Skip to content

chore: bump github.com/labstack/echo/v4 from 4.16.1 to 4.16.2 - #337

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/labstack/echo/v4-4.16.2
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/labstack/echo/v4-4.16.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/labstack/echo/v4 from 4.16.1 to 4.16.2.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.2

Fixes

  • Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
  • Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
  • Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

Commits
  • 679c415 chore: prepare v4.16.2 release (#3191)
  • 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
  • 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
  • ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/labstack/echo/v4](https://github.com/labstack/echo) from 4.16.1 to 4.16.2.
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.16.1...v4.16.2)

---
updated-dependencies:
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area/ci type/chore Tooling, CI, release plumbing labels Oct 31, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 31, 2026 23:03
@github-actions
github-actions Bot enabled auto-merge (squash) October 31, 2026 23:04
@github-actions

Copy link
Copy Markdown
Contributor

Thanks for your first pull request. CI will run shortly. Please use a Conventional Commits title (feat:, fix:, docs:, ...) because the release notes are generated from it.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecov Bot commented Oct 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot @github

dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #342.

@dependabot dependabot Bot closed this Nov 1, 2026
auto-merge was automatically disabled November 1, 2026 04:45

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/labstack/echo/v4-4.16.2 branch November 1, 2026 04:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci type/chore Tooling, CI, release plumbing

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants