Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

chore: bump github.com/labstack/echo/v4 from 4.12.0 to 4.13.0 #2771

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 9, 2024

Bumps github.com/labstack/echo/v4 from 4.12.0 to 4.13.0.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

JWT Middleware Removed

BREAKING CHANGE: JWT Middleware Removed from Core

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository or see alternative implementation

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

New Contributors

Full Changelog: labstack/echo@v4.12.0...v4.13.0

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.13.0 - 2024-12-04

BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

Commits
  • 3b01785 Changelog for 4.13.0 (#2712)
  • fe26277 remove jwt middleware
  • 9e73691 Shorten Github issue template and add test example
  • 118c163 CORS middleware should compile allowOrigin regexp at creation.
  • a973e3b add unit-test
  • c4410fe fix(bind body): content-length can be -1
  • 5d98929 Remove broken header
  • 5a0b4dd clean up field assignments with default values to make test configuration mor...
  • 03c0236 refactor basic_auth_test to utilize table driven tests
  • 822d11a Add TemplateRenderer struct to ease creating renderers for html/template an...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added automerge dependencies Pull requests that update a dependency file labels Dec 9, 2024
Copy link

netlify bot commented Dec 9, 2024

Deploy Preview for go-feature-flag-doc-preview canceled.

Name Link
🔨 Latest commit 541bd3b
🔍 Latest deploy log https://app.netlify.com/sites/go-feature-flag-doc-preview/deploys/675652a3571fe7000892d267

Copy link

codecov bot commented Dec 9, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.87%. Comparing base (11b162b) to head (541bd3b).
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2771   +/-   ##
=======================================
  Coverage   84.87%   84.87%           
=======================================
  Files         111      111           
  Lines        5178     5178           
=======================================
  Hits         4395     4395           
  Misses        620      620           
  Partials      163      163           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/labstack/echo/v4-4.13.0 branch 2 times, most recently from 206855f to e4aa2e0 Compare December 9, 2024 01:51
Bumps [github.com/labstack/echo/v4](https://github.com/labstack/echo) from 4.12.0 to 4.13.0.
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.12.0...v4.13.0)

---
updated-dependencies:
- dependency-name: github.com/labstack/echo/v4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/labstack/echo/v4-4.13.0 branch from e4aa2e0 to 7755ee8 Compare December 9, 2024 02:03
Copy link

sonarqubecloud bot commented Dec 9, 2024

@kodiakhq kodiakhq bot merged commit 3986405 into main Dec 9, 2024
24 checks passed
@kodiakhq kodiakhq bot deleted the dependabot/go_modules/github.com/labstack/echo/v4-4.13.0 branch December 9, 2024 02:32
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
automerge dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant