Skip to content

Commit 74475b0

Browse files
n9te9n9te9
committed
Merge remote-tracking branch 'upstream/master'
2 parents 48b2f2f + 88c379f commit 74475b0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

92 files changed

+6082
-2562
lines changed

‎.github/workflows/checks.yml

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Run checks
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
branches:
9+
- master
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read # to fetch code (actions/checkout)
14+
15+
env:
16+
# run static analysis only with the latest Go version
17+
LATEST_GO_VERSION: "1.22"
18+
19+
jobs:
20+
check:
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Checkout Code
24+
uses: actions/checkout@v4
25+
26+
- name: Set up Go ${{ matrix.go }}
27+
uses: actions/setup-go@v5
28+
with:
29+
go-version: ${{ env.LATEST_GO_VERSION }}
30+
check-latest: true
31+
32+
- name: Run golint
33+
run: |
34+
go install golang.org/x/lint/golint@latest
35+
golint -set_exit_status ./...
36+
37+
- name: Run staticcheck
38+
run: |
39+
go install honnef.co/go/tools/cmd/staticcheck@latest
40+
staticcheck ./...
41+
42+
- name: Run govulncheck
43+
run: |
44+
go version
45+
go install golang.org/x/vuln/cmd/govulncheck@latest
46+
govulncheck ./...
47+
48+

‎.github/workflows/echo.yml

+22-35
Original file line numberDiff line numberDiff line change
@@ -4,82 +4,69 @@ on:
44
push:
55
branches:
66
- master
7-
paths:
8-
- '**.go'
9-
- 'go.*'
10-
- '_fixture/**'
11-
- '.github/**'
12-
- 'codecov.yml'
137
pull_request:
148
branches:
159
- master
16-
paths:
17-
- '**.go'
18-
- 'go.*'
19-
- '_fixture/**'
20-
- '.github/**'
21-
- 'codecov.yml'
2210
workflow_dispatch:
2311

12+
permissions:
13+
contents: read # to fetch code (actions/checkout)
14+
15+
env:
16+
# run coverage and benchmarks only with the latest Go version
17+
LATEST_GO_VERSION: "1.22"
18+
2419
jobs:
2520
test:
2621
strategy:
2722
matrix:
2823
os: [ubuntu-latest, macos-latest, windows-latest]
2924
# Each major Go release is supported until there are two newer major releases. https://golang.org/doc/devel/release.html#policy
30-
# Echo tests with last four major releases
31-
go: [1.16, 1.17, 1.18, 1.19]
25+
# Echo tests with last four major releases (unless there are pressing vulnerabilities)
26+
# As we depend on `golang.org/x/` libraries which only support last 2 Go releases we could have situations when
27+
# we derive from last four major releases promise.
28+
go: ["1.19", "1.20", "1.21", "1.22"]
3229
name: ${{ matrix.os }} @ Go ${{ matrix.go }}
3330
runs-on: ${{ matrix.os }}
3431
steps:
3532
- name: Checkout Code
36-
uses: actions/checkout@v3
37-
with:
38-
ref: ${{ github.ref }}
33+
uses: actions/checkout@v4
3934

4035
- name: Set up Go ${{ matrix.go }}
41-
uses: actions/setup-go@v3
36+
uses: actions/setup-go@v5
4237
with:
4338
go-version: ${{ matrix.go }}
4439

45-
- name: Install Dependencies
46-
run: go install golang.org/x/lint/golint@latest
47-
4840
- name: Run Tests
49-
run: |
50-
golint -set_exit_status ./...
51-
go test -race --coverprofile=coverage.coverprofile --covermode=atomic ./...
41+
run: go test -race --coverprofile=coverage.coverprofile --covermode=atomic ./...
5242

5343
- name: Upload coverage to Codecov
54-
if: success() && matrix.go == 1.19 && matrix.os == 'ubuntu-latest'
44+
if: success() && matrix.go == env.LATEST_GO_VERSION && matrix.os == 'ubuntu-latest'
5545
uses: codecov/codecov-action@v3
5646
with:
5747
token:
5848
fail_ci_if_error: false
49+
5950
benchmark:
6051
needs: test
61-
strategy:
62-
matrix:
63-
os: [ubuntu-latest]
64-
go: [1.19]
65-
name: Benchmark comparison ${{ matrix.os }} @ Go ${{ matrix.go }}
66-
runs-on: ${{ matrix.os }}
52+
name: Benchmark comparison
53+
runs-on: ubuntu-latest
6754
steps:
6855
- name: Checkout Code (Previous)
69-
uses: actions/checkout@v3
56+
uses: actions/checkout@v4
7057
with:
7158
ref: ${{ github.base_ref }}
7259
path: previous
7360

7461
- name: Checkout Code (New)
75-
uses: actions/checkout@v3
62+
uses: actions/checkout@v4
7663
with:
7764
path: new
7865

7966
- name: Set up Go ${{ matrix.go }}
80-
uses: actions/setup-go@v3
67+
uses: actions/setup-go@v5
8168
with:
82-
go-version: ${{ matrix.go }}
69+
go-version: ${{ env.LATEST_GO_VERSION }}
8370

8471
- name: Install Dependencies
8572
run: go install golang.org/x/perf/cmd/benchstat@latest

‎.travis.yml

-21
This file was deleted.

‎CHANGELOG.md

+169
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,174 @@
11
# Changelog
22

3+
## v4.12.0 - 2024-04-15
4+
5+
**Security**
6+
7+
* Update golang.org/x/net dep because of [GO-2024-2687](https://pkg.go.dev/vuln/GO-2024-2687) by @aldas in https://github.com/labstack/echo/pull/2625
8+
9+
10+
**Enhancements**
11+
12+
* binder: make binding to Map work better with string destinations by @aldas in https://github.com/labstack/echo/pull/2554
13+
* README.md: add Encore as sponsor by @marcuskohlberg in https://github.com/labstack/echo/pull/2579
14+
* Reorder paragraphs in README.md by @aldas in https://github.com/labstack/echo/pull/2581
15+
* CI: upgrade actions/checkout to v4 by @aldas in https://github.com/labstack/echo/pull/2584
16+
* Remove default charset from 'application/json' Content-Type header by @doortts in https://github.com/labstack/echo/pull/2568
17+
* CI: Use Go 1.22 by @aldas in https://github.com/labstack/echo/pull/2588
18+
* binder: allow binding to a nil map by @georgmu in https://github.com/labstack/echo/pull/2574
19+
* Add Skipper Unit Test In BasicBasicAuthConfig and Add More Detail Explanation regarding BasicAuthValidator by @RyoKusnadi in https://github.com/labstack/echo/pull/2461
20+
* fix some typos by @teslaedison in https://github.com/labstack/echo/pull/2603
21+
* fix: some typos by @pomadev in https://github.com/labstack/echo/pull/2596
22+
* Allow ResponseWriters to unwrap writers when flushing/hijacking by @aldas in https://github.com/labstack/echo/pull/2595
23+
* Add SPDX licence comments to files. by @aldas in https://github.com/labstack/echo/pull/2604
24+
* Upgrade deps by @aldas in https://github.com/labstack/echo/pull/2605
25+
* Change type definition blocks to single declarations. This helps copy… by @aldas in https://github.com/labstack/echo/pull/2606
26+
* Fix Real IP logic by @cl-bvl in https://github.com/labstack/echo/pull/2550
27+
* Default binder can use `UnmarshalParams(params []string) error` inter… by @aldas in https://github.com/labstack/echo/pull/2607
28+
* Default binder can bind pointer to slice as struct field. For example `*[]string` by @aldas in https://github.com/labstack/echo/pull/2608
29+
* Remove maxparam dependence from Context by @aldas in https://github.com/labstack/echo/pull/2611
30+
* When route is registered with empty path it is normalized to `/`. by @aldas in https://github.com/labstack/echo/pull/2616
31+
* proxy middleware should use httputil.ReverseProxy for SSE requests by @aldas in https://github.com/labstack/echo/pull/2624
32+
33+
34+
## v4.11.4 - 2023-12-20
35+
36+
**Security**
37+
38+
* Upgrade golang.org/x/crypto to v0.17.0 to fix vulnerability [issue](https://pkg.go.dev/vuln/GO-2023-2402) [#2562](https://github.com/labstack/echo/pull/2562)
39+
40+
**Enhancements**
41+
42+
* Update deps and mark Go version to 1.18 as this is what golang.org/x/* use [#2563](https://github.com/labstack/echo/pull/2563)
43+
* Request logger: add example for Slog https://pkg.go.dev/log/slog [#2543](https://github.com/labstack/echo/pull/2543)
44+
45+
46+
## v4.11.3 - 2023-11-07
47+
48+
**Security**
49+
50+
* 'c.Attachment' and 'c.Inline' should escape filename in 'Content-Disposition' header to avoid 'Reflect File Download' vulnerability. [#2541](https://github.com/labstack/echo/pull/2541)
51+
52+
**Enhancements**
53+
54+
* Tests: refactor context tests to be separate functions [#2540](https://github.com/labstack/echo/pull/2540)
55+
* Proxy middleware: reuse echo request context [#2537](https://github.com/labstack/echo/pull/2537)
56+
* Mark unmarshallable yaml struct tags as ignored [#2536](https://github.com/labstack/echo/pull/2536)
57+
58+
59+
## v4.11.2 - 2023-10-11
60+
61+
**Security**
62+
63+
* Bump golang.org/x/net to prevent CVE-2023-39325 / CVE-2023-44487 HTTP/2 Rapid Reset Attack [#2527](https://github.com/labstack/echo/pull/2527)
64+
* fix(sec): randomString bias introduced by #2490 [#2492](https://github.com/labstack/echo/pull/2492)
65+
* CSRF/RequestID mw: switch math/random usage to crypto/random [#2490](https://github.com/labstack/echo/pull/2490)
66+
67+
**Enhancements**
68+
69+
* Delete unused context in body_limit.go [#2483](https://github.com/labstack/echo/pull/2483)
70+
* Use Go 1.21 in CI [#2505](https://github.com/labstack/echo/pull/2505)
71+
* Fix some typos [#2511](https://github.com/labstack/echo/pull/2511)
72+
* Allow CORS middleware to send Access-Control-Max-Age: 0 [#2518](https://github.com/labstack/echo/pull/2518)
73+
* Bump dependancies [#2522](https://github.com/labstack/echo/pull/2522)
74+
75+
## v4.11.1 - 2023-07-16
76+
77+
**Fixes**
78+
79+
* Fix `Gzip` middleware not sending response code for no content responses (404, 301/302 redirects etc) [#2481](https://github.com/labstack/echo/pull/2481)
80+
81+
82+
## v4.11.0 - 2023-07-14
83+
84+
85+
**Fixes**
86+
87+
* Fixes the proxy middleware concurrency issue of calling the Next() proxy target on Round Robin Balancer [#2409](https://github.com/labstack/echo/pull/2409)
88+
* Fix `group.RouteNotFound` not working when group has attached middlewares [#2411](https://github.com/labstack/echo/pull/2411)
89+
* Fix global error handler return error message when message is an error [#2456](https://github.com/labstack/echo/pull/2456)
90+
* Do not use global timeNow variables [#2477](https://github.com/labstack/echo/pull/2477)
91+
92+
93+
**Enhancements**
94+
95+
* Added a optional config variable to disable centralized error handler in recovery middleware [#2410](https://github.com/labstack/echo/pull/2410)
96+
* refactor: use `strings.ReplaceAll` directly [#2424](https://github.com/labstack/echo/pull/2424)
97+
* Add support for Go1.20 `http.rwUnwrapper` to Response struct [#2425](https://github.com/labstack/echo/pull/2425)
98+
* Check whether is nil before invoking centralized error handling [#2429](https://github.com/labstack/echo/pull/2429)
99+
* Proper colon support in `echo.Reverse` method [#2416](https://github.com/labstack/echo/pull/2416)
100+
* Fix misuses of a vs an in documentation comments [#2436](https://github.com/labstack/echo/pull/2436)
101+
* Add link to slog.Handler library for Echo logging into README.md [#2444](https://github.com/labstack/echo/pull/2444)
102+
* In proxy middleware Support retries of failed proxy requests [#2414](https://github.com/labstack/echo/pull/2414)
103+
* gofmt fixes to comments [#2452](https://github.com/labstack/echo/pull/2452)
104+
* gzip response only if it exceeds a minimal length [#2267](https://github.com/labstack/echo/pull/2267)
105+
* Upgrade packages [#2475](https://github.com/labstack/echo/pull/2475)
106+
107+
108+
## v4.10.2 - 2023-02-22
109+
110+
**Security**
111+
112+
* `filepath.Clean` behaviour has changed in Go 1.20 - adapt to it [#2406](https://github.com/labstack/echo/pull/2406)
113+
* Add `middleware.CORSConfig.UnsafeWildcardOriginWithAllowCredentials` to make UNSAFE usages of wildcard origin + allow cretentials less likely [#2405](https://github.com/labstack/echo/pull/2405)
114+
115+
**Enhancements**
116+
117+
* Add more HTTP error values [#2277](https://github.com/labstack/echo/pull/2277)
118+
119+
120+
## v4.10.1 - 2023-02-19
121+
122+
**Security**
123+
124+
* Upgrade deps due to the latest golang.org/x/net vulnerability [#2402](https://github.com/labstack/echo/pull/2402)
125+
126+
127+
**Enhancements**
128+
129+
* Add new JWT repository to the README [#2377](https://github.com/labstack/echo/pull/2377)
130+
* Return an empty string for ctx.path if there is no registered path [#2385](https://github.com/labstack/echo/pull/2385)
131+
* Add context timeout middleware [#2380](https://github.com/labstack/echo/pull/2380)
132+
* Update link to jaegertracing [#2394](https://github.com/labstack/echo/pull/2394)
133+
134+
135+
## v4.10.0 - 2022-12-27
136+
137+
**Security**
138+
139+
* We are deprecating JWT middleware in this repository. Please use https://github.com/labstack/echo-jwt instead.
140+
141+
JWT middleware is moved to separate repository to allow us to bump/upgrade version of JWT implementation (`github.com/golang-jwt/jwt`) we are using
142+
which we can not do in Echo core because this would break backwards compatibility guarantees we try to maintain.
143+
144+
* This minor version bumps minimum Go version to 1.17 (from 1.16) due `golang.org/x/` packages we depend on. There are
145+
several vulnerabilities fixed in these libraries.
146+
147+
Echo still tries to support last 4 Go versions but there are occasions we can not guarantee this promise.
148+
149+
150+
**Enhancements**
151+
152+
* Bump x/text to 0.3.8 [#2305](https://github.com/labstack/echo/pull/2305)
153+
* Bump dependencies and add notes about Go releases we support [#2336](https://github.com/labstack/echo/pull/2336)
154+
* Add helper interface for ProxyBalancer interface [#2316](https://github.com/labstack/echo/pull/2316)
155+
* Expose `middleware.CreateExtractors` function so we can use it from echo-contrib repository [#2338](https://github.com/labstack/echo/pull/2338)
156+
* Refactor func(Context) error to HandlerFunc [#2315](https://github.com/labstack/echo/pull/2315)
157+
* Improve function comments [#2329](https://github.com/labstack/echo/pull/2329)
158+
* Add new method HTTPError.WithInternal [#2340](https://github.com/labstack/echo/pull/2340)
159+
* Replace io/ioutil package usages [#2342](https://github.com/labstack/echo/pull/2342)
160+
* Add staticcheck to CI flow [#2343](https://github.com/labstack/echo/pull/2343)
161+
* Replace relative path determination from proprietary to std [#2345](https://github.com/labstack/echo/pull/2345)
162+
* Remove square brackets from ipv6 addresses in XFF (X-Forwarded-For header) [#2182](https://github.com/labstack/echo/pull/2182)
163+
* Add testcases for some BodyLimit middleware configuration options [#2350](https://github.com/labstack/echo/pull/2350)
164+
* Additional configuration options for RequestLogger and Logger middleware [#2341](https://github.com/labstack/echo/pull/2341)
165+
* Add route to request log [#2162](https://github.com/labstack/echo/pull/2162)
166+
* GitHub Workflows security hardening [#2358](https://github.com/labstack/echo/pull/2358)
167+
* Add govulncheck to CI and bump dependencies [#2362](https://github.com/labstack/echo/pull/2362)
168+
* Fix rate limiter docs [#2366](https://github.com/labstack/echo/pull/2366)
169+
* Refactor how `e.Routes()` work and introduce `e.OnAddRouteHandler` callback [#2337](https://github.com/labstack/echo/pull/2337)
170+
171+
3172
## v4.9.1 - 2022-10-12
4173

5174
**Fixes**

‎Makefile

+4-2
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,10 @@ check: lint vet race ## Check project
1010

1111
init:
1212
@go install golang.org/x/lint/golint@latest
13+
@go install honnef.co/go/tools/cmd/staticcheck@latest
1314

1415
lint: ## Lint the files
16+
@staticcheck ${PKG_LIST}
1517
@golint -set_exit_status ${PKG_LIST}
1618

1719
vet: ## Vet the files
@@ -29,6 +31,6 @@ benchmark: ## Run benchmarks
2931
help: ## Display this help screen
3032
@grep -h -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
3133

32-
goversion ?= "1.16"
33-
test_version: ## Run tests inside Docker with given version (defaults to 1.15 oldest supported). Example: make test_version goversion=1.16
34+
goversion ?= "1.19"
35+
test_version: ## Run tests inside Docker with given version (defaults to 1.19 oldest supported). Example: make test_version goversion=1.19
3436
@docker run --rm -it -v $(shell pwd):/project golang:$(goversion) /bin/sh -c "cd /project && make init check"

0 commit comments

Comments
 (0)