chore(deps): bump github.com/labstack/echo/v4 from 4.13.4 to 4.15.1

[dependabot]

Bumps github.com/labstack/echo/v4 from 4.13.4 to 4.15.1.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.0

Security

WARNING: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship between the request origin and the target. The middleware uses this to make security decisions:

• same-origin or none: Requests are allowed (exact origin match or direct user navigation)
• same-site: Falls back to token validation (e.g., subdomain to main domain)
• cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to traditional token-based CSRF protection.

New Configuration Options:

• TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)
• AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

Example:

e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    // Allow OAuth callbacks from trusted provider
    TrustedOrigins: []string{"https://oauth-provider.com"},
// Custom validation for same-site requests
AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
    // Your custom authorization logic here
    return validateCustomAuth(c), nil
    // return true, err  // blocks request with error
    // return true, nil  // allows CSRF request through
    // return false, nil // falls back to legacy token logic
},

}))

PR: labstack/echo#2858

Type-Safe Generic Parameter Binding

• Added generic functions for type-safe parameter extraction and context access by @​aldas in labstack/echo#2856

  Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion, eliminating manual string parsing and type assertions.

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

Changelog

v5.0.4 - 2026-02-15

Enhancements

• Remove unused import 'errors' from README example by @​kumapower17 in labstack/echo#2889
• Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @​aldas in labstack/echo#2898
• Update location of oapi-codegen in README by @​mromaszewicz in labstack/echo#2896
• Add Go 1.26 to CI flow by @​aldas in labstack/echo#2899
• Add new function echo.StatusCode by @​suwakei in labstack/echo#2892
• CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in labstack/echo#2894
• Add echo.ResolveResponseStatus function to help middleware/handlers determine HTTP status code and echo.Response by @​aldas in labstack/echo#2900

v5.0.3 - 2026-02-06

Security

• Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @​shblue21.

This applies to cases when:

• Windows is used as OS
• middleware.StaticConfig.Filesystem is nil (default)
• echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

v5.0.2 - 2026-02-02

Security

• Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in labstack/echo#2887

v5.0.1 - 2026-01-28

• Panic MW: will now return a custom PanicStackError with stack trace by @​aldas in labstack/echo#2871
• Docs: add missing err parameter to DenyHandler example by @​cgalibern in labstack/echo#2878
• improve: improve websocket checks in IsWebSocket() [per RFC 6455] by @​raju-mechatronics in labstack/echo#2875
• fix: Context.Json() should not send status code before serialization is complete by @​aldas in labstack/echo#2877

v5.0.0 - 2026-01-18

Echo v5 is maintenance release with major breaking changes

• Context is now struct instead of interface and we can add method to it in the future in minor versions.
• Adds new Router interface for possible new routing implementations.
• Drops old logging interface and uses moderm log/slog instead.

... (truncated)

Commits

• 6f3a84a Merge pull request #2905 from aldas/v4_crsf_token_fallback
• 24fa4d0 CSRF: support older token-based CSRF protection handler that want to render t...
• 482bb46 v4.15.0 changelog
• d0f9d1e CRSF with Sec-Fetch-Site=same-site falls back to legacy token
• f3fc618 CRSF with Sec-Fetch-Site checks
• 4dcb9b4 licence headers
• cbc0ac1 Add PathParam(Or)/QueryParam(Or)/FormParam(Or) generic functions
• 6b14f4e Add Context.Get generic functions
• 321530d disable test - returns different error under Windows
• c8abd9f disable flaky test
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	4		0	0	0.04s
✅ API	spectral	2		0	0	2.53s
✅ COPYPASTE	jscpd	yes		no	no	1.99s
✅ DOCKERFILE	hadolint	1		0	0	0.08s
❌ GO	golangci-lint	yes	yes	1	no	53.34s
✅ GO	revive	yes		no	no	1.63s
✅ MARKDOWN	markdownlint	2	0	0	0	0.77s
✅ MARKDOWN	markdown-table-formatter	2	0	0	0	0.28s
✅ REPOSITORY	checkov	yes		no	no	40.27s
✅ REPOSITORY	gitleaks	yes		no	no	0.49s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
✅ REPOSITORY	grype	yes		no	no	61.85s
✅ REPOSITORY	secretlint	yes		no	no	0.74s
✅ REPOSITORY	syft	yes		no	no	3.47s
✅ REPOSITORY	trivy	yes		no	no	22.21s
✅ REPOSITORY	trivy-sbom	yes		no	no	2.78s
✅ REPOSITORY	trufflehog	yes		no	no	4.76s
✅ SPELL	lychee	12		0	0	0.15s
✅ YAML	prettier	10	0	0	0	0.81s
✅ YAML	v8r	10		0	0	11.35s
✅ YAML	yamllint	10		0	0	0.79s

Detailed Issues

❌ GO / golangci-lint - 1 error

level=info msg="golangci-lint has version 2.10.1 built with go1.26.0 from 5d1e709b on 2026-02-17T15:27:33Z"
level=info msg="[config_reader] Used config file ../../action/lib/.automation/.golangci.yml"
level=info msg="[config_reader] Module name \"github.com/atlascloud/packages\""
level=info msg="[goenv] Read go env for 6.488297ms: map[string]string{\"GOCACHE\":\"/github/home/.cache/go-build\", \"GOROOT\":\"/usr/lib/go\"}"
level=info msg="[lintersdb] Active 6 linters: [gocritic gofmt govet ineffassign staticcheck unused]"
level=info msg="[loader] Go packages loading at mode 8767 (deps|exports_file|name|compiled_files|files|imports|types_sizes) took 38.593799059s"
level=info msg="[runner/filename_unadjuster] Pre-built 0 adjustments in 6.050053ms"
level=info msg="[linters_context/goanalysis] analyzers took 36.443981058s with top 10 stages: buildir: 30.449104234s, printf: 1.523018658s, inspect: 751.669376ms, fact_purity: 682.274333ms, fact_deprecated: 461.920068ms, ctrlflow: 453.855389ms, nilness: 434.104276ms, SA5012: 378.124975ms, typedness: 327.363989ms, unused: 155.260629ms"
level=info msg="[runner] Applying suggested fixes"
level=info msg="[runner] fixer took 1.704µs with stages: all: 1.704µs"
level=info msg="[runner/exclusion_paths] Skipped 0 issues by pattern \"third_party$\""
level=info msg="[runner/exclusion_paths] Skipped 0 issues by pattern \"builtin$\""
level=info msg="[runner/exclusion_paths] Skipped 0 issues by pattern \"examples$\""
level=info msg="[runner/exclusion_rules] Skipped 0 issues by rules: [Path: \"third_party$\", Linters: \"gofmt\"]"
level=info msg="[runner/exclusion_rules] Skipped 0 issues by rules: [Path: \"builtin$\", Linters: \"gofmt\"]"
level=info msg="[runner/exclusion_rules] Skipped 0 issues by rules: [Path: \"examples$\", Linters: \"gofmt\"]"
level=info msg="[runner] Issues before processing: 2, after processing: 1"
level=info msg="[runner] Processors filtering stat (in/out): source_code: 1/1, path_shortener: 1/1, cgo: 2/2, exclusion_rules: 1/1, max_per_file_from_linter: 1/1, severity-rules: 1/1, sort_results: 1/1, diff: 1/1, fixer: 1/1, uniq_by_line: 1/1, path_prettifier: 1/1, path_absoluter: 2/2, generated_file_filter: 2/1, nolint_filter: 1/1, max_same_issues: 1/1, filename_unadjuster: 2/2, invalid_issue: 2/2, path_relativity: 2/2, exclusion_paths: 2/2, max_from_linter: 1/1"
level=info msg="[runner] processing took 601.673µs with stages: nolint_filter: 256.038µs, generated_file_filter: 101.58µs, exclusion_rules: 79.088µs, exclusion_paths: 60.954µs, fixer: 47.448µs, source_code: 37.48µs, path_relativity: 5.73µs, uniq_by_line: 2.666µs, max_same_issues: 2.204µs, sort_results: 1.903µs, path_absoluter: 1.282µs, path_shortener: 1.031µs, cgo: 843ns, invalid_issue: 812ns, max_from_linter: 791ns, filename_unadjuster: 581ns, path_prettifier: 381ns, max_per_file_from_linter: 320ns, diff: 310ns, severity-rules: 231ns"
level=info msg="[runner] linters took 14.227801771s with stages: goanalysis_metalinter: 14.227069835s"
../../..cmd/api/main.go:49:8: SA1019: middleware.Logger is deprecated: please use middleware.RequestLogger or middleware.RequestLoggerWithConfig instead. (staticcheck)
	e.Use(middleware.Logger())
	      ^
1 issues:
* staticcheck: 1
level=info msg="File cache stats: 1 entries of total size 2.8KiB"
level=info msg="Memory: 527 samples, avg is 141.2MB, max is 563.5MB"
level=info msg="Execution took 52.835147943s"

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,API_SPECTRAL,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,GO_GOLANGCI_LINT,GO_REVIVE,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

[dependabot]

Looks like github.com/labstack/echo/v4 is up-to-date now, so this is no longer needed.