong>Security</strong></p> <ul> <li>Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by <a href="https://github.com/shblue21"><code>@shblue21</code></a>.</li> </ul> <p>This applies to cases when:</p> <ul> <li>Windows is used as OS</li> <li><code>middleware.StaticConfig.Filesystem</code> is <code>nil</code> (default)</li> <li><code>echo.Filesystem</code> is has not been set explicitly (default)</li> </ul> <p>Exposure is restricted to the active process working directory and its subfolders.</p> <h2>v5.0.2 - 2026-02-02</h2> <p><strong>Security</strong></p> <ul> <li>Fix Static middleware with <code>config.Browse=true</code> lists all files/subfolders from <code>config.Filesystem</code> root and not starting from <code>config.Root</code> in <a href="https://redirect.github.com/labstack/echo/pull/2887">labstack/echo#2887</a></li> </ul> <h2>v5.0.1 - 2026-01-28</h2> <ul> <li>Panic MW: will now return a custom PanicStackError with stack trace by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2871">labstack/echo#2871</a></li> <li>Docs: add missing err parameter to DenyHandler example by <a href="https://github.com/cgalibern"><code>@cgalibern</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2878">labstack/echo#2878</a></li> <li>improve: improve websocket checks in IsWebSocket() [per RFC 6455] by <a href="https://github.com/raju-mechatronics"><code>@raju-mechatronics</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2875">labstack/echo#2875</a></li> <li>fix: Context.Json() should not send status code before serialization is complete by <a href="https://github.com/aldas"><code>@aldas</code></a> in <a href="https://redirect.github.com/labstack/echo/pull/2877">labstack/echo#2877</a></li> </ul> <h2>v5.0.0 - 2026-01-18</h2> <p>Echo <code>v5</code> is maintenance release with <strong>major breaking changes</strong></p> <ul> <li><code>Context</code> is now struct instead of interface and we can add method to it in the future in minor versions.</li> <li>Adds new <code>Router</code> interface for possible new routing implementations.</li> <li>Drops old logging interface and uses moderm <code>log/slog</code> instead.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/labstack/echo/commit/6f3a84a50585110dc71c39585e7c97faf8fcaf0a"><code>6f3a84a</code></a> Merge pull request <a href="https://redirect.github.com/labstack/echo/issues/2905">#2905</a> from aldas/v4_crsf_token_fallback</li> <li><a href="https://github.com/labstack/echo/commit/24fa4d07ff994074cfb47ca8a6b088e17cbe1711"><code>24fa4d0</code></a> CSRF: support older token-based CSRF protection handler that want to render t...</li> <li>See full diff in <a href="https://github.com/labstack/echo/compare/v4.15.0...v4.15.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/labstack/echo/v4&package-manager=go_modules&previous-version=4.15.0&new-version=4.15.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>