[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/labstack/echo/v5	v5.4.1 → v5.4.2

---

Release Notes

labstack/echo (github.com/labstack/echo/v5)

v5.4.2

Compare Source

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #​3138, thanks to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #​3135, thanks to @​hoangtaiki.

Upgrade

go get github.com/labstack/echo/v5@v5.4.2

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.

The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.

Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.

Full changelog: labstack/echo@v5.4.1...v5.4.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-10-25 04:46 UTC

Review the latest changes.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🟢 Approval recommended

The focused patch update includes matching checksums, with no identified compatibility issues or blocking findings.

No open issues 🎉

What changed in this PR

Updates Echo from v5.4.1 to v5.4.2 in the Go HTTP conformance scenarios, incorporating upstream Basic authentication and CSRF validation fixes without public API changes.

Changes:

• Bumps the Echo dependency to v5.4.2.
• Adds the corresponding module checksums.

File	Description
scenarios/​http/​go/​go.sum	Adds Echo v5.4.2 checksums.
scenarios/​http/​go/​go.mod	Updates the required Echo version to v5.4.2.

_{Review effort: Balanced}