[dependabot]

Bumps the go group with 5 updates in the /server directory:

Package	From	To
github.com/aws/aws-sdk-go-v2	1.47.3	1.47.4
github.com/aws/aws-sdk-go-v2/credentials	1.20.9	1.20.11
github.com/aws/aws-sdk-go-v2/service/s3	1.114.3	1.114.5
github.com/labstack/echo/v5	5.4.0	5.4.2
github.com/oapi-codegen/runtime	1.7.0	1.8.0

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.11

Commits

• 9c92421 Release 2022-09-20
• 389c50b Regenerated Clients
• 834dd34 Update endpoints model
• d8d5446 Update API model
• 4c9dc4d Merge pull request #1847 from RanVaknin/documentation-update-config
• 72c90fe updated linting ignore
• 3f34bd0 added changelog statment
• 3938bb7 Release 2022-09-19
• c547650 Regenerated Clients
• 2d3bbde Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.5

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.0 to 5.4.2

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.2

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3135, thanks to @​hoangtaiki.

Upgrade

go get github.com/labstack/echo/v5@v5.4.2

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.

The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.

Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.

Full changelog: labstack/echo@v5.4.1...v5.4.2

v5.4.1

Security fixes

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

Behavior to review when upgrading

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

Other changes

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @​rm-Umar, @​Duodum, @​irisitymichaelgrundberg, @​Hama1cco, @​jakezwang, @​Shubham-Padkonde and @​rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: labstack/echo@v5.4.0...v5.4.1

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

Changelog

v5.4.4 - 2026-10-29

Proxy identity hardening

• Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
• Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
• Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

Commits

• 7c312e0 chore: prepare v5.4.2 release (#3190)
• f9d7e77 fix(middleware): reject empty tokens in CSRF validation (#3135)
• 0996992 fix: check Basic authentication scheme boundary (#3138)
• a6a9673 chore: prepare v5.4.1 security release (#3185)
• 1855061 Merge commit from fork
• 8fd0e18 feat(context): add ValidateCtx (#3152)
• 3882266 docs: move support terms to .github/SUPPORT.md (#3165)
• 1836fed docs: refresh README badges (#3164)
• f098cb2 docs: add Support sponsorship terms (#3163)
• 199f7d8 docs: add Used by section, ADOPTERS.md and tidy README (#3161)
• Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.8.0: Bind the request body value the validator saw

This release adds a request body binder that reuses the value a kin-openapi validation middleware already decoded, so strict servers no longer decode the body a second time with different matching rules. It also rounds out types.Date's text encoding and fixes a deepObject serialization quirk. Existing binding and serialization behaviour is unchanged unless generated code calls the new function. The root module's dependencies are unchanged; the separate strictmiddleware/echo-v5 module now requires Echo v5.4.2.

Notable Changes

BindJSONBody: bind exactly what the validator validated

Strict servers generated by oapi-codegen decode the JSON request body with encoding/json after a validation middleware has already decoded and validated it. The two decoders do not agree on member names: encoding/json matches struct fields case-insensitively, so a body like {"role":"user","ROLE":"admin"} validates as role: user and then binds as Role: "admin". Anything the validator checked can be bypassed by a differently-cased duplicate.

BindJSONBody(r *http.Request, v any) error closes that gap. When the request has passed through a validator built on kin-openapi v0.151.0 or later with openapi3filter.Options.KeepValidatedValue set, the body carries the value the validator decoded, and BindJSONBody binds that value into the destination with BindJSONValue(value, v any) error instead of reading the body again. Binding follows encoding/json's rules (struct tags, embedded structs, json.Unmarshaler and encoding.TextUnmarshaler, base64 for []byte, float64 for any, json.Number preserved) with one deliberate difference: member names are matched to struct fields exactly.

Without a validated value, or when the value cannot be bound into the destination type, BindJSONBody falls back to json.NewDecoder(r.Body).Decode(v), so error responses are unchanged for everyone who is not running a validator. The oapi-codegen validation middlewares enable KeepValidatedValue by default as of nethttp-middleware v1.3.1, echo-middleware v1.2.1, echo-v5-middleware v0.2.1, gin-middleware v1.2.1 and iris-middleware v1.2.1. The net/http strict server template that calls BindJSONBody is landing in oapi-codegenoapi-codegen/oapi-codegen#2605

types.Date implements encoding.TextMarshaler

Date had an UnmarshalText that parses 2006-01-02 but no MarshalText, so it inherited time.Time's RFC 3339 one. Any codec that pairs TextMarshaler with TextUnmarshaler (encoding/xml, DynamoDB mappers, and others) therefore wrote a Date it could not read back. MarshalText now formats with DateFormat, matching MarshalJSON, String and UnmarshalText. Thanks to @​jusabe-kreditz.

deepObject no longer emits param[]=null for nil maps and slices

Marshalling a deepObject parameter whose field held a typed nil map or nil slice produced a param[]=null pair, because the intermediate json.Marshal turned the nil into null. Such fields are now omitted, as an empty map or slice already was. Nil pointers are still serialized as null, as before. Thanks to @​SKalt (#160).

🚀 New features and improvements

• Add BindJSONBody to bind the request body value kin-openapi validated (#165) @​mromaszewicz
• Add MarshalText to types.Date (#162) @​jusabe-kreditz, @​mromaszewicz

🐛 Bug fixes

• fix: omit nil maps and slices from deepObject marshalling (#161) @​SKalt, @​mromaszewicz

📦 Dependency updates

• fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164) @​renovate[bot]
• fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163) @​renovate[bot]
• chore(deps): update github/codeql-action action to v4.39.1 (#159) @​renovate[bot]
• chore(deps): update oapi-codegen/actions action to v0.9.2 (#158) @​renovate[bot]
• chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157) @​renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

... (truncated)

Commits

• c0b2ca2 fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166)
• 170896a Add BindJSONBody to bind the request body value kin-openapi validated (#165)
• c702e06 fix: omit nil maps and slices from deepObject marshalling (#161)
• ea5fc39 Add MarshalText to types.Date (#162)
• 64f16fb chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164)
• 9808d04 fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163)
• df8dfa8 chore(deps): update github/codeql-action action to v4.39.1 (#159)
• ae0fff0 chore(deps): update oapi-codegen/actions action to v0.9.2 (#158)
• 2fd3480 chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions