Skip to content

deps: bump the go-modules group across 1 directory with 6 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-cec48cb43d
Open

deps: bump the go-modules group across 1 directory with 6 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-cec48cb43d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the go-modules group with 6 updates in the / directory:

Package From To
github.com/getkin/kin-openapi 0.144.0 0.145.0
github.com/goccy/go-json 0.10.2 0.10.6
github.com/labstack/echo/v4 4.12.0 4.15.4
github.com/rs/zerolog 1.34.0 1.35.1
github.com/spf13/viper 1.20.1 1.21.0
k8s.io/apimachinery 0.34.0 0.36.3

Updates github.com/getkin/kin-openapi from 0.144.0 to 0.145.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.145.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.144.0...v0.145.0

Commits
  • 88aa64c Merge commit from fork
  • f1a5b52 Merge commit from fork
  • 27bc028 openapi3: stop InternalizeRefs panicking on unresolved discriminator mappings...
  • See full diff in compare view

Updates github.com/goccy/go-json from 0.10.2 to 0.10.6

Release notes

Sourced from github.com/goccy/go-json's releases.

0.10.6

What's Changed

New Contributors

Full Changelog: goccy/go-json@v0.10.5...v0.10.6

0.10.5

What's Changed

New Contributors

Full Changelog: goccy/go-json@v0.10.4...v0.10.5

0.10.4

What's Changed

New Contributors

Full Changelog: goccy/go-json@v0.10.3...v0.10.4

0.10.3

What's Changed

New Contributors

Full Changelog: goccy/go-json@v0.10.2...v0.10.3

Commits

Updates github.com/labstack/echo/v4 from 4.12.0 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

v4.15.3 - 2026-06-14

... (truncated)

Commits
  • ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
  • 2714c07 Changelog for v4.15.4 - security fix
  • 13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
  • d16a4ec backport PR 3016 from v4
  • 8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
  • 9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
  • 1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
  • 11a3cc4 Update dependencies and add ignore for linting
  • 26bd016 Update CI action versions
  • aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
  • Additional commits viewable in compare view

Updates github.com/rs/zerolog from 1.34.0 to 1.35.1

Commits
  • 116c806 event: restore Err() logging when ErrorStackMarshaler returns nil (#763)
  • 1396655 Bump CI Go matrix minimum from 1.21 to 1.23
  • 4b65a2f Bump actions/cache from 4 to 5 (#741)
  • b835796 Bump actions/setup-go from 5 to 6 (#742)
  • 134caf8 Added sanitization of journald keys (#751)
  • e133b6a Added variadic StrsV, ObjectsV, and StringersV (#752)
  • 82017d8 Bump github.com/coreos/go-systemd/v22 from 22.6.0 to 22.7.0 (#753)
  • 2f5b8a9 fix: UpdateContext skips Nop and zero-value loggers (#754)
  • d64c9a7 Add slog.Handler implementation for zerolog (#755)
  • a0d61dc fix: return dict to Event pool (#749)
  • Additional commits viewable in compare view

Updates github.com/spf13/viper from 1.20.1 to 1.21.0

Release notes

Sourced from github.com/spf13/viper's releases.

v1.21.0

What's Changed

Enhancements 🚀

Bug Fixes 🐛

Dependency Updates ⬆️

Other Changes

New Contributors

Full Changelog: spf13/viper@v1.20.0...v1.21.0

Commits
  • 394040c ci: build on go 1.25
  • 812f548 chore: update dependencies
  • d5271ef ci: update stale workflow
  • dff303b feat: add a stale issue scheduled action
  • 1287976 build(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10
  • 38932cd build(deps): bump github.com/go-viper/mapstructure/v2 in /remote
  • 6d014be build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1
  • b74c7ee build(deps): bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0
  • acd05e1 fix: linting issues
  • ae5a8e2 ci: upgrade golangci-lint
  • Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.34.0 to 0.36.3

Commits
  • 40bf4b2 Update dependencies to v0.36.3 tag
  • 34d46be Merge pull request #140296 from jpbetz/cherry-pick-smd-306-revert
  • 66a3724 Bump sigs.k8s.io/structured-merge-diff/v6 to v6.3.3
  • 2ec982d Merge pull request #139508lalitc375/automated-cherry-pick-of-#139480
  • 6a88102 Fix wrong marking of errors
  • efb7f26 Merge remote-tracking branch 'origin/master' into release-1.36
  • d966e56 Update github.com/moby/spdystream from v0.5.0 to v0.5.1
  • 79b3632 Merge pull request #137864 from yongruilin/dv-dra-mismatch
  • a8822f7 Add slice and map union member support with tests
  • 7dba2d0 Use IsZero instead of IsNil for union ratcheting check
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 28, 2026
@dependabot dependabot Bot changed the title deps: bump the go-modules group with 6 updates deps: bump the go-modules group across 1 directory with 6 updates Jul 30, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-modules-cec48cb43d branch 2 times, most recently from fd49130 to bea9c8b Compare July 30, 2026 18:52
@dependabot
deps: bump the go-modules group across 1 directory with 6 updates
c6633b8 
Bumps the go-modules group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) | `0.144.0` | `0.145.0` |
| [github.com/goccy/go-json](https://github.com/goccy/go-json) | `0.10.2` | `0.10.6` |
| [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.12.0` | `4.15.4` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.34.0` | `1.35.1` |
| [github.com/spf13/viper](https://github.com/spf13/viper) | `1.20.1` | `1.21.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.34.0` | `0.36.3` |



Updates `github.com/getkin/kin-openapi` from 0.144.0 to 0.145.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.144.0...v0.145.0)

Updates `github.com/goccy/go-json` from 0.10.2 to 0.10.6
- [Release notes](https://github.com/goccy/go-json/releases)
- [Changelog](https://github.com/goccy/go-json/blob/master/CHANGELOG.md)
- [Commits](goccy/go-json@v0.10.2...v0.10.6)

Updates `github.com/labstack/echo/v4` from 4.12.0 to 4.15.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/v4.15.4/CHANGELOG.md)
- [Commits](labstack/echo@v4.12.0...v4.15.4)

Updates `github.com/rs/zerolog` from 1.34.0 to 1.35.1
- [Commits](rs/zerolog@v1.34.0...v1.35.1)

Updates `github.com/spf13/viper` from 1.20.1 to 1.21.0
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](spf13/viper@v1.20.1...v1.21.0)

Updates `k8s.io/apimachinery` from 0.34.0 to 0.36.3
- [Commits](kubernetes/apimachinery@v0.34.0...v0.36.3)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.145.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/goccy/go-json
  dependency-version: 0.10.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.15.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/rs/zerolog
  dependency-version: 1.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/spf13/viper
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-modules-cec48cb43d branch from bea9c8b to c6633b8 Compare August 1, 2026 00:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants