[dependabot]

Bumps the gomod group with 2 updates: github.com/go-playground/validator/v10 and github.com/labstack/echo/v4.

Updates github.com/go-playground/validator/v10 from 10.30.5 to 10.30.6

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.6

What's Changed

• fix: update the KR and IL postcode patterns to the current national formats by @​yu2971512385-ui in go-playground/validator#1644
• fix: accept Taiwan six-digit postcodes by @​sb123sb123 in go-playground/validator#1642
• docs: use the registered fieldcontains tag in usage example by @​lazerg in go-playground/validator#1635
• fix: fully anchor Costa Rica postcode regex by @​sb123sb123 in go-playground/validator#1648
• feat: add duration validator for time.ParseDuration strings by @​ahmedkamalio in go-playground/validator#1649
• chore(deps): bump github.com/go-playground/universal-translator from 0.18.1 to 0.18.2 by @​dependabot[bot] in go-playground/validator#1653
• feat: Add hostname label validation tag by @​KytnaCode in go-playground/validator#1616
• chore(deps): bump github.com/go-playground/locales from 0.14.1 to 0.14.2 by @​dependabot[bot] in go-playground/validator#1663
• Align excluded_without with its stated multi-field contract by @​dylanpulver in go-playground/validator#1621
• fix: accept Nigeria's 11-character postcodes by @​Adeniyikayodee in go-playground/validator#1664
• chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @​dependabot[bot] in go-playground/validator#1670
• ci: send coverage from the Go 1.26.x leg (step skipped since #1535) by @​glaziermag in go-playground/validator#1671
• Clarify separators for non-existent directory paths by @​yuefdev in go-playground/validator#1672
• Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (Israel) by @​JohannesHepp in go-playground/validator#1629
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 by @​dependabot[bot] in go-playground/validator#1680
• docs: fix stale alias, uuid and snippet details in package docs by @​yxshee in go-playground/validator#1679
• fix: anchor GB and LI postcode patterns as a whole by @​beduldul in go-playground/validator#1646
• fix: reject ULIDs outside the 128-bit range by @​sergioperezcheco in go-playground/validator#1660
• fix: reject duplicate variants in strict BCP47 tags by @​guocn in go-playground/validator#1678
• Convert to time.Time before asserting in isNeField by @​youdie006 in go-playground/validator#1619
• Add uuid7 validation tag by @​ChrisJr404 in go-playground/validator#1614

New Contributors

• @​yu2971512385-ui made their first contribution in go-playground/validator#1644
• @​sb123sb123 made their first contribution in go-playground/validator#1642
• @​lazerg made their first contribution in go-playground/validator#1635
• @​KytnaCode made their first contribution in go-playground/validator#1616
• @​dylanpulver made their first contribution in go-playground/validator#1621
• @​Adeniyikayodee made their first contribution in go-playground/validator#1664
• @​glaziermag made their first contribution in go-playground/validator#1671
• @​yuefdev made their first contribution in go-playground/validator#1672
• @​JohannesHepp made their first contribution in go-playground/validator#1629
• @​yxshee made their first contribution in go-playground/validator#1679
• @​beduldul made their first contribution in go-playground/validator#1646
• @​sergioperezcheco made their first contribution in go-playground/validator#1660
• @​guocn made their first contribution in go-playground/validator#1678
• @​youdie006 made their first contribution in go-playground/validator#1619
• @​ChrisJr404 made their first contribution in go-playground/validator#1614

Full Changelog: go-playground/validator@v10.30.5...v10.30.6

Commits

• 19397f2 Add uuid7 validation tag (#1614)
• 5b09d8d Convert to time.Time before asserting in isNeField (#1619)
• 563e738 fix: reject duplicate variants in strict BCP47 tags (#1678)
• 0f885d2 fix: reject ULIDs outside the 128-bit range (#1660)
• c9cfe75 fix: anchor GB and LI postcode patterns as a whole (#1646)
• 29d05a7 docs: fix stale alias, uuid and snippet details in package docs (#1679)
• 0411012 chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 (#...
• a5843c6 Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (...
• c29fac1 Clarify separators for non-existent directory paths (#1672)
• 3b54840 ci: send coverage from the Go 1.26.x leg (step skipped since #1535) (#1671)
• Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.16.2 to 4.16.3

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.3

Security and migration

Applications behind proxies must configure Echo#IPExtractor to trust their own proxies before upgrading. Without an extractor, clients behind one proxy share its address for rate limiting, IP-based access controls, logging, and proxy forwarding. The safe default now ignores client-supplied IP headers.

This release fixes the remaining v4 exposure for:

• CVE-2026-118651: Proxy always derives upstream X-Real-IP from Context.RealIP(), including after hop-by-hop header stripping and on WebSocket upgrades. One derived identity is preserved across retries.
• CVE-2026-118653: Context.RealIP() uses the connection peer when IPExtractor is unset, so rotating spoofed forwarded-IP headers cannot create fresh default rate-limit buckets.

Use echo.ExtractIPDirect() without a proxy. Behind a proxy, use ExtractIPFromXFFHeader or ExtractIPFromRealIPHeader with trust restricted to your proxies. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Migration example with explicit proxy trust ranges

Other changes

• Resolve bare IPv4 and IPv6 connection addresses without a port.
• Document v4 support dates (#3194).

No dependency or minimum Go-version changes; Go 1.26 or later remains required.

The security fix (#3197) passed independent agent and Claude reviews, full race tests on Go 1.26 and 1.27, and GitHub Linux/macOS/Windows checks.

Full Changelog: labstack/echo@v4.16.2...v4.16.3

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.16.3 - 2026-10-29

Security

• Client IP defaults: when Echo#IPExtractor is unset, Context.RealIP() now uses the connection peer and ignores X-Forwarded-For and X-Real-IP. This prevents clients from selecting their own default rate-limit bucket. Fixes CVE-2026-118653.
• Proxy identity: Proxy middleware always replaces upstream X-Real-IP with the derived client identity, including after Connection-nominated header removal and on WebSocket upgrades. The identity is derived once and preserved across retries. Fixes CVE-2026-118651.

Migration required for applications behind proxies

Configure Echo#IPExtractor to trust only your deployment's proxies before upgrading. Otherwise, clients behind one proxy share its address for rate limiting, access controls, logging, and proxy forwarding. See the README migration example for explicit XFF trust ranges; use the same trust options with ExtractIPFromRealIPHeader for proxies that set X-Real-IP. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Other changes

• The direct-peer fallback now accepts bare IPv4 and IPv6 addresses without a port.
• Document v4 bug-fix and security-fix support dates (#3194).

Implementation: #3197. No dependency or minimum Go-version changes; Go 1.26 or later remains required.

v4.16.0 - 2026-09-27

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

• Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. the new Echo#SchemeExtractor field selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
• JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
• MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
• Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
• Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr
• Dependencies: update golang.org/x/text to v0.40.0 (GO-2026-5970).

Client IP address (no code change in v4)

Without Echo#IPExtractor, Context.RealIP() in v4 trusts the X-Forwarded-For and X-Real-IP headers from any client, so the rate limiter can be bypassed and the Proxy middleware forwards a spoofed X-Real-IP (GHSA-246p-cpwv-v3jq, GHSA-99jh-6h7p-pp36). Changing this default in v4 would put all clients behind a proxy into one rate-limit bucket, so v4 keeps it. Set an extractor that matches your deployment:

e.IPExtractor = echo.ExtractIPDirect()        // no proxy in front of the app
e.IPExtractor = echo.ExtractIPFromXFFHeader() // behind proxies in private networks that set X-Forwarded-For
// behind a proxy with public addresses (e.g. a CDN), also trust its ranges:
// e.IPExtractor = echo.ExtractIPFromXFFHeader(echo.TrustIPRange(cdnRange))

v5 uses the direct peer address by default since v5.1.0.

Behavior changes to check before upgrading

• Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges:

  _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
  _, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
  e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))

... (truncated)

Commits

• c99c7cb chore: prepare v4.16.3 security release (#3198)
• ebbb855 fix: secure v4 client IP defaults for proxying and rate limiting (#3197)
• fa780cd docs: state v4 bug-fix and security-fix dates (#3194)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions