From 3d10ff7e91b3144f1d416e0bcc67024d597f67a4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 16:52:45 +0000 Subject: [PATCH 1/4] build(deps): bump github.com/labstack/echo/v5 from 5.3.1 to 5.4.4 Bumps [github.com/labstack/echo/v5](https://github.com/labstack/echo) from 5.3.1 to 5.4.4. - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md) - [Commits](https://github.com/labstack/echo/compare/v5.3.1...v5.4.4) --- updated-dependencies: - dependency-name: github.com/labstack/echo/v5 dependency-version: 5.4.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5a4f7cd..dfe6eb4 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/ganto/pkgproxy go 1.25.0 require ( - github.com/labstack/echo/v5 v5.3.1 + github.com/labstack/echo/v5 v5.4.4 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 gopkg.in/yaml.v3 v3.0.1 diff --git a/go.sum b/go.sum index ee0f170..1b3f98d 100644 --- a/go.sum +++ b/go.sum @@ -1,8 +1,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/labstack/echo/v5 v5.3.1 h1:75maCxkQVGualckLc/5s/ihgpH1a1Dc6AuGWNVNs6bw= -github.com/labstack/echo/v5 v5.3.1/go.mod h1:4iEGNQiPPZnkfYpNR/L6fINd3NLiGWUD5+eBotFALas= +github.com/labstack/echo/v5 v5.4.4 h1:Nag9Mee0M9sOcKjProYuDNiw60QisysgfbIgz5US5Cw= +github.com/labstack/echo/v5 v5.4.4/go.mod h1:4iEGNQiPPZnkfYpNR/L6fINd3NLiGWUD5+eBotFALas= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= From 130fd3f872dc5e8395f9165061d938440dcda854 Mon Sep 17 00:00:00 2001 From: Reto Gantenbein Date: Fri, 13 Nov 2026 23:13:46 +0100 Subject: [PATCH 2/4] Changelog: Add entry about updated labstack/echo/v5 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e72ed41..1bbe62c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Changed +- Upgraded Echo web framework to v5.4.4 - Reject upstream redirects that downgrade from HTTPS to HTTP ### Fixed From cf104d4090dc30ac83211addf4a1e534b37fea99 Mon Sep 17 00:00:00 2001 From: Reto Gantenbein Date: Fri, 13 Nov 2026 23:15:26 +0100 Subject: [PATCH 3/4] go.mod: Use Go 1.26 and run another round of updates --- CHANGELOG.md | 2 +- go.mod | 8 ++++---- go.sum | 12 ++++++------ 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1bbe62c..cde762d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Changed -- Upgraded Echo web framework to v5.4.4 +- Upgraded Echo web framework to v5.4.5 - Reject upstream redirects that downgrade from HTTPS to HTTP ### Fixed diff --git a/go.mod b/go.mod index dfe6eb4..890d35a 100644 --- a/go.mod +++ b/go.mod @@ -1,9 +1,9 @@ module github.com/ganto/pkgproxy -go 1.25.0 +go 1.26.0 require ( - github.com/labstack/echo/v5 v5.4.4 + github.com/labstack/echo/v5 v5.4.5 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 gopkg.in/yaml.v3 v3.0.1 @@ -11,7 +11,7 @@ require ( require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/spf13/pflag v1.0.10 // indirect + github.com/spf13/pflag v1.1.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/time v0.15.0 // indirect + golang.org/x/time v0.16.0 // indirect ) diff --git a/go.sum b/go.sum index 1b3f98d..dee145c 100644 --- a/go.sum +++ b/go.sum @@ -1,14 +1,14 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/labstack/echo/v5 v5.4.4 h1:Nag9Mee0M9sOcKjProYuDNiw60QisysgfbIgz5US5Cw= -github.com/labstack/echo/v5 v5.4.4/go.mod h1:4iEGNQiPPZnkfYpNR/L6fINd3NLiGWUD5+eBotFALas= +github.com/labstack/echo/v5 v5.4.5 h1:lEPtXOQXgDcJNgrFy85WU2xBPZ/m9R2R+pc4eAxymjA= +github.com/labstack/echo/v5 v5.4.5/go.mod h1:4iEGNQiPPZnkfYpNR/L6fINd3NLiGWUD5+eBotFALas= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= -github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.1.0 h1:6W6MbVUrnMb8PEhjkqwsVLY7ryuzRfFHF4mQd7L94ag= +github.com/spf13/pflag v1.1.0/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= @@ -18,8 +18,8 @@ golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= +golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= From 7eed08a1c75b8c5cfa8a884190e3b203a131cc76 Mon Sep 17 00:00:00 2001 From: Reto Gantenbein Date: Fri, 13 Nov 2026 23:27:13 +0100 Subject: [PATCH 4/4] cmd: Pin trust-proxy behaviour for zoned IPv6 link-local peers Echo v5.4.5 strips the IPv6 zone from the direct peer address, so X-Forwarded-For from zoned link-local proxies is now honoured when the operator trusts their range. Add test cases for this and document the user-visible change in the changelog. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + cmd/serve_test.go | 14 ++++++++++++++ 2 files changed, 15 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cde762d..107a670 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ### Changed - Upgraded Echo web framework to v5.4.5 +- Strip IPv6 zone from logged client IPs; `--trust-proxy` now matches zoned link-local proxies - Reject upstream redirects that downgrade from HTTPS to HTTP ### Fixed diff --git a/cmd/serve_test.go b/cmd/serve_test.go index 3c907c0..eb79075 100644 --- a/cmd/serve_test.go +++ b/cmd/serve_test.go @@ -255,6 +255,20 @@ func TestParseTrustProxy(t *testing.T) { xff: "203.0.113.5", wantIP: "203.0.113.5", }, + { + name: "zoned link-local peer trusted via explicit CIDR honours XFF", + value: "fe80::/10", + remoteAddr: "[fe80::1%eth0]:1234", + xff: "203.0.113.5", + wantIP: "203.0.113.5", + }, + { + name: "zoned link-local peer not trusted by default, zone stripped", + value: "loopback", + remoteAddr: "[fe80::1%eth0]:1234", + xff: "203.0.113.5", + wantIP: "fe80::1", + }, { name: "combined loopback and CIDR trusts loopback", value: "loopback,10.0.0.0/8",