Update module github.com/labstack/echo/v4 to v5#55
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Update module github.com/labstack/echo/v4 to v5#55renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
Contributor
Author
|
b980bda to
e3eb2d2
Compare
e3eb2d2 to
88800b8
Compare
88800b8 to
91ec4ec
Compare
57e4b1c to
84e7e0f
Compare
84e7e0f to
19486bc
Compare
19486bc to
08eefc4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.2.0→v5.1.1Release Notes
labstack/echo (github.com/labstack/echo/v4)
v5.1.1Compare Source
Security
Context.Scheme()should validate values taken from header by @aldas in #2953Thanks to @shblue21 for reporting this issue.
Enhancements
v5.1.0Compare Source
Security
This change does not break the API contract, but it does introduce breaking changes in logic/behavior.
If your application is using
c.RealIP()beware and read https://echo.labstack.com/docs/ip-addressv4behavior can be restored with:Enhancements
v5.0.4Compare Source
Enhancements
http.Server.Servereturns we need to wait for graceful shutdown goroutine to finish by @aldas in #2898echo.StatusCodeby @suwakei in #2892echo.ResolveResponseStatusfunction to help middleware/handlers determine HTTP status code and echo.Response by @aldas in #2900v5.0.3Compare Source
Security
This applies to cases when:
middleware.StaticConfig.Filesystemisnil(default)echo.Filesystemis has not been set explicitly (default)Exposure is restricted to the active process working directory and its subfolders.
v5.0.2Compare Source
Security
config.Browse=truelists all files/subfolders fromconfig.Filesystemroot and not starting fromconfig.Rootin #2887v5.0.1Compare Source
v5.0.0Compare Source
Echo
v5is maintenance release with major breaking changesContextis now struct instead of interface and we can add method to it in the future in minor versions.Routerinterface for possible new routing implementations.log/sloginstead.Upgrade notes and
v4support:v4is supported with security* updates and bug fixes until 2026-12-31v5API changes will be addressed, even if this violates semantic versioning.See API_CHANGES_V5.md for public API changes between
v4andv5, notes on upgrading.Upgrading TLDR:
If you are using Linux you can migrate easier parts like that:
macOS
or in your favorite IDE
Replace all:
echo.Context->*echo.Contextecho/v4->echo/v5This should solve most of the issues. Probably the hardest part is updating all the tests.
v4.15.2: - Context.Scheme() header validationCompare Source
Security
Context.Scheme()should validate values taken from header by @aldas in #2962Thanks to @shblue21 for reporting this issue.
Full Changelog: labstack/echo@v4.15.1...v4.15.2
v4.15.1Compare Source
What's Changed
Full Changelog: labstack/echo@v4.15.0...v4.15.1
v4.15.0Compare Source
Security
NB: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production
The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF
protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.
How it works:
Modern browsers automatically send the
Sec-Fetch-Siteheader with all requests, indicating the relationshipbetween the request origin and the target. The middleware uses this to make security decisions:
same-originornone: Requests are allowed (exact origin match or direct user navigation)same-site: Falls back to token validation (e.g., subdomain to main domain)cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)For browsers that don't send this header (older browsers), the middleware seamlessly falls back to
traditional token-based CSRF protection.
New Configuration Options:
TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validationExample:
PR: #2858
Type-Safe Generic Parameter Binding
Added generic functions for type-safe parameter extraction and context access by @aldas in #2856
Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion,
eliminating manual string parsing and type assertions.
New Functions:
PathParam[T],PathParamOr[T]QueryParam[T],QueryParamOr[T],QueryParams[T],QueryParamsOr[T]FormParam[T],FormParamOr[T],FormParams[T],FormParamsOr[T]ContextGet[T],ContextGetOr[T]Supported Types:
Primitives (
bool,string,int/uintvariants,float32/float64),time.Duration,time.Time(with custom layouts and Unix timestamp support), and custom types implementing
BindUnmarshaler,TextUnmarshaler, orJSONUnmarshaler.Example:
PR: #2856
DEPRECATION NOTICE Timeout Middleware Deprecated - Use ContextTimeout Instead
The
middleware.Timeoutmiddleware has been deprecated due to fundamental architectural issues that causedata races. Use
middleware.ContextTimeoutormiddleware.ContextTimeoutWithConfiginstead.Why is this being deprecated?
The Timeout middleware manipulates response writers across goroutine boundaries, which causes data races that
cannot be reliably fixed without a complete architectural redesign. The middleware:
http.TimeoutHandlerWhat should you use instead?
The
ContextTimeoutmiddleware (available since v4.12.0) provides timeout functionality using Go's standardcontext mechanism. It is:
Migration Guide:
Important Behavioral Differences:
Handler cooperation required: With ContextTimeout, your handlers must check
context.Done()for cooperativecancellation. The old Timeout middleware would send a 503 response regardless of handler cooperation, but had
data race issues.
Error handling: ContextTimeout returns errors through the standard error handling flow. Handlers that receive
context.DeadlineExceededshould handle it appropriately:Enhancements
v4.14.0Compare Source
middleware.Loggerhas been deprecated. For request logging, usemiddleware.RequestLoggerormiddleware.RequestLoggerWithConfig.middleware.RequestLoggerreplacesmiddleware.Logger, offering comparable configuration while relying on theGo standard library’s new
sloglogger.The previous default output format was JSON. The new default follows the standard
sloglogger settings.To continue emitting request logs in JSON, configure
slogaccordingly:Security
Enhancements
v4.13.4Compare Source
Enhancements
Security
v4.13.3Compare Source
Security
v4.13.2Compare Source
Security
v4.13.1Compare Source
Fixes
Transfer-Encoding: chunkedrequests by @178inaba in #2717v4.13.0Compare Source
BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead
The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.
Important: Direct assignments like
token := c.Get("user").(*jwt.Token)will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from"github.com/golang-jwt/jwt"in your handlers to the new middleware version using"github.com/golang-jwt/jwt/v5".Background:
The version of
golang-jwt/jwt(v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in PR #1946.JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.
We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.
Enhancements
MultipartFormtest by @martinyonatann in #2682bind: add support of multipart multi files by @martinyonatann in #2684html/templateandtext/templatepackages. by @aldas in #2690v4.12.0Compare Source
Security
Enhancements
UnmarshalParams(params []string) errorinter… by @aldas in #2607*[]stringby @aldas in #2608/. by @aldas in #2616v4.11.4Compare Source
Security
Enhancements
v4.11.3Compare Source
Security
Enhancements
v4.11.2Compare Source
Security
Enhancements
v4.11.1Compare Source
Fixes
Gzipmiddleware not sending response code for no content responses (404, 301/302 redirects etc) #2481v4.11.0Compare Source
Fixes
group.RouteNotFoundnot working when group has attached middlewares #2411Enhancements
strings.ReplaceAlldirectly #2424http.rwUnwrapperto Response struct #2425echo.Reversemethod #2416v4.10.2Compare Source
Security
filepath.Cleanbehaviour has changed in Go 1.20 - adapt to it #2406middleware.CORSConfig.UnsafeWildcardOriginWithAllowCredentialsto make UNSAFE usages of wildcard origin + allow cretentials less likely #2405Enhancements
v4.10.1Compare Source
Security
Enhancements
v4.10.0Compare Source
Security
We are deprecating JWT middleware in this repository. Please use https://github.com/labstack/echo-jwt instead.
JWT middleware is moved to separate repository to allow us to bump/upgrade version of JWT implementation (
github.com/golang-jwt/jwt) we are usingwhich we can not do in Echo core because this would break backwards compatibility guarantees we try to maintain.
This minor version bumps minimum Go version to 1.17 (from 1.16) due
golang.org/x/packages we depend on. There areseveral vulnerabilities fixed in these libraries.
Echo still tries to support last 4 Go versions but there are occasions we can not guarantee this promise.
Enhancements
middleware.CreateExtractorsfunction so we can use it from echo-contrib repository #2338e.Routes()work and introducee.OnAddRouteHandlercallback #2337v4.9.1Compare Source
Fixes
Enhancements
v4.9.0Compare Source
Security
Enhancements
v4.8.0Compare Source
Most notable things
You can now add any arbitrary HTTP method type as a route #2237
You can add custom 404 handler for specific paths #2217
Enhancements
v4.7.2Compare Source
Fixes
Enhancements
v4.7.1Compare Source
Fixes
e.Static,.File(),c.Attachment()being picky with paths starting with./,../and/after 4.7.0 introduced echo.Filesystem support (Go1.16+) #2123Enhancements
v4.7.0Compare Source
Enhancements
Fixes
General
godirective ingo.modto 1.17 #2049v4.6.3Compare Source
Fixes
4.6.2#2066v4.6.2Compare Source
Fixes
Enhancements
v4.6.1Compare Source
Enhancements
v4.6.0Compare Source
Introduced a new request logger middleware
to help with cases when you want to use some other logging library in your application.
Fixes
Enhancements
v4.5.0Compare Source
Important notes
A BREAKING CHANGE is introduced for JWT middleware users.
The JWT library used for the JWT middleware had to be changed from github.com/dgrijalva/jwt-go to
github.com/golang-jwt/jwt due former library being unmaintained and affected by security
issues.
The github.com/golang-jwt/jwt project is a drop-in replacement, but supports only the latest 2 Go versions.
So for JWT middleware users Go 1.15+ is required. For detailed information please read #1940
To change the library imports in all .go files in your project replace all occurrences of
dgrijalva/jwt-gowithgolang-jwt/jwt.For Linux CLI you can use:
Fixes
github.com/golang-jwt/jwt#1946v4.4.0Compare Source
Fixes
Enhancements
v4.3.0Compare Source
Important notes
Fixes
Enhancements
v4.2.2Compare Source
Fixes
v4.2.1Compare Source
Important notes
Due to a datarace the config parameters for the newly added timeout middleware required a change.
See the docs.
A performance regression has been fixed, even bringing better performance than before for some routing scenarios.
Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.