Skip to content

chore(deps): bump the go-dependencies group across 5 directories with 5 updates - #14

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/client/go-dependencies-87f66de4a2
Closed

chore(deps): bump the go-dependencies group across 5 directories with 5 updates#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/client/go-dependencies-87f66de4a2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 2 updates in the /client directory: connectrpc.com/connect and golang.org/x/net.
Bumps the go-dependencies group with 1 update in the /client/chi directory: github.com/go-chi/chi/v5.
Bumps the go-dependencies group with 1 update in the /client/echo directory: github.com/labstack/echo/v4.
Bumps the go-dependencies group with 2 updates in the /proto directory: connectrpc.com/connect and github.com/klauspost/compress.
Bumps the go-dependencies group with 1 update in the /server directory: connectrpc.com/connect.

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits
  • c4ad2c4 Prepare for v1.21.1 (#1027)
  • ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
  • a58596c Enforce read max limit on unary errors (#1022)
  • b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
  • abe4c95 Guard against typed nil *connect.Error (#1020)
  • 6a8459c Return the end-stream error when the body read fails after it (#1014)
  • 128a9d9 Improve http2 client disconnect error handling (#1019)
  • 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
  • 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
  • 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.60.0 to 0.61.0

Commits
  • c1d31df go.mod: update golang.org/x dependencies
  • 8456a20 quic: properly check for allowed frame types in a packet
  • See full diff in compare view

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits
  • c4ad2c4 Prepare for v1.21.1 (#1027)
  • ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
  • a58596c Enforce read max limit on unary errors (#1022)
  • b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
  • abe4c95 Guard against typed nil *connect.Error (#1020)
  • 6a8459c Return the end-stream error when the body read fails after it (#1014)
  • 128a9d9 Improve http2 client disconnect error handling (#1019)
  • 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
  • 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
  • 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
  • Additional commits viewable in compare view

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits
  • c4ad2c4 Prepare for v1.21.1 (#1027)
  • ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
  • a58596c Enforce read max limit on unary errors (#1022)
  • b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
  • abe4c95 Guard against typed nil *connect.Error (#1020)
  • 6a8459c Return the end-stream error when the body read fails after it (#1014)
  • 128a9d9 Improve http2 client disconnect error handling (#1019)
  • 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
  • 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
  • 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
  • Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.5.0

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

Commits
  • 3a33ba5 middleware: SupressNotFound must not mutate the request's route context (#1220)
  • 6075570 middleware: parse quoted ContentCharset media parameters (#1218)
  • 46295d0 middleware: test Retry-After rounding in one table test (#1217)
  • c6e33a1 middleware: build Maybe handler once (#1197)
  • c9744a3 middleware: test ClientIPFromHeader does not fall back to other headers (#1208)
  • fff8bb2 middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only (#1195)
  • 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
  • 167e1e3 README: point middleware doc links to chi/v5 (#1196)
  • 3d1777a middleware: honor Discard when flushing (#1185)
  • b1c9ab4 middleware: record response status when flushing (#1174)
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.16.0 to 4.16.2

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.2

Fixes

  • Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
  • Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
  • Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

  • Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
  • Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
  • Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
  • Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
  • Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
  • Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

... (truncated)

Commits
  • 679c415 chore: prepare v4.16.2 release (#3191)
  • 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
  • 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
  • ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
  • 600b985 chore: prepare v4.16.1 security release (#3186)
  • 3fb0ba7 Merge commit from fork
  • be08005 fix(router): grow param values for contexts created before a route with more ...
  • 320fe67 fix(bind): honor OpenAPI date, date-time and date-time-local format tags (v4)...
  • f085ffb fix(router): handle escaped colons and inline verbs in v4 (#3132)
  • 5440f99 fix(middleware): prevent BodyLimit bypass in v4 (#3131)
  • Additional commits viewable in compare view

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits
  • c4ad2c4 Prepare for v1.21.1 (#1027)
  • ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
  • a58596c Enforce read max limit on unary errors (#1022)
  • b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
  • abe4c95 Guard against typed nil *connect.Error (#1020)
  • 6a8459c Return the end-stream error when the body read fails after it (#1014)
  • 128a9d9 Improve http2 client disconnect error handling (#1019)
  • 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
  • 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
  • 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
  • Additional commits viewable in compare view

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits
  • c4ad2c4 Prepare for v1.21.1 (#1027)
  • ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
  • a58596c Enforce read max limit on unary errors (#1022)
  • b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
  • abe4c95 Guard against typed nil *connect.Error (#1020)
  • 6a8459c Return the end-stream error when the body read fails after it (#1014)
  • 128a9d9 Improve http2 client disconnect error handling (#1019)
  • 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
  • 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
  • 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
  • Additional commits viewable in compare view

Updates github.com/klauspost/compress from 1.20.1 to 1.20.3

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.3

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.20.1...v1.20.3

v1.20.2

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

Commits
  • b946d41 Revert #1255 (#1261)
  • 748550b Merge commit from fork
  • dd54d86 huff0: reuse Scratch across inputs in the fuzzers (#1257)
  • d189b4c gzhttp: do not compress 206 responses without Content-Range, read Accept-Enco...
  • 6b91995 zstd, huff0: keep the encoder bit writers in registers (#1245)
  • 402c3a5 s2: Reject short index chunk in RemoveIndexHeaders (#1254)
  • 29f5f81 build(deps): bump the github-actions group with 4 updates (#1252)
  • 9b8ba61 dict: Stricter input validation (#1250)
  • da4df9c zstd: decode at full speed into exact-size destinations (#1246)
  • 1971eec reject zip entries named "." in ReadDir (#1249)
  • Additional commits viewable in compare view

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits
  • c4ad2c4 Prepare for v1.21.1 (#1027)
  • ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
  • a58596c Enforce read max limit on unary errors (#1022)
  • b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
  • abe4c95 Guard against typed nil *connect.Error (#1020)
  • 6a8459c Return the end-stream error when the body read fails after it (#1014)
  • 128a9d9 Improve http2 client disconnect error handling (#1019)
  • 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
  • 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
  • 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
  • Additional commits viewable in compare view

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

@dependabot
chore(deps): bump the go-dependencies group across 5 directories with…
3556592 
… 5 updates

Bumps the go-dependencies group with 2 updates in the /client directory: [connectrpc.com/connect](https://github.com/connectrpc/connect-go) and [golang.org/x/net](https://github.com/golang/net).
Bumps the go-dependencies group with 1 update in the /client/chi directory: [github.com/go-chi/chi/v5](https://github.com/go-chi/chi).
Bumps the go-dependencies group with 1 update in the /client/echo directory: [github.com/labstack/echo/v4](https://github.com/labstack/echo).
Bumps the go-dependencies group with 2 updates in the /proto directory: [connectrpc.com/connect](https://github.com/connectrpc/connect-go) and [github.com/klauspost/compress](https://github.com/klauspost/compress).
Bumps the go-dependencies group with 1 update in the /server directory: [connectrpc.com/connect](https://github.com/connectrpc/connect-go).


Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `golang.org/x/net` from 0.60.0 to 0.61.0
- [Commits](golang/net@v0.60.0...v0.61.0)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `github.com/go-chi/chi/v5` from 5.3.2 to 5.5.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.2...v5.5.0)

Updates `github.com/labstack/echo/v4` from 4.16.0 to 4.16.2
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.16.0...v4.16.2)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `github.com/klauspost/compress` from 1.20.1 to 1.20.3
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.20.1...v1.20.3)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

Updates `connectrpc.com/connect` from 1.21.0 to 1.21.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.21.0...v1.21.1)

---
updated-dependencies:
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: connectrpc.com/connect
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from arhuman as a code owner October 26, 2026 02:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 26, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 26, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/client/go-dependencies-87f66de4a2 branch November 2, 2026 02:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arhuman arhuman Awaiting requested review from arhuman arhuman is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants