chore(deps)(deps): bump the go-deps group across 1 directory with 8 updates by dependabot[bot] · Pull Request #35 · devituz/lagodev

dependabot · 2026-07-20T03:46:36Z

Bumps the go-deps group with 8 updates in the / directory:

Package	From	To
github.com/mattn/go-sqlite3	`1.14.47`	`1.14.48`
golang.org/x/crypto	`0.53.0`	`0.54.0`
github.com/gin-gonic/gin	`1.10.0`	`1.12.0`
google.golang.org/grpc	`1.81.1`	`1.82.1`
github.com/coder/websocket	`1.8.12`	`1.8.15`
github.com/go-chi/chi/v5	`5.3.0`	`5.3.1`
github.com/labstack/echo/v4	`4.12.0`	`4.15.4`
github.com/gofiber/fiber/v2	`2.52.13`	`2.52.14`

Updates github.com/mattn/go-sqlite3 from 1.14.47 to 1.14.48

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.48

What's Changed

Add Serialize and Deserialize support by @otoolep in mattn/go-sqlite3#1089

Replace namedValue with driver.NamedValue to avoid copying exec/query args by @charlievieth in mattn/go-sqlite3#1128

Add go 1.20 to workflow matrix, remove 1.17 by @connyay in mattn/go-sqlite3#1136

Add build tags to support both x86 and ARM compilation on macOS by @Spaider in mattn/go-sqlite3#1069

Fix virtual table example. by @andrzh in mattn/go-sqlite3#1149

Update README.md by @parthokr in mattn/go-sqlite3#1163

Update amalgamation code by @mattn in mattn/go-sqlite3#1166

Update amalgamation code by @mattn in mattn/go-sqlite3#1197

Fix docker job by @itizir in mattn/go-sqlite3#1201

Fix musl build (#1164) by @leso-kn in mattn/go-sqlite3#1177

update go version to 1.19 by @mattn in mattn/go-sqlite3#1208

Update amalgamation code to 3.45.0 by @mattn in mattn/go-sqlite3#1207

Update amalgamation code to 3.45.1 by @mattn in mattn/go-sqlite3#1211

close channel by @mattn in mattn/go-sqlite3#1213

fix: some typos by @pomadev in mattn/go-sqlite3#1222

Add support for libsqlite3 on z/OS by @dustin-ward in mattn/go-sqlite3#1239

Update amalgamation code to 3.46.1 by @mattn in mattn/go-sqlite3#1273

close statement when missing query arguments by @mattn in mattn/go-sqlite3#1281

Upgrade upload-artifact action by @jonstacks in mattn/go-sqlite3#1300

Remove suggestion that CGO isn't always needed by @samjewell in mattn/go-sqlite3#1290

remove superfluous use of runtime.SetFinalizer on SQLiteRows by @charlievieth in mattn/go-sqlite3#1301

Fix sqlite3_opt_unlock_notify with USE_LIBSQLITE3 by @q66 in mattn/go-sqlite3#1262

Fix memory leak in callbackRetText function by @hionay in mattn/go-sqlite3#1259

docs: clarify GCP section by @justinsb in mattn/go-sqlite3#1305

Add ability to set an int64 file control by @jonstacks in mattn/go-sqlite3#1298

Update amalgamation code to 3.49.1 by @mattn in mattn/go-sqlite3#1335

Update amalgamation code to 3.50.3 by @mattn in mattn/go-sqlite3#1343

Drop userauth implementation by @mattn in mattn/go-sqlite3#1344

fix syntax error by @eraytufan in mattn/go-sqlite3#1346

update amalgamation code by @mattn in mattn/go-sqlite3#1347

use quote include instead of angled include for sqlite3-binding.h by @nautaa in mattn/go-sqlite3#1362

Upgrade SQLite to version 3051001 by @mattn in mattn/go-sqlite3#1366

Feat: add percentile extension option by @dsonck92 in mattn/go-sqlite3#1364

Upgrade SQLite to version 3051002 by @mattn in mattn/go-sqlite3#1370

Use unsafe slice by @mattn in mattn/go-sqlite3#1373

Call sqlite3_clear_bindings() after sqlite3_reset() in bind() by @mattn in mattn/go-sqlite3#1374

Upgrade SQLite to version 3051003 by @mattn in mattn/go-sqlite3#1375

Ensure Close always removes runtime finalizer to prevent memory leak by @mattn in mattn/go-sqlite3#1376

Fix json example by @Jaculabilis in mattn/go-sqlite3#1313

Add missing virtual table constraint op constants by @theimpostor in mattn/go-sqlite3#1379

Eliminate unnecessary bounds checks in hot paths by @mattn in mattn/go-sqlite3#1381

[codex] optimize sqlite bind fast path by @mattn in mattn/go-sqlite3#1382

[codex] batch row column fetches in Next by @mattn in mattn/go-sqlite3#1383

Raise minimum Go version to 1.21 by @mattn in mattn/go-sqlite3#1384

Reduce sqlite bind overhead by @mattn in mattn/go-sqlite3#1385

reduce CGO call overhead for exec and bind paths by @mattn in mattn/go-sqlite3#1386

[codex] add opt-in statement cache by @mattn in mattn/go-sqlite3#1387

Fix panic when querying input with no SQL (only comments/whitespace) by @mattn in mattn/go-sqlite3#1392

... (truncated)

Commits

0cfec60 Merge pull request #1427 from mattn/sqlite-amalgamation-3053003
603b1ba Upgrade SQLite to version 3053003
3be2bdb Merge pull request #1426 from mattn/fix-load-extension-errmsg-leak
7a3f560 Merge pull request #1425 from mattn/fix-trampoline-abi
a5fd1f6 Merge pull request #1424 from mattn/fix-preupdate-null-deref
66371d2 Merge pull request #1423 from mattn/fix-open-error-leak
b55096d Merge pull request #1418 from mattn/add-coderabbit-config
fa5cf80 Merge pull request #1422 from mattn/fix-bind-unsupported-type
08a4ce4 Add regression tests for bind error paths
ca77cf4 Merge pull request #1421 from mattn/fix-callback-named-types
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

cdce021 go.mod: update golang.org/x dependencies
d9474cc openpgp: make the deprecation message more explicit
7626c50 ssh: verify declared key type matches decoded key in authorized_keys
0471e79 ssh/agent: enforce strict limits on DSA key parameters
6435c37 ssh: sanitize client disconnect messages
7d695da ssh/agent: drain channel stderr in agent forwarders
5b7f841 acme/autocert: fix data race in Manager.createCert
0b316e7 argon2: update RFC 9106 parameter recommendations
55aec0a x509roots/fallback: update bundle
5f2de1a internal: remove wycheproof tests
See full diff in compare view

Updates github.com/gin-gonic/gin from 1.10.0 to 1.12.0

Release notes

Sourced from github.com/gin-gonic/gin's releases.

v1.12.0

Changelog

Features

192ac89eefc1c30f7c97ae48a9ffb1c6f1c8c8bc: feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203) (@takanuva15)

53410d2e07054369e0960fbe2eed97e1b9966f12: feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502) (@raju-mechatronics)

acc55e049e33b401e810dbd8c0d6dcb6b3ba2b05: feat(context): add Protocol Buffers support to content negotiation (#4423) (@1911860538)

38e765119241d990705169bedb5002a29ae0cbd1: feat(context): implemented Delete method (@Spyder01)

771dcc6476d7bc6abb9ec0235ecefa4d38fe6fb0: feat(gin): add option to use escaped path (#4420) (@ldesauw)

4dec17afdff48e8018c83618fbbe69fceeb2b41d: feat(logger): color latency (#4146) (@wsyqn6)

d7776de7d444935ea4385999711bd6331a98fecb: feat(render): add bson protocol (#4145) (@laurentcau)

Bug fixes

b917b14ff9d189f16a7492be79d123a47806ee19: fix(binding): empty value error (#2169) (@guonaihong)

c3d1092b3b48addf6f9cd00fe274ec3bd14650eb: fix(binding): improve empty slice/array handling in form binding (#4380) (@1911860538)

9914178584e42458ff7d23891463a880f58c9d86: fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472) (@Nurysso)

2a794cd0b0faa7d829291375b27a3467ea972b0d: fix(debug): version mismatch (#4403) (@zeek0x)

c3d5a28ed6d3849da820195b6774d212bcc038a9: fix(gin): close os.File in RunFd to prevent resource leak (#4422) (@1911860538)

5fad976b372e381312f8de69f0969f1284d229d3: fix(gin): literal colon routes not working with engine.Handler() (#4415) (@pawannn)

63dd3e60cab89c27fb66bce1423bd268d52abad1: fix(recover): suppress http.ErrAbortHandler in recover (#4336) (@MondayCha)

5c00df8afadd06cc5be530dde00fe6d9fa4a2e4a: fix(render): write content length in Data.Render (#4206) (@dengaleev)

234a6d4c00cb77af9852aca0b8289745d5529b4b: fix(response): refine hijack behavior for response lifecycle (#4373) (@appleboy)

472d086af2acd924cb4b9d7be0525f7d790f69bc: fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535) (@veeceey)

8e07d37c63e5536eb25f4af4c91eabeee4011fba: fix: Correct typos, improve documentation clarity, and remove dead code (#4511) (@mahanadh)

Enhancements

ba093d19477b896ac89a7fc3246af23d290b8e26: chore(binding): upgrade bson dependency to mongo-driver v2 (#4549) (@BobDu)

b2b489dbf4826c2c630717a77fd5e42774625410: chore(context): always trust xff headers from unix socket (#3359) (@WeidiDeng)

ecb3f7b5e2f3915bf1db240ed5eee572f8dbea36: chore(deps): upgrade golang.org/x/crypto to v0.45.0 (#4449) (@appleboy)

af6e8b70b8261bb0c99ad094fe552ab92991620a: chore(deps): upgrade quic-go to v0.57.1 (@appleboy)

db309081bc5c137b2aa15701ef53f7f19788da25: chore(logger): allow skipping query string output (#4547) (@USA-RedDragon)

26c3a628655cad2388380cb8102d6ce7d4875f3b: chore(response): prevent Flush() panic when http.Flusher (#4479) (@Twacqwq)

5dd833f1f26de0eb30eae47b17e05ced2482dc41: chore: bump minimum Go version to 1.24 and update workflows (#4388) (@appleboy)

Refactor

39858a0859c914bd26948fa950477e11bd8d3823: refactor(binding): use maps.Copy for cleaner map handling (#4352) (@russcoss)

c0048f645ee945c4db30593afdea10123e2c30a6: refactor(context): omit the return value names (#4395) (@wanghaolong613)

915e4c90d28ec4cffc6eb146e208ab5a65eac772: refactor(context): replace hardcoded localhost IPs with constants (#4481) (@pauloappbr)

414de60574449457f3192a7a1d5528940db2836d: refactor(context): using maps.Clone (#4333) (@cuiweixie)

59e9d4a794f12c4f9a6c7bed441b9644e5f6d99b: refactor(ginS): use sync.OnceValue to simplify engine function (#4314) (@1911860538)

3ab698dc5110af1977d57226e4995c57dd34c233: refactor(recovery): smart error comparison (#4142) (@zeek0x)

d1a15347b1e45a8ee816193d3578a93bfd73b70f: refactor(utils): move util functions to utils.go (#4467) (@zeek0x)

e3118cc378d263454098924ebbde7e8d1dd2e904: refactor: for loop can be modernized using range over int (#4392) (@wanghaolong613)

488f8c3ffa579a8d19beb2bae95ff8ef36b3d53f: refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529) (@veeceey)

9968c4bf9d5a99edc3eee2c068a4c9160ece8915: refactor: use b.Loop() to simplify the code and improve performance (#4389) (@reddaisyy)

a85ef5ce4d0cda8834c59c855068ed48b51192d1: refactor: use b.Loop() to simplify the code and improve performance (#4432) (@efcking)

Build process updates

61b67de522a189b568aced4c5c16917c558e3387: ci(bot): increase frequency and group updates for dependencies (#4367) (@appleboy)

fb27ef26c2fdfe25344b4c039d8a53551f9e912c: ci(lint): refactor test assertions and linter configuration (#4436) (@appleboy)

93ff771e6dbf10e432864b30f3719ac5c84a4d4a: ci(sec): improve type safety and server organization in HTTP middleware (#4437) (@appleboy)

e88fc8927a52b74f55bec0351604a56ac0aa1c51: ci(sec): schedule Trivy security scans to run daily at midnight UTC (#4439) (@appleboy)

5e5ff3ace496a31b138b0820136a146bfb5de0ef: ci: replace vulnerability scanning workflow with Trivy integration (#4421) (@appleboy)

00900fb3e1ea9dde33985a0e4f6afec793d5e786: ci: update CI workflows and standardize Trivy config quotes (#4531) (@appleboy)

ae3f524974fc4f55d18c9e7fae4614503c015226: ci: update Go version support to 1.25+ across CI and docs (#4550) (@appleboy)

... (truncated)

Changelog

Sourced from github.com/gin-gonic/gin's changelog.

Gin v1.12.0

Features

feat(render): add bson protocol (#4145)

feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502)

feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203)

feat(gin): add option to use escaped path (#4420)

feat(context): add Protocol Buffers support to content negotiation (#4423)

feat(context): implemented Delete method (#38e7651)

feat(logger): color latency (#4146)

Enhancements

perf(tree): reduce allocations in findCaseInsensitivePath (#4417)

perf(recovery): optimize line reading in stack function (#4466)

perf(path): replace regex with custom functions in redirectTrailingSlash (#4414)

perf(tree): optimize path parsing using strings.Count (#4246)

chore(logger): allow skipping query string output (#4547)

chore(context): always trust xff headers from unix socket (#3359)

chore(response): prevent Flush() panic when the underlying ResponseWriter does not implement http.Flusher (#4479)

refactor(recovery): smart error comparison (#4142)

refactor(context): replace hardcoded localhost IPs with constants (#4481)

refactor(utils): move util functions to utils.go (#4467)

refactor(binding): use maps.Copy for cleaner map handling (#4352)

refactor(context): using maps.Clone (#4333)

refactor(ginS): use sync.OnceValue to simplify engine function (#4314)

refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529)

refactor: for loop can be modernized using range over int (#4392)

Bug Fixes

fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)

fix(render): write content length in Data.Render (#4206)

fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472)

fix(binding): empty value error (#2169)

fix(recover): suppress http.ErrAbortHandler in recover (#4336)

fix(gin): literal colon routes not working with engine.Handler() (#4415)

fix(gin): close os.File in RunFd to prevent resource leak (#4422)

fix(response): refine hijack behavior for response lifecycle (#4373)

fix(binding): improve empty slice/array handling in form binding (#4380)

fix(debug): version mismatch (#4403)

fix: correct typos, improve documentation clarity, and remove dead code (#4511)

Build process updates / CI

ci: update Go version support to 1.25+ across CI and docs (#4550)

chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)

Gin v1.11.0

... (truncated)

Commits

73726dc docs: update documentation to reflect Go version changes (#4552)
e292e5c docs: document and finalize Gin v1.12.0 release (#4551)
ae3f524 ci: update Go version support to 1.25+ across CI and docs (#4550)
38534e2 chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)
472d086 fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)
fb25834 test(context): use http.StatusContinue constant instead of magic number 100 (...
6f1d5fe test(render): add comprehensive error handling tests (#4541)
5c00df8 fix(render): write content length in Data.Render (#4206)
db30908 chore(logger): allow skipping query string output (#4547)
ba093d1 chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.81.1 to 1.82.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.

xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.

xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.

xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Release 1.82.0

Behavior Changes

server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)

transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)

balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

New Features

experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)

Special Thanks: @seth-epps

client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)

Special Thanks: @chengxilo

server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)

Special Thanks: @dfinkel

Bug Fixes

xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)

grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)

Special Thanks: @evilgensec

stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)

encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)

channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)

Commits

ebd8f06 Change version to 1.82.1 (#9238)
4ea465d Cherry-pick commits (#9236)
9494a2c Change version to 1.82.1-dev (#9171)
bd23985 Change version to 1.82.0 (#9170)
0f3086d Fix minor issues not covered by PR #9137 (#9147)
fef07fb internal: Split v3procservicepb import into pb and grpc for extproc (#9163)
91dd64f transport: surface subsequent data when receiving non-gRPC header (#8929)
adc97de test/kokoro: add config for regional-td test (#9158)
57c9ff1 xds: ensure full-string matching for RBAC Filter rules (#9148)
b58f32d server: Set a pprof label on new stream goroutines (#9082)
Additional commits viewable in compare view

Updates github.com/coder/websocket from 1.8.12 to 1.8.15

Release notes

Sourced from github.com/coder/websocket's releases.

v1.8.15

Changes

chore: fix typo in Accept function by @IgorSilvestre in coder/websocket#544

fix: transmit in single frame when compression enabled by @DanielleMaywood in coder/websocket#552

docs: add document for AI agents (AGENTS.md) by @mafredri in coder/websocket#547

docs: remove mention of resolved issue in README by @tamird in coder/websocket#556

docs: fix lint issue by @mafredri in coder/websocket#557

docs: fix roadmap links after repo transfer by @GeObts in coder/websocket#558

avoid per-frame cleanup closures on read to remove 2 allocs per frame read by @mitchellh in coder/websocket#565

conn: skip timeout callbacks for background contexts by @mitchellh in coder/websocket#566

New Contributors

@IgorSilvestre made their first contribution in coder/websocket#544

@tamird made their first contribution in coder/websocket#556

@GeObts made their first contribution in coder/websocket#558

@mitchellh made their first contribution in coder/websocket#565

Full Changelog: coder/websocket@v1.8.14...v1.8.15

v1.8.14

Changes

fix: match Origin scheme if defined in OriginPatterns by @mafredri in coder/websocket#536

refactor: use context.AfterFunc to track timeouts instead of goroutine by @ash2k in coder/websocket#532

refactor: add ErrMessageTooBig sentinel error for limited reads by @DanielleMaywood in coder/websocket#535

build: update to Go 1.23 by @mafredri in coder/websocket#524

build: add Makefile by @mafredri in coder/websocket#525

chore: update LICENSE file by @mtojek in coder/websocket#526

chore: apply various modernisations by @Jacalz in coder/websocket#531

New Contributors

@mtojek made their first contribution in coder/websocket#526

@ash2k made their first contribution in coder/websocket#532

@DanielleMaywood made their first contribution in coder/websocket#535

Full Changelog: coder/websocket@v1.8.13...v1.8.14

v1.8.13

Changes

Use new atomic types from Go 1.19 by @Jacalz in coder/websocket#444

Fix coverage by @mafredri in coder/websocket#466

Clean out env passed to wasmbrowsertest in TestWasm by @mafredri in coder/websocket#469

Sunset the dev branch by @mafredri in coder/websocket#471

Replace filepath.Match with path.Match by @KianYang-Lee in coder/websocket#452

internal/bpool: add New function by @bestgopher in coder/websocket#465

accept: Add unwrapping for hijack like http.ResponseController by @mafredri in coder/websocket#472

... (truncated)

Commits

9c8faad conn: skip timeout callbacks for background contexts (#566)
7039364 avoid per-frame cleanup closures on read to remove 2 allocs per frame read (#...
d099e16 docs: fix roadmap links (#558)
c98e9dc docs: fix lint issue (#557)
39b7b07 docs: remove mention of resolved issue in README (#556)
9f473ad docs: add document for AI agents (AGENTS.md) (#547)
8d3545a fix: transmit in single frame when compression enabled (#552)
8bf6dd2 chore: fix typo in Accept function (#544)
7d7c644 refactor: add ErrMessageTooBig sentinel error for limited reads (#535)
c7846ea refactor: use context.AfterFunc to track timeouts instead of goroutine (#532)
Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in go-chi/chi#1110

Tidy build directives by @JRaspass in go-chi/chi#1113

feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in go-chi/chi#1127

Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in go-chi/chi#1050

middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in go-chi/chi#1131

feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in go-chi/chi#1132

ci: pin GitHub Actions to full commit SHAs by @XananasX7 in go-chi/chi#1116

New Contributors

@DucMinhNe made their first contribution in go-chi/chi#1110

@doganarif made their first contribution in go-chi/chi#1050

@XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits

8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
3b50c7c Tidy build directives (#1113)
2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
See full diff in compare view

Updates github.com/labstack/echo/v4 from 4.12.0 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))
v4.15.3 - 2026-06-14

... (truncated)

Commits

ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
2714c07 Changelog for v4.15.4 - security fix
13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
d16a4ec backport PR 3016 from v4
8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
11a3cc4 Update dependencies and add ignore for linting
26bd016 Update CI action versions
aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
Additional commits viewable in compare view

Updates github.com/gofiber/fiber/v2 from 2.52.13 to 2.52.14

Release notes

Sourced from github.com/gofiber/fiber/v2's releases.

v2.52.14

What's Changed

🐛 Bug Fixes

backport BalancerForward X-Real-IP overwrite fix to v2 by @terraincognita07 in gofiber/fiber#4495

New Contributors

@terraincognita07 made their first contribution

Full Changelog: gofiber/fiber@v2.52.13...v2.52.14

Commits

…pdates Bumps the go-deps group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.47` | `1.14.48` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.53.0` | `0.54.0` | | [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.10.0` | `1.12.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.81.1` | `1.82.1` | | [github.com/coder/websocket](https://github.com/coder/websocket) | `1.8.12` | `1.8.15` | | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.0` | `5.3.1` | | [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.12.0` | `4.15.4` | | [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber) | `2.52.13` | `2.52.14` | Updates `github.com/mattn/go-sqlite3` from 1.14.47 to 1.14.48 - [Release notes](https://github.com/mattn/go-sqlite3/releases) - [Commits](mattn/go-sqlite3@v1.14.47...v1.14.48) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `github.com/gin-gonic/gin` from 1.10.0 to 1.12.0 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.10.0...v1.12.0) Updates `google.golang.org/grpc` from 1.81.1 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.81.1...v1.82.1) Updates `github.com/coder/websocket` from 1.8.12 to 1.8.15 - [Release notes](https://github.com/coder/websocket/releases) - [Commits](coder/websocket@v1.8.12...v1.8.15) Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.1 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.3.0...v5.3.1) Updates `github.com/labstack/echo/v4` from 4.12.0 to 4.15.4 - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/v4.15.4/CHANGELOG.md) - [Commits](labstack/echo@v4.12.0...v4.15.4) Updates `github.com/gofiber/fiber/v2` from 2.52.13 to 2.52.14 - [Release notes](https://github.com/gofiber/fiber/releases) - [Commits](gofiber/fiber@v2.52.13...v2.52.14) --- updated-dependencies: - dependency-name: github.com/mattn/go-sqlite3 dependency-version: 1.14.48 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/gin-gonic/gin dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/coder/websocket dependency-version: 1.8.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.15.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/gofiber/fiber/v2 dependency-version: 2.52.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps)(deps): bump the go-deps group across 1 directory with 8 updates#35

chore(deps)(deps): bump the go-deps group across 1 directory with 8 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-0c9ec5ac7b

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026

1.14.48

What's Changed

v1.12.0

Changelog

Features

Bug fixes

Enhancements

Refactor

Build process updates

Gin v1.12.0

Features

Enhancements

Bug Fixes

Build process updates / CI

Gin v1.11.0

Release 1.82.1

Security

Release 1.82.0

Behavior Changes

New Features

Bug Fixes

v1.8.15

Changes

New Contributors

v1.8.14

Changes

New Contributors

v1.8.13

Changes

v5.3.1

What's Changed

New Contributors

v4.15.4

v4.15.4 - 2026-06-15

v4.15.3 - 2026-06-14

v2.52.14

What's Changed

🐛 Bug Fixes

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants