Skip to content

deps: bump the all-go-minor-and-patch group across 1 directory with 5 updates - #5150

Open
dependabot[bot] wants to merge 1 commit into
release/v1.7from
dependabot/go_modules/release/v1.7/all-go-minor-and-patch-25ff7f4d77
Open

deps: bump the all-go-minor-and-patch group across 1 directory with 5 updates#5150
dependabot[bot] wants to merge 1 commit into
release/v1.7from
dependabot/go_modules/release/v1.7/all-go-minor-and-patch-25ff7f4d77

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-go-minor-and-patch group with 5 updates in the / directory:

Package From To
google.golang.org/grpc 1.84.0 1.85.0
github.com/labstack/echo/v4 4.16.0 4.16.2
github.com/prometheus/common 0.72.1 0.73.0
golang.org/x/net 0.61.0 0.62.0
github.com/cilium/cilium 1.18.15 1.18.16

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
Commits

Updates github.com/labstack/echo/v4 from 4.16.0 to 4.16.2

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.2

Fixes

  • Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
  • Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
  • Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

  • Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
  • Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
  • Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
  • Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
  • Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
  • Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

... (truncated)

Commits
  • 679c415 chore: prepare v4.16.2 release (#3191)
  • 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
  • 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
  • ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
  • 600b985 chore: prepare v4.16.1 security release (#3186)
  • 3fb0ba7 Merge commit from fork
  • be08005 fix(router): grow param values for contexts created before a route with more ...
  • 320fe67 fix(bind): honor OpenAPI date, date-time and date-time-local format tags (v4)...
  • f085ffb fix(router): handle escaped colons and inline verbs in v4 (#3132)
  • 5440f99 fix(middleware): prevent BodyLimit bypass in v4 (#3131)
  • Additional commits viewable in compare view

Updates github.com/prometheus/common from 0.72.1 to 0.73.0

Release notes

Sourced from github.com/prometheus/common's releases.

v0.73.0

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.72.1...v0.73.0

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

Commits

Updates golang.org/x/net from 0.61.0 to 0.62.0

Commits
  • 3de643d html: check all ancestor namespace transitions when rendering raw text
  • 05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
  • dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
  • 9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
  • 9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
  • 4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
  • afcf8cd ipv4: fix several missing bounds checks
  • 4af4fce html: avoid quadratic complexity when coalescing text nodes
  • 7e56200 quic: per-path connection ids
  • See full diff in compare view

Updates github.com/cilium/cilium from 1.18.15 to 1.18.16

Release notes

Sourced from github.com/cilium/cilium's releases.

1.18.16

Security patch release

Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.

Summary of Changes

Bugfixes:

  • CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR cilium/cilium#49476, Upstream PR cilium/cilium#49076, @​maxskokov)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.16@sha256:7e101fc20997b226330dadc1142849a6bf42745fb8f892adfa49b80a078d23b9

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.16@sha256:f67a6f55cce5d067b21aeae46448e3177e34924dfe543619ef512937d042e5cf

docker-plugin

quay.io/cilium/docker-plugin:v1.18.16@sha256:0de458d3a8f43271f7ee3fd5eb362175751ea5083be9275d8bce30337d89ff5d

hubble-relay

quay.io/cilium/hubble-relay:v1.18.16@sha256:312eda66f166d7e327056dc8d412a2c65936765fbd02688260397f183b822bb4

operator-alibabacloud

... (truncated)

Changelog

Sourced from github.com/cilium/cilium's changelog.

v1.18.16

Summary of Changes

Bugfixes:

  • CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR cilium/cilium#49476, Upstream PR cilium/cilium#49076, @​maxskokov)

CI Changes:

Misc Changes:

Other Changes:

Commits
  • 4dd7ec8 Prepare for release v1.18.16
  • 34072f4 chore(deps): update auto-merge-trusted-deps
  • b88a8ee Revert "Prepare for release v1.18.16"
  • c27239a Prepare for release v1.18.16
  • 5aa65f0 docs: clarify cosign documentation to prevent issues due to old versions
  • e49cc9f ciliumenvoyconfig: scope service references to the CEC namespace
  • 4fb5a5a images: update cilium-{runtime,builder}
  • 32482a0 chore(deps): update auto-merge-trusted-deps
  • 53bb689 chore(deps): update stable lvh-images
  • 6443aee chore(deps): update dependency sphinxcontrib-openapi to v0.10.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the all-go-minor-and-patch group across 1 directory with 5…
b480ce8 
… updates

Bumps the all-go-minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.84.0` | `1.85.0` |
| [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.16.0` | `4.16.2` |
| [github.com/prometheus/common](https://github.com/prometheus/common) | `0.72.1` | `0.73.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.61.0` | `0.62.0` |
| [github.com/cilium/cilium](https://github.com/cilium/cilium) | `1.18.15` | `1.18.16` |



Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.84.0...v1.85.0)

Updates `github.com/labstack/echo/v4` from 4.16.0 to 4.16.2
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v4.16.0...v4.16.2)

Updates `github.com/prometheus/common` from 0.72.1 to 0.73.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)
- [Commits](prometheus/common@v0.72.1...v0.73.0)

Updates `golang.org/x/net` from 0.61.0 to 0.62.0
- [Commits](golang/net@v0.61.0...v0.62.0)

Updates `github.com/cilium/cilium` from 1.18.15 to 1.18.16
- [Release notes](https://github.com/cilium/cilium/releases)
- [Changelog](https://github.com/cilium/cilium/blob/1.18.16/CHANGELOG.md)
- [Commits](cilium/cilium@1.18.15...1.18.16)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-minor-and-patch
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-minor-and-patch
- dependency-name: github.com/prometheus/common
  dependency-version: 0.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-minor-and-patch
- dependency-name: github.com/cilium/cilium
  dependency-version: 1.18.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner November 4, 2026 09:54
@dependabot dependabot Bot added the dependencies Dependencies only. label Nov 4, 2026
Copilot AI balanced review requested due to automatic review settings November 4, 2026 09:54
@dependabot dependabot Bot added the release/1.7 Change affects v1.7 release train label Nov 4, 2026
@azure-pipelines

azure-pipelines Bot commented Nov 4, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI reviewed Nov 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the dependency and checksum updates.

No open issues 🎉

What changed in this PR

Updates the root Go module’s dependencies for Azure Container Networking, incorporating upstream fixes and improvements without changing application code.

Changes:

  • Upgrades gRPC, Echo, Prometheus common, golang.org/x/net, and Cilium.
  • Updates supporting indirect dependencies and module checksums.
File Description
go.sum Refreshes checksums for upgraded and newly added dependencies.
go.mod Updates five dependency versions and related indirect requirements.

Review effort: Balanced

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@ramiro-gamarra Ramiro (ramiro-gamarra) Awaiting requested review from ramiro-gamarra ramiro-gamarra is a code owner automatically assigned from Azure/azure-sdn-members

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependencies only. release/1.7 Change affects v1.7 release train

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant