[dependabot]

Bumps github.com/labstack/echo/v5 from 5.4.0 to 5.4.2.

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.2

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3135, thanks to @​hoangtaiki.

Upgrade

go get github.com/labstack/echo/v5@v5.4.2

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.

The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.

Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.

Full changelog: labstack/echo@v5.4.1...v5.4.2

v5.4.1

Security fixes

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

Behavior to review when upgrading

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

Other changes

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @​rm-Umar, @​Duodum, @​irisitymichaelgrundberg, @​Hama1cco, @​jakezwang, @​Shubham-Padkonde and @​rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: labstack/echo@v5.4.0...v5.4.1

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

Changelog

Commits

• 7c312e0 chore: prepare v5.4.2 release (#3190)
• f9d7e77 fix(middleware): reject empty tokens in CSRF validation (#3135)
• 0996992 fix: check Basic authentication scheme boundary (#3138)
• a6a9673 chore: prepare v5.4.1 security release (#3185)
• 1855061 Merge commit from fork
• 8fd0e18 feat(context): add ValidateCtx (#3152)
• 3882266 docs: move support terms to .github/SUPPORT.md (#3165)
• 1836fed docs: refresh README badges (#3164)
• f098cb2 docs: add Support sponsorship terms (#3163)
• 199f7d8 docs: add Used by section, ADOPTERS.md and tidy README (#3161)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Thank you for contributing to this project! 😊🕹️

[retr0h]

@dependabot rebase