Skip to content

chore(deps): bump the go-dependencies group with 4 updates - #424

Merged
mxssl merged 2 commits into
mainfrom
dependabot/go_modules/go-dependencies-4d581f4672
Nov 3, 2026
Merged

chore(deps): bump the go-dependencies group with 4 updates#424
mxssl merged 2 commits into
mainfrom
dependabot/go_modules/go-dependencies-4d581f4672

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 4 updates: github.com/bytedance/sonic, github.com/ethereum/go-ethereum, github.com/labstack/echo/v4 and github.com/molecule-man/go-brrr.

Updates github.com/bytedance/sonic from 1.15.4 to 1.15.5

Release notes

Sourced from github.com/bytedance/sonic's releases.

v1.15.5

What's Changed

New Contributors

Full Changelog: bytedance/sonic@v1.15.4...v1.15.5

Commits
  • 4640e45 chore: update loader to v0.5.3
  • 2fd18c5 test(jit): preserve ABI in X15 regression probes
  • 81a5467 fix(jit): clear X15 after native calls
  • 02863a8 test: skip unicode error check on stdlib fallback
  • 9e65e7f fix(ast): keep fallback scan starts GC-invisible
  • aa3db01 fix(ast): avoid GC-visible end pointers in fallback scanners
  • 5ce9454 fix(encoder): propagate newline write errors in StreamEncoder.Encode
  • bf12ab8 MAP_ANON should be set to -1 , not required on Linux, required on BSD. + go fmt
  • 42c7b55 fix(ast): preserve NewAny numeric values
  • eefcfdc fix(ast): encode empty NewBytes as an empty string
  • Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.17.8 to 1.17.10

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Soil Reducer (v1.17.10)

This is a quick release that postpones the Amsterdam fork on the Hoodi testnet, previously scheduled for Oct 26, 2026, 17:42:48 UTC. Hoodi node operators running v1.17.9 must upgrade before then. A new date will be set in a future release; other networks are unaffected.

Snap sync now switches to snap/2 automatically once Amsterdam is active. Use --snap.v2=false or --snap.v2=true to force a protocol.

Changes

  • Cancel the Amsterdam activation on Hoodi (#36001)
  • Use snap/2 automatically once Amsterdam is active (#35989)
  • Optimize DUP/SWAP dispatch in the interpreter (#35959)

For a full rundown of the changes please consult the Geth 1.17.10 release milestone.

As with all our previous releases, you can find the:

Universal Semiconductor (v1.17.9)

This release enables the Amsterdam fork 🦩 on the Hoodi testnet at block timestamp 1793036568 (Mon, 26 Oct 2026 17:42:48 UTC).

It also contains changes to the EVM to improve the performance significantly.

This release is recommended for all users running their nodes on the Hoodi testnet.

Geth

  • Blsync now supports the Gloas beacon chain fork and had some bug fixes (#35956, #35385, #35957)
  • When running an archive node, you can now configure the transaction index history using --history.transactions flag. (#35907)

Core

  • Amsterdam fork is set to activate at block timestamp 1793036568. (#35974)
  • EVM interpreter opcode dispatching became 16% faster due to a new inlined switch implementation. (#35638)
  • Several fixes for database corruption on power failure (#35939, #35936)
  • Bug fix in trie database related to concurrent state reading (#35978)
  • RPC call concurrent with block processing could result in BAL corruption. (#35905)
  • State history committing is moved to the background, making newPayload 2% faster. (#35949)
  • Key-value database settings changed for improved write performance (#35691)
  • Fixed log index under history pruning beyond the checkpoint (#35875)

Networking

  • Fixed snap/2 restart issue by checking for pivot block reorg in the header chain (#35930, #35982)

... (truncated)

Commits

Updates github.com/labstack/echo/v4 from 4.16.0 to 4.16.2

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.2

Fixes

  • Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
  • Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
  • Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

  • Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
  • Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
  • Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
  • Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
  • Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
  • Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

... (truncated)

Commits
  • 679c415 chore: prepare v4.16.2 release (#3191)
  • 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
  • 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
  • ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
  • 600b985 chore: prepare v4.16.1 security release (#3186)
  • 3fb0ba7 Merge commit from fork
  • be08005 fix(router): grow param values for contexts created before a route with more ...
  • 320fe67 fix(bind): honor OpenAPI date, date-time and date-time-local format tags (v4)...
  • f085ffb fix(router): handle escaped colons and inline verbs in v4 (#3132)
  • 5440f99 fix(middleware): prevent BodyLimit bypass in v4 (#3131)
  • Additional commits viewable in compare view

Updates github.com/molecule-man/go-brrr from 1.3.0 to 1.3.1

Release notes

Sourced from github.com/molecule-man/go-brrr's releases.

v1.3.1 fixes Reader behavior for malformed Brotli input. For specific invalid streams it could return extra bytes before an error or on a later read. Valid streams are unaffected.

What's Changed

New Contributors

Full Changelog: molecule-man/go-brrr@v1.3.0...v1.3.1

Commits
  • 4c40d5f test(fuzz): compare only new Reader bytes against the C prefix
  • dba3f30 Merge pull request #74 from molecule-man/test/fuzz-reject-prefix
  • d329be6 test(fuzz): check Reader output before C rejects a stream
  • 58ac011 fix(reader): return only the error after a decode error
  • 83a23b6 Merge pull request #73 from molecule-man/deps/brotli-v1.2.1
  • dbc0b92 Merge branch 'main' into deps/brotli-v1.2.1
  • c03cf96 Merge pull request #72 from shibukawa/fix/metablock-overrun-output
  • bf8f83f deps: pin brotli-ref to release v1.2.1
  • 02875cd test: pin Go q3/q4 compound dictionary output for brotli v1.2.1
  • 66bac8a fix(decode): refuse output after a command overruns its metablock
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-dependencies group with 4 updates
a287ada 
Bumps the go-dependencies group with 4 updates: [github.com/bytedance/sonic](https://github.com/bytedance/sonic), [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum), [github.com/labstack/echo/v4](https://github.com/labstack/echo) and [github.com/molecule-man/go-brrr](https://github.com/molecule-man/go-brrr).


Updates `github.com/bytedance/sonic` from 1.15.4 to 1.15.5
- [Release notes](https://github.com/bytedance/sonic/releases)
- [Commits](bytedance/sonic@v1.15.4...v1.15.5)

Updates `github.com/ethereum/go-ethereum` from 1.17.8 to 1.17.10
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.8...v1.17.10)

Updates `github.com/labstack/echo/v4` from 4.16.0 to 4.16.2
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.16.0...v4.16.2)

Updates `github.com/molecule-man/go-brrr` from 1.3.0 to 1.3.1
- [Release notes](https://github.com/molecule-man/go-brrr/releases)
- [Commits](molecule-man/go-brrr@v1.3.0...v1.3.1)

---
updated-dependencies:
- dependency-name: github.com/bytedance/sonic
  dependency-version: 1.15.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/molecule-man/go-brrr
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 29, 2026
mxssl
mxssl approved these changes Nov 3, 2026
View reviewed changes

@mxssl mxssl left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — approving.

Verified locally on the PR head (a287ada):

  • go mod verify clean, go mod tidy -diff empty
  • go build ./..., go vet ./..., go vet -tags=e2e ./test/e2e/... all pass
  • go test -race -count=1 ./... — 101 packages, all green

Per dependency:

  • sonic 1.15.4 → 1.15.5 / loader → v0.5.3: go mod graph confirms sonic v1.15.5 requires exactly loader v0.5.3, so the "keep in lockstep" note still holds, and we move off the pseudo-version onto a tagged release. Changes are decoder/encoder/JIT bug fixes (incl. the X15 register restore after native calls).
  • go-ethereum 1.17.8 → 1.17.10: node-side changes (Hoodi fork schedule, snap/2, EVM dispatch, DB fixes); nothing in the types/rpc surface we consume changes behavior.
  • echo v4.16.0 → v4.16.2: the behavior changes are all in echo's bundled middlewares (Decompress 100 MiB cap, BodyDump caps, CSRF/BasicAuth tightening, proxy Forwarded stripping). We don't use any of them — http_server registers our own Decompress()/Compress() and the metrics server only uses echoprometheus — so no behavior change for us; we pick up the router fixes and x/net bump.
  • go-brrr 1.3.0 → 1.3.1: fixes Reader emitting extra bytes on malformed Brotli input; valid streams unaffected. This is the reader we use for Content-Encoding: br request bodies, so it's a strict improvement.

CI note: the e2e failure is the usual Dependabot-run issue — "NODECORE_E2E_DRPC_KEY secret is required" (Dependabot-triggered runs don't receive Actions secrets). It isn't related to this change, and e2e isn't a required check. The branch is 1 commit behind main, so it needs an update before merging; that update, done by a human, will also re-run e2e with secrets.

@mxssl
mxssl merged commit d8a2fea into main Nov 3, 2026
5 checks passed
@mxssl
mxssl deleted the dependabot/go_modules/go-dependencies-4d581f4672 branch November 3, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mxssl mxssl mxssl approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mxssl