[dependabot]

Bumps the go-dependencies group with 4 updates: github.com/bytedance/sonic, github.com/ethereum/go-ethereum, github.com/labstack/echo/v4 and github.com/molecule-man/go-brrr.

Updates github.com/bytedance/sonic from 1.15.4 to 1.15.5

Release notes

Sourced from github.com/bytedance/sonic's releases.

v1.15.5

What's Changed

• fix(decoder): overwrite interface{} map value with null for duplicate key by @​linhongyu510 in bytedance/sonic#989
• fix: honor UseUnicodeErrors in Config.Froze by @​dajiaohuang in bytedance/sonic#976
• fix(ast): encode empty NewBytes as an empty string by @​hazyhaar in bytedance/sonic#991
• fix(ast): preserve NewAny numeric values by @​dajiaohuang in bytedance/sonic#980
• fix[bsd]: MAP_ANON should be set to -1 , ignored on Linux, required on BSD + go fmt by @​gboddin in bytedance/sonic#902
• fix(encoder): return newline write errors by @​dajiaohuang in bytedance/sonic#978
• fix(ast): avoid GC-visible end pointers in fallback scanners by @​liuq19 in bytedance/sonic#998
• fix(jit): restore X15 zero register after native calls by @​liuq19 in bytedance/sonic#988
• build(deps): 升级 loader 至 v0.5.3，交付 BSD mmap 修复 by @​liuq19 in bytedance/sonic#1006

New Contributors

• @​linhongyu510 made their first contribution in bytedance/sonic#989
• @​dajiaohuang made their first contribution in bytedance/sonic#976
• @​hazyhaar made their first contribution in bytedance/sonic#991
• @​gboddin made their first contribution in bytedance/sonic#902

Full Changelog: bytedance/sonic@v1.15.4...v1.15.5

Commits

• 4640e45 chore: update loader to v0.5.3
• 2fd18c5 test(jit): preserve ABI in X15 regression probes
• 81a5467 fix(jit): clear X15 after native calls
• 02863a8 test: skip unicode error check on stdlib fallback
• 9e65e7f fix(ast): keep fallback scan starts GC-invisible
• aa3db01 fix(ast): avoid GC-visible end pointers in fallback scanners
• 5ce9454 fix(encoder): propagate newline write errors in StreamEncoder.Encode
• bf12ab8 MAP_ANON should be set to -1 , not required on Linux, required on BSD. + go fmt
• 42c7b55 fix(ast): preserve NewAny numeric values
• eefcfdc fix(ast): encode empty NewBytes as an empty string
• Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.17.8 to 1.17.10

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Soil Reducer (v1.17.10)

This is a quick release that postpones the Amsterdam fork on the Hoodi testnet, previously scheduled for Oct 26, 2026, 17:42:48 UTC. Hoodi node operators running v1.17.9 must upgrade before then. A new date will be set in a future release; other networks are unaffected.

Snap sync now switches to snap/2 automatically once Amsterdam is active. Use --snap.v2=false or --snap.v2=true to force a protocol.

Changes

• Cancel the Amsterdam activation on Hoodi (#36001)
• Use snap/2 automatically once Amsterdam is active (#35989)
• Optimize DUP/SWAP dispatch in the interpreter (#35959)

For a full rundown of the changes please consult the Geth 1.17.10 release milestone.

---

As with all our previous releases, you can find the:

• Pre-built binaries for all platforms on our downloads page
• Docker images published under ethereum/client-go (use "stable" tag)
• Ubuntu packages in our Launchpad PPA repository
• macOS packages in our Homebrew Tap repository

Universal Semiconductor (v1.17.9)

This release enables the Amsterdam fork 🦩 on the Hoodi testnet at block timestamp 1793036568 (Mon, 26 Oct 2026 17:42:48 UTC).

It also contains changes to the EVM to improve the performance significantly.

This release is recommended for all users running their nodes on the Hoodi testnet.

Geth

• Blsync now supports the Gloas beacon chain fork and had some bug fixes (#35956, #35385, #35957)
• When running an archive node, you can now configure the transaction index history using --history.transactions flag. (#35907)

Core

• Amsterdam fork is set to activate at block timestamp 1793036568. (#35974)
• EVM interpreter opcode dispatching became 16% faster due to a new inlined switch implementation. (#35638)
• Several fixes for database corruption on power failure (#35939, #35936)
• Bug fix in trie database related to concurrent state reading (#35978)
• RPC call concurrent with block processing could result in BAL corruption. (#35905)
• State history committing is moved to the background, making newPayload 2% faster. (#35949)
• Key-value database settings changed for improved write performance (#35691)
• Fixed log index under history pruning beyond the checkpoint (#35875)

Networking

• Fixed snap/2 restart issue by checking for pivot block reorg in the header chain (#35930, #35982)

... (truncated)

Commits

• 1df30b1 version: release 1.17.10 (#36002)
• e8e61f7 cmd/evm/testdata: fix test (#36004)
• c0816b8 core/types: improve transaction field validation (#36003)
• 1223cf3 core, params: revert schedule amsterdam fork on hoodi (#36001)
• 8b8bb43 cmd/utils: show automatic as the snap.v2 default in help (#35998)
• 6c63e48 build: upgrade -dlgo version to Go 1.27.3 (#35985)
• ac7467e core/vm: fold DUP/SWAP into shared cases and fetch the next opcode per case (...
• 1c6b310 cmd, eth: auto-enable snapv2 with amsterdam activated (#35989)
• ad4a087 version: start release cycle v1.17.10 (#35991)
• 9dffe6e version: release go-ethereum v1.17.9 stable (#35990)
• Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.16.0 to 4.16.2

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.2

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
• Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
• Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
• Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

... (truncated)

Commits

• 679c415 chore: prepare v4.16.2 release (#3191)
• 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
• 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
• ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
• 600b985 chore: prepare v4.16.1 security release (#3186)
• 3fb0ba7 Merge commit from fork
• be08005 fix(router): grow param values for contexts created before a route with more ...
• 320fe67 fix(bind): honor OpenAPI date, date-time and date-time-local format tags (v4)...
• f085ffb fix(router): handle escaped colons and inline verbs in v4 (#3132)
• 5440f99 fix(middleware): prevent BodyLimit bypass in v4 (#3131)
• Additional commits viewable in compare view

Updates github.com/molecule-man/go-brrr from 1.3.0 to 1.3.1

Release notes

Sourced from github.com/molecule-man/go-brrr's releases.

v1.3.1 fixes Reader behavior for malformed Brotli input. For specific invalid streams it could return extra bytes before an error or on a later read. Valid streams are unaffected.

What's Changed

• fix(decode): refuse output after a command overruns its metablock by @​shibukawa in molecule-man/go-brrr#72
• deps: pin the Brotli C reference to v1.2.1 by @​molecule-man in molecule-man/go-brrr#73
• test(fuzz): compare Reader output before C rejects a stream by @​molecule-man in molecule-man/go-brrr#74

New Contributors

• @​shibukawa made their first contribution in molecule-man/go-brrr#72

Full Changelog: molecule-man/go-brrr@v1.3.0...v1.3.1

Commits

• 4c40d5f test(fuzz): compare only new Reader bytes against the C prefix
• dba3f30 Merge pull request #74 from molecule-man/test/fuzz-reject-prefix
• d329be6 test(fuzz): check Reader output before C rejects a stream
• 58ac011 fix(reader): return only the error after a decode error
• 83a23b6 Merge pull request #73 from molecule-man/deps/brotli-v1.2.1
• dbc0b92 Merge branch 'main' into deps/brotli-v1.2.1
• c03cf96 Merge pull request #72 from shibukawa/fix/metablock-overrun-output
• bf8f83f deps: pin brotli-ref to release v1.2.1
• 02875cd test: pin Go q3/q4 compound dictionary output for brotli v1.2.1
• 66bac8a fix(decode): refuse output after a command overruns its metablock
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions