Bump github.com/labstack/echo/v4 from 4.12.0 to 4.13.0

[dependabot]

Bumps github.com/labstack/echo/v4 from 4.12.0 to 4.13.0.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

JWT Middleware Removed

BREAKING CHANGE: JWT Middleware Removed from Core

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

• remove jwt middleware by @​stevenwhitehead in labstack/echo#2701
• optimization: struct alignment by @​behnambm in labstack/echo#2636
• bind: Maintain backwards compatibility for map[string]interface{} binding by @​thesaltree in labstack/echo#2656
• Add Go 1.23 to CI by @​aldas in labstack/echo#2675
• improve MultipartForm test by @​martinyonatann in labstack/echo#2682
• bind : add support of multipart multi files by @​martinyonatann in labstack/echo#2684
• Add TemplateRenderer struct to ease creating renderers for html/template and text/template packages. by @​aldas in labstack/echo#2690
• Refactor TestBasicAuth to utilize table-driven test format by @​ErikOlson in labstack/echo#2688
• Remove broken header by @​aldas in labstack/echo#2705
• fix(bind body): content-length can be -1 by @​phamvinhdat in labstack/echo#2710
• CORS middleware should compile allowOrigin regexp at creation by @​aldas in labstack/echo#2709
• Shorten Github issue template and add test example by @​aldas in labstack/echo#2711

New Contributors

• @​behnambm made their first contribution in labstack/echo#2636
• @​thesaltree made their first contribution in labstack/echo#2656
• @​martinyonatann made their first contribution in labstack/echo#2682
• @​ErikOlson made their first contribution in labstack/echo#2688
• @​phamvinhdat made their first contribution in labstack/echo#2710
• @​stevenwhitehead made their first contribution in labstack/echo#2701

Full Changelog: labstack/echo@v4.12.0...v4.13.0

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.13.0 - 2024-12-04

BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

Enhancements

• remove jwt middleware by @​stevenwhitehead in labstack/echo#2701
• optimization: struct alignment by @​behnambm in labstack/echo#2636
• bind: Maintain backwards compatibility for map[string]interface{} binding by @​thesaltree in labstack/echo#2656
• Add Go 1.23 to CI by @​aldas in labstack/echo#2675
• improve MultipartForm test by @​martinyonatann in labstack/echo#2682
• bind : add support of multipart multi files by @​martinyonatann in labstack/echo#2684
• Add TemplateRenderer struct to ease creating renderers for html/template and text/template packages. by @​aldas in labstack/echo#2690
• Refactor TestBasicAuth to utilize table-driven test format by @​ErikOlson in labstack/echo#2688
• Remove broken header by @​aldas in labstack/echo#2705
• fix(bind body): content-length can be -1 by @​phamvinhdat in labstack/echo#2710
• CORS middleware should compile allowOrigin regexp at creation by @​aldas in labstack/echo#2709
• Shorten Github issue template and add test example by @​aldas in labstack/echo#2711

Commits

• 3b01785 Changelog for 4.13.0 (#2712)
• fe26277 remove jwt middleware
• 9e73691 Shorten Github issue template and add test example
• 118c163 CORS middleware should compile allowOrigin regexp at creation.
• a973e3b add unit-test
• c4410fe fix(bind body): content-length can be -1
• 5d98929 Remove broken header
• 5a0b4dd clean up field assignments with default values to make test configuration mor...
• 03c0236 refactor basic_auth_test to utilize table driven tests
• 822d11a Add TemplateRenderer struct to ease creating renderers for html/template an...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Benchmark Result

goos: linux
goarch: amd64
pkg: github.com/mazrean/formstream
cpu: AMD EPYC 7763 64-Core Processor                
BenchmarkFormStreamFastPath/1MB-4 	    2805	    405910 ns/op	   10010 B/op	      64 allocs/op
BenchmarkFormStreamFastPath/10MB-4         	     308	   3873324 ns/op	   10020 B/op	      64 allocs/op
BenchmarkFormStreamFastPath/100MB-4        	      28	  41467700 ns/op	   10596 B/op	      64 allocs/op
BenchmarkFormStreamFastPath/1GB-4          	       3	 422176393 ns/op	   15637 B/op	      65 allocs/op
BenchmarkFormStreamSlowPath/1MB-4          	    2732	    439891 ns/op	   13204 B/op	      69 allocs/op
BenchmarkFormStreamSlowPath/10MB-4         	     274	   4359533 ns/op	  132705 B/op	      69 allocs/op
BenchmarkFormStreamSlowPath/100MB-4        	       5	 211729298 ns/op	26890027 B/op	      81 allocs/op
BenchmarkFormStreamSlowPath/1GB-4          	       1	2380495602 ns/op	134269632 B/op	     101 allocs/op
BenchmarkStdMultipartNextPart/1MB-4        	    2670	    414082 ns/op	   39299 B/op	      32 allocs/op
BenchmarkStdMultipartNextPart/10MB-4       	     309	   3879344 ns/op	   39316 B/op	      32 allocs/op
BenchmarkStdMultipartNextPart/100MB-4      	      27	  44719123 ns/op	   39622 B/op	      32 allocs/op
BenchmarkStdMultipartNextPart/1GB-4        	       3	 449987335 ns/op	   42202 B/op	      33 allocs/op
BenchmarkStdMultipartReadForm/1MB-4        	    1141	   1026962 ns/op	 4204149 B/op	      61 allocs/op
BenchmarkStdMultipartReadForm/10MB-4       	     120	  10335234 ns/op	33566630 B/op	      64 allocs/op
BenchmarkStdMultipartReadForm/100MB-4      	       4	 250914887 ns/op	134262972 B/op	      78 allocs/op
BenchmarkStdMultipartReadForm/1GB-4        	       1	2538972369 ns/op	134283624 B/op	      83 allocs/op
PASS
ok  	github.com/mazrean/formstream	33.261s

pprof command

gh api /repos/mazrean/formstream/actions/artifacts/2285403426/zip > /tmp/profile.zip
unzip /tmp/profile.zip -d profile
rm -rf /tmp/profile.zip
go tool pprof -http :6060 profile/cpu.out

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 57.70%. Comparing base (dc3fa7a) to head (31179bd).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #35   +/-   ##
=======================================
  Coverage   57.70%   57.70%           
=======================================
  Files          12       12           
  Lines         506      506           
=======================================
  Hits          292      292           
  Misses        193      193           
  Partials       21       21           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[dependabot]

Superseded by #39.