chore(deps): bump github.com/labstack/echo/v4 from 4.13.4 to 4.15.1

[dependabot]

Bumps github.com/labstack/echo/v4 from 4.13.4 to 4.15.1.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.0

Security

WARNING: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship between the request origin and the target. The middleware uses this to make security decisions:

• same-origin or none: Requests are allowed (exact origin match or direct user navigation)
• same-site: Falls back to token validation (e.g., subdomain to main domain)
• cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to traditional token-based CSRF protection.

New Configuration Options:

• TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)
• AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

Example:

e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    // Allow OAuth callbacks from trusted provider
    TrustedOrigins: []string{"https://oauth-provider.com"},
// Custom validation for same-site requests
AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
    // Your custom authorization logic here
    return validateCustomAuth(c), nil
    // return true, err  // blocks request with error
    // return true, nil  // allows CSRF request through
    // return false, nil // falls back to legacy token logic
},

}))

PR: labstack/echo#2858

Type-Safe Generic Parameter Binding

• Added generic functions for type-safe parameter extraction and context access by @​aldas in labstack/echo#2856

  Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion, eliminating manual string parsing and type assertions.

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

Changelog

v5.0.4 - 2026-02-15

Enhancements

• Remove unused import 'errors' from README example by @​kumapower17 in labstack/echo#2889
• Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @​aldas in labstack/echo#2898
• Update location of oapi-codegen in README by @​mromaszewicz in labstack/echo#2896
• Add Go 1.26 to CI flow by @​aldas in labstack/echo#2899
• Add new function echo.StatusCode by @​suwakei in labstack/echo#2892
• CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in labstack/echo#2894
• Add echo.ResolveResponseStatus function to help middleware/handlers determine HTTP status code and echo.Response by @​aldas in labstack/echo#2900

v5.0.3 - 2026-02-06

Security

• Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @​shblue21.

This applies to cases when:

• Windows is used as OS
• middleware.StaticConfig.Filesystem is nil (default)
• echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

v5.0.2 - 2026-02-02

Security

• Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in labstack/echo#2887

v5.0.1 - 2026-01-28

• Panic MW: will now return a custom PanicStackError with stack trace by @​aldas in labstack/echo#2871
• Docs: add missing err parameter to DenyHandler example by @​cgalibern in labstack/echo#2878
• improve: improve websocket checks in IsWebSocket() [per RFC 6455] by @​raju-mechatronics in labstack/echo#2875
• fix: Context.Json() should not send status code before serialization is complete by @​aldas in labstack/echo#2877

v5.0.0 - 2026-01-18

Echo v5 is maintenance release with major breaking changes

• Context is now struct instead of interface and we can add method to it in the future in minor versions.
• Adds new Router interface for possible new routing implementations.
• Drops old logging interface and uses moderm log/slog instead.

... (truncated)

Commits

• 6f3a84a Merge pull request #2905 from aldas/v4_crsf_token_fallback
• 24fa4d0 CSRF: support older token-based CSRF protection handler that want to render t...
• 482bb46 v4.15.0 changelog
• d0f9d1e CRSF with Sec-Fetch-Site=same-site falls back to legacy token
• f3fc618 CRSF with Sec-Fetch-Site checks
• 4dcb9b4 licence headers
• cbc0ac1 Add PathParam(Or)/QueryParam(Or)/FormParam(Or) generic functions
• 6b14f4e Add Context.Get generic functions
• 321530d disable test - returns different error under Windows
• c8abd9f disable flaky test
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	4		0	0	0.3s
✅ API	spectral	2		0	0	3.64s
✅ COPYPASTE	jscpd	yes		no	no	1.69s
✅ DOCKERFILE	hadolint	1		0	0	0.06s
❌ GO	golangci-lint	yes	yes	1	no	36.06s
✅ GO	revive	yes		no	no	0.02s
✅ MARKDOWN	markdownlint	2	0	0	0	0.64s
✅ MARKDOWN	markdown-table-formatter	2	0	0	0	0.23s
✅ REPOSITORY	checkov	yes		no	no	29.7s
✅ REPOSITORY	gitleaks	yes		no	no	0.29s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	36.3s
✅ REPOSITORY	secretlint	yes		no	no	0.34s
✅ REPOSITORY	syft	yes		no	no	12.73s
✅ REPOSITORY	trivy	yes		no	no	8.75s
✅ REPOSITORY	trivy-sbom	yes		no	no	1.32s
✅ REPOSITORY	trufflehog	yes		no	no	2.18s
✅ SPELL	lychee	12		0	0	0.35s
✅ YAML	prettier	10	0	0	0	0.77s
✅ YAML	v8r	10		0	0	7.73s
✅ YAML	yamllint	10		0	0	0.6s

Detailed Issues

❌ GO / golangci-lint - 1 error

level=info msg="golangci-lint has version 2.7.2 built with go1.25.4 from 9f61b0f5 on 2025-12-07T16:57:12Z"
level=info msg="[config_reader] Used config file ../../action/lib/.automation/.golangci.yml"
level=info msg="[config_reader] Module name \"github.com/atlascloud/packages\""
level=info msg="maxprocs: Leaving GOMAXPROCS=4: CPU quota undefined"
level=info msg="[goenv] Read go env for 6.827461ms: map[string]string{\"GOCACHE\":\"/github/home/.cache/go-build\", \"GOROOT\":\"/usr/lib/go\"}"
level=info msg="[lintersdb] Active 6 linters: [gocritic gofmt govet ineffassign staticcheck unused]"
level=info msg="[loader] Go packages loading at mode 8767 (deps|exports_file|imports|compiled_files|files|name|types_sizes) took 27.780706566s"
level=info msg="[runner/filename_unadjuster] Pre-built 0 adjustments in 3.817708ms"
level=info msg="[linters_context/goanalysis] analyzers took 21.271786863s with top 10 stages: buildir: 17.343213263s, inspect: 685.336864ms, fact_purity: 396.054934ms, ctrlflow: 349.61974ms, fact_deprecated: 336.912863ms, printf: 279.94202ms, nilness: 272.250193ms, gocritic: 250.605967ms, SA5012: 207.816846ms, gofmt: 203.067606ms"
level=info msg="[runner] Applying suggested fixes"
level=info msg="[runner] fixer took 795ns with stages: all: 795ns"
level=info msg="[runner/exclusion_paths] Skipped 0 issues by pattern \"third_party$\""
level=info msg="[runner/exclusion_paths] Skipped 0 issues by pattern \"builtin$\""
level=info msg="[runner/exclusion_paths] Skipped 0 issues by pattern \"examples$\""
level=info msg="[runner/exclusion_rules] Skipped 0 issues by rules: [Path: \"third_party$\", Linters: \"gofmt\"]"
level=info msg="[runner/exclusion_rules] Skipped 0 issues by rules: [Path: \"builtin$\", Linters: \"gofmt\"]"
level=info msg="[runner/exclusion_rules] Skipped 0 issues by rules: [Path: \"examples$\", Linters: \"gofmt\"]"
level=info msg="[runner] Issues before processing: 2, after processing: 1"
level=info msg="[runner] Processors filtering stat (in/out): fixer: 1/1, max_same_issues: 1/1, severity-rules: 1/1, filename_unadjuster: 2/2, path_relativity: 2/2, generated_file_filter: 2/1, max_per_file_from_linter: 1/1, max_from_linter: 1/1, source_code: 1/1, path_prettifier: 1/1, exclusion_paths: 2/2, uniq_by_line: 1/1, path_shortener: 1/1, cgo: 2/2, invalid_issue: 2/2, exclusion_rules: 1/1, sort_results: 1/1, path_absoluter: 2/2, nolint_filter: 1/1, diff: 1/1"
level=info msg="[runner] processing took 371.273µs with stages: nolint_filter: 199.247µs, generated_file_filter: 69.622µs, exclusion_rules: 33.025µs, source_code: 19.363µs, fixer: 19.326µs, exclusion_paths: 18.362µs, path_relativity: 3.005µs, uniq_by_line: 2.079µs, sort_results: 1.688µs, max_same_issues: 1.329µs, max_from_linter: 670ns, path_shortener: 667ns, invalid_issue: 578ns, path_absoluter: 576ns, cgo: 555ns, filename_unadjuster: 432ns, path_prettifier: 266ns, diff: 214ns, max_per_file_from_linter: 163ns, severity-rules: 106ns"
level=info msg="[runner] linters took 7.974652168s with stages: goanalysis_metalinter: 7.974220926s"
../../..cmd/api/main.go:49:8: SA1019: middleware.Logger is deprecated: please use middleware.RequestLogger or middleware.RequestLoggerWithConfig instead. (staticcheck)
	e.Use(middleware.Logger())
	      ^
1 issues:
* staticcheck: 1
level=info msg="File cache stats: 1 entries of total size 2.8KiB"
level=info msg="Memory: 358 samples, avg is 113.9MB, max is 532.7MB"
level=info msg="Execution took 35.766548905s"

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.3.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,API_SPECTRAL,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,GO_GOLANGCI_LINT,GO_REVIVE,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R