[ganto]

Summary

Supersedes #169 (Dependabot, Echo 5.4.4).

 go.mod
-go 1.25.0
+go 1.26.0
-github.com/labstack/echo/v5 v5.3.1
+github.com/labstack/echo/v5 v5.4.5
-github.com/spf13/pflag v1.0.10
+github.com/spf13/pflag v1.1.0
-golang.org/x/time v0.15.0
+golang.org/x/time v0.16.0

Echo 5.4.5 strips the IPv6 zone from the peer address before running --trust-proxy checks:

 ExtractIPFromXFFHeader(req)
   directIP = extractIP(req.RemoteAddr)     # [fe80::1%eth0]:1234
-    → "fe80::1%eth0"  → ParseIP fails → X-Forwarded-For ignored
+    → "fe80::1"       → trust check runs → X-Forwarded-For honoured if range trusted

New TestParseTrustProxy rows pin this behaviour. The CHANGELOG covers the effect on remote_ip in logs and on --trust-proxy.

Evidence

• Before (Echo 5.3.1):

  zoned link-local peer trusted via explicit CIDR honours XFF
    trust-proxy=fe80::/10, peer [fe80::1%eth0], XFF 203.0.113.5
    expected "203.0.113.5", actual "fe80::1%eth0"   FAIL
  zoned link-local peer not trusted by default, zone stripped
    trust-proxy=loopback, peer [fe80::1%eth0], XFF 203.0.113.5
    expected "fe80::1",     actual "fe80::1%eth0"   FAIL
  

  After (Echo 5.4.5): both rows pass. make ci-check exits 0 and lint reports 0 issues.

  govulncheck did not run locally because the binary in bin/ was built with Go 1.26 and the local toolchain is Go 1.27. CI should run it.

Merge Danger

Door: two-way

Reverting the commits restores Echo 5.3.1 and Go 1.25.

Blast Radius: narrow

• Building from source now needs Go ≥ 1.26 (e.g. distro builds with GOTOOLCHAIN=local).
• Clients connecting over zoned IPv6 link-local addresses: remote_ip in the access log loses the %zone suffix.
• With --trust-proxy covering fe80::/10, X-Forwarded-For from link-local proxies now takes effect, which changes the logged client IP.

🤖 Generated with Claude Code