[dependabot]

Bumps the go group with 5 updates in the / directory:

Package	From	To
github.com/godbus/dbus/v5	5.2.2	5.2.4
github.com/labstack/echo/v4	4.16.0	4.16.3
github.com/urfave/cli/v3	3.13.0	3.14.0
golang.org/x/sync	0.23.0	0.24.0
tailscale.com	1.102.5	1.104.4

Updates github.com/godbus/dbus/v5 from 5.2.2 to 5.2.4

Release notes

Sourced from github.com/godbus/dbus/v5's releases.

v5.2.4

What's Changed

• conn: return the system bus error on every OS by @​SashaMIT in godbus/dbus#448

New Contributors

• @​SashaMIT made their first contribution in godbus/dbus#448

Full Changelog: godbus/dbus@v5.2.3...v5.2.4

v5.2.3

What's Changed

• README: update by @​kolyshkin in godbus/dbus#431
• Switch from reflect.Ptr to reflect.Pointer by @​kolyshkin in godbus/dbus#430
• mediakeys.go example: Fix error handling. by @​smu-ggl in godbus/dbus#433
• Test/fix CI issues by @​guelfey in godbus/dbus#439
• Misc CI bumps; replace cirrus freebsd with GHA; add all-done job by @​kolyshkin in godbus/dbus#420
• make GOOS=js GOARCH=wasm go build ./... work by @​eliasnaur in godbus/dbus#435
• Do not swallow non-error panics in Encode/Decode by @​kolyshkin in godbus/dbus#438
• Fix panic in DecodeMessageWithFDs on read error by @​kolyshkin in godbus/dbus#437
• Do not embed reflect.Value into exportedMethod by @​kolyshkin in godbus/dbus#436
• Add godbus_no_tcp build tag to disable tcp transports by @​kolyshkin in godbus/dbus#444
• CI: bump golangci-lint to 2.14 by @​guelfey in godbus/dbus#447
• Do not trust lengths from the input when allocating by @​kolyshkin in godbus/dbus#442
• conn: support /run and /var/run default addresses by @​twilly in godbus/dbus#424

New Contributors

• @​smu-ggl made their first contribution in godbus/dbus#433
• @​eliasnaur made their first contribution in godbus/dbus#435
• @​twilly made their first contribution in godbus/dbus#424

Full Changelog: godbus/dbus@v5.2.2...v5.2.3

Commits

• 4e46d5e Merge pull request #448 from SashaMIT/fix/system-bus-error
• 2d04606 conn: return the system bus error on every OS
• 4ad7526 Merge pull request #424 from twilly/linux-system-bus-address
• 9f81f26 conn: support /run and /var/run default addresses
• b3c0de5 Merge pull request #442 from kolyshkin/fuzz-oom
• c0b1b46 Do not trust lengths from the input when allocating
• 51e6822 Merge pull request #447 from godbus/fix/ci_bump_lint
• ec94797 CI: bump golangci-lint to 2.14
• ad906d5 Merge pull request #444 from kolyshkin/no-tcp-tag
• d7c5c0b Add godbus_no_tcp build tag to disable tcp transports
• Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.16.0 to 4.16.3

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.3

Security and migration

Applications behind proxies must configure Echo#IPExtractor to trust their own proxies before upgrading. Without an extractor, clients behind one proxy share its address for rate limiting, IP-based access controls, logging, and proxy forwarding. The safe default now ignores client-supplied IP headers.

This release fixes the remaining v4 exposure for:

• CVE-2026-118651: Proxy always derives upstream X-Real-IP from Context.RealIP(), including after hop-by-hop header stripping and on WebSocket upgrades. One derived identity is preserved across retries.
• CVE-2026-118653: Context.RealIP() uses the connection peer when IPExtractor is unset, so rotating spoofed forwarded-IP headers cannot create fresh default rate-limit buckets.

Use echo.ExtractIPDirect() without a proxy. Behind a proxy, use ExtractIPFromXFFHeader or ExtractIPFromRealIPHeader with trust restricted to your proxies. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Migration example with explicit proxy trust ranges

Other changes

• Resolve bare IPv4 and IPv6 connection addresses without a port.
• Document v4 support dates (#3194).

No dependency or minimum Go-version changes; Go 1.26 or later remains required.

The security fix (#3197) passed independent agent and Claude reviews, full race tests on Go 1.26 and 1.27, and GitHub Linux/macOS/Windows checks.

Full Changelog: labstack/echo@v4.16.2...v4.16.3

v4.16.2

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
• Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.16.3 - 2026-10-29

Security

• Client IP defaults: when Echo#IPExtractor is unset, Context.RealIP() now uses the connection peer and ignores X-Forwarded-For and X-Real-IP. This prevents clients from selecting their own default rate-limit bucket. Fixes CVE-2026-118653.
• Proxy identity: Proxy middleware always replaces upstream X-Real-IP with the derived client identity, including after Connection-nominated header removal and on WebSocket upgrades. The identity is derived once and preserved across retries. Fixes CVE-2026-118651.

Migration required for applications behind proxies

Configure Echo#IPExtractor to trust only your deployment's proxies before upgrading. Otherwise, clients behind one proxy share its address for rate limiting, access controls, logging, and proxy forwarding. See the README migration example for explicit XFF trust ranges; use the same trust options with ExtractIPFromRealIPHeader for proxies that set X-Real-IP. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Other changes

• The direct-peer fallback now accepts bare IPv4 and IPv6 addresses without a port.
• Document v4 bug-fix and security-fix support dates (#3194).

Implementation: #3197. No dependency or minimum Go-version changes; Go 1.26 or later remains required.

Commits

• c99c7cb chore: prepare v4.16.3 security release (#3198)
• ebbb855 fix: secure v4 client IP defaults for proxying and rate limiting (#3197)
• fa780cd docs: state v4 bug-fix and security-fix dates (#3194)
• 679c415 chore: prepare v4.16.2 release (#3191)
• 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
• 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
• ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
• 600b985 chore: prepare v4.16.1 security release (#3186)
• 3fb0ba7 Merge commit from fork
• be08005 fix(router): grow param values for contexts created before a route with more ...
• Additional commits viewable in compare view

Updates github.com/urfave/cli/v3 from 3.13.0 to 3.14.0

Release notes

Sourced from github.com/urfave/cli/v3's releases.

v3.14.0

What's Changed

• chore(deps): bump mkdocs-git-revision-date-localized-plugin from 1.5.4 to 1.6.0 in the python-packages group by @​dependabot[bot] in urfave/cli#2436
• fix: set BoolWithInverseFlag in a short option group by @​lazerg in urfave/cli#2440
• Keep arguments after a bare dash by @​official-burak in urfave/cli#2419
• fix: handle a multi-byte flag at the end of a short option group by @​SulimanAbdulrazzaq in urfave/cli#2438
• fix: complete persistent flags in shell completion by @​sb123sb123 in urfave/cli#2437
• fix: restore Unwrap on the error returned by Exit by @​fadiroot in urfave/cli#2444
• fix: reject a parent's Local flag inside a short option group by @​fadiroot in urfave/cli#2445
• fix: report a flag that needs an argument but is not last in a short group by @​yu2971512385-ui in urfave/cli#2443
• Use prefixFor so flag suggestions agree with help on rune count by @​januththedev in urfave/cli#2448
• fix: reject duplicate flag names by @​deepakganesh78 in urfave/cli#2396
• fix: date a time-only timestamp today when Timezone is not UTC by @​breken-ai in urfave/cli#2450
• fix: let a subcommand's command-line value replace a persistent flag's env/file value by @​breken-ai in urfave/cli#2449
• Add urfave_cli_no_template build tag by @​kolyshkin in urfave/cli#2441
• fix: skip empty source values for flags that cannot parse them by @​abo3losh1 in urfave/cli#2451

New Contributors

• @​lazerg made their first contribution in urfave/cli#2440
• @​official-burak made their first contribution in urfave/cli#2419
• @​SulimanAbdulrazzaq made their first contribution in urfave/cli#2438
• @​sb123sb123 made their first contribution in urfave/cli#2437
• @​fadiroot made their first contribution in urfave/cli#2444
• @​yu2971512385-ui made their first contribution in urfave/cli#2443
• @​januththedev made their first contribution in urfave/cli#2448
• @​deepakganesh78 made their first contribution in urfave/cli#2396
• @​breken-ai made their first contribution in urfave/cli#2450
• @​abo3losh1 made their first contribution in urfave/cli#2451

Full Changelog: urfave/cli@v3.13.0...v3.14.0

Commits

• 2f64589 Merge pull request #2451 from abo3losh1/fix/empty-env-source-not-set
• 72a6466 docs: describe empty values for any source, not only environment variables
• c40d7b3 test: cover an empty file source in TestFlagFromEmptyFileSource
• ea94516 Merge remote-tracking branch 'origin/main' into fix/empty-env-source-not-set
• f6f38ed Merge pull request #2441 from kolyshkin/no-template-tag
• 925b1e3 Merge pull request #2449 from breken-ai/fix/persistent-flag-source-override
• 4dac5a8 test: cover slice separator and cmd.Set after a source value
• 4d537c9 docs: say how an empty environment variable is treated
• 41ce75f test: cover empty source values in TestFlagsFromEmptyEnv
• 72f4bbb fix: skip empty source values for flags that cannot parse them
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits

• 36f2d70 errgroup: modernize the usage of closures in goroutines
• See full diff in compare view

Updates tailscale.com from 1.102.5 to 1.104.4

[ethanjli]

@dependabot rebase