build(deps): bump github.com/labstack/echo/v4 from 4.13.3 to 4.15.3

[dependabot]

Bumps github.com/labstack/echo/v4 from 4.13.3 to 4.15.3.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.3 - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

Security

• fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in labstack/echo#3011

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3009, released in v5.2.0). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Full Changelog: labstack/echo@v4.15.2...v4.15.3

v4.15.2 - Context.Scheme() header validation

Security

• Context.Scheme() should validate values taken from header by @​aldas in labstack/echo#2962

Thanks to @​shblue21 for reporting this issue.

Full Changelog: labstack/echo@v4.15.1...v4.15.2

v4.15.1

What's Changed

• CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in labstack/echo#2905

Full Changelog: labstack/echo@v4.15.0...v4.15.1

v4.15.0

Security

WARNING: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship between the request origin and the target. The middleware uses this to make security decisions:

• same-origin or none: Requests are allowed (exact origin match or direct user navigation)
• same-site: Falls back to token validation (e.g., subdomain to main domain)
• cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to traditional token-based CSRF protection.

New Configuration Options:

• TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)
• AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.3 - 2026-06-14

Security

• fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in labstack/echo#3011

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3009). Thanks to @​a-tt-om and @​oran-gugu for reporting.

v4.15.2 - 2026-05-01

Security

• Context.Scheme() should validate values taken from header by @​aldas in labstack/echo#2962

Thanks to @​shblue21 for reporting this issue.

v4.15.1 - 2026-02-22

Enhancements

• CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in labstack/echo#2905

v4.15.0 - 2026-01-01

Security

NB: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship between the request origin and the target. The middleware uses this to make security decisions:

• same-origin or none: Requests are allowed (exact origin match or direct user navigation)
• same-site: Falls back to token validation (e.g., subdomain to main domain)
• cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to traditional token-based CSRF protection.

New Configuration Options:

• TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)

... (truncated)

Commits

• 8800212 Changelog for v4.15.3 (#3012)
• c3fa2a2 fix(static): reject encoded path separators that bypass route-level middlewar...
• 25685e6 Merge pull request #2963 from aldas/v4_changelog_4_15_2
• f9d7689 Changelog for v4.15.2
• 37fff28 Merge pull request #2962 from aldas/v4_valid_proto
• ca4f38a Context.Scheme should validate values taken from header
• 2e527a7 Update CI, update deps
• 6f3a84a Merge pull request #2905 from aldas/v4_crsf_token_fallback
• 24fa4d0 CSRF: support older token-based CSRF protection handler that want to render t...
• 482bb46 v4.15.0 changelog
• Additional commits viewable in compare view