Skip to content

fix(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] #208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] #208

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link

@renovate renovate bot commented Nov 26, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
github.com/gin-gonic/gin v1.7.7 -> v1.9.1 age confidence

Improper input validation in github.com/gin-gonic/gin

CVE-2023-26125 / GHSA-3vp4-m3rf-835h

More information

Details

Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.

Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

Severity

  • CVSS Score: 5.6 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function

CVE-2023-29401 / GHSA-2c4m-59x9-fr2g / GO-2023-1737

More information

Details

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

Severity

  • CVSS Score: 4.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

CVE-2023-29401 / GHSA-2c4m-59x9-fr2g / GO-2023-1737

More information

Details

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

gin-gonic/gin (github.com/gin-gonic/gin)

v1.9.1

Compare Source

BUG FIXES
SECURITY
  • fix lack of escaping of filename in Content-Disposition #​3556
ENHANCEMENTS
  • refactor: use bytes.ReplaceAll directly #​3455
  • convert strings and slices using the officially recommended way #​3344
  • improve render code coverage #​3525
DOCS
  • docs: changed documentation link for trusted proxies #​3575
  • chore: improve linting, testing, and GitHub Actions setup #​3583

v1.9.0

Compare Source

BREAK CHANGES
  • Stop useless panicking in context and render #​2150
BUG FIXES
  • fix(router): tree bug where loop index is not decremented. #​3460
  • fix(context): panic on NegotiateFormat - index out of range #​3397
  • Add escape logic for header #​3500 and #​3503
SECURITY
  • Fix the GO-2022-0969 and GO-2022-0288 vulnerabilities #​3333
  • fix(security): vulnerability GO-2023-1571 #​3505
ENHANCEMENTS
  • feat: add sonic json support #​3184
  • chore(file): Creates a directory named path #​3316
  • fix: modify interface check way #​3327
  • remove deprecated of package io/ioutil #​3395
  • refactor: avoid calling strings.ToLower twice #​3343
  • console logger HTTP status code bug fixed #​3453
  • chore(yaml): upgrade dependency to v3 version #​3456
  • chore(router): match method added to routergroup for multiple HTTP methods supporting #​3464
  • chore(http): add support for go1.20 http.rwUnwrapper to gin.responseWriter #​3489
DOCS
  • docs: update markdown format #​3260
  • docs(readme): Add the TOML rendering example #​3400
  • docs(readme): move more example to docs/doc.md #​3449
  • docs: update markdown format #​3446

v1.8.2

Compare Source

BUG FIXES
SECURITY

v1.8.1

Compare Source

ENHANCEMENTS
  • feat(context): add ContextWithFallback feature flag #​3172

v1.8.0

Compare Source

BREAK CHANGES
  • TrustedProxies: Add default IPv6 support and refactor #​2967. Please replace RemoteIP() (net.IP, bool) with RemoteIP() net.IP
  • gin.Context with fallback value from gin.Context.Request.Context() #​2751
BUG FIXES
  • Fixed SetOutput() panics on go 1.17 #​2861
  • Fix: wrong when wildcard follows named param #​2983
  • Fix: missing sameSite when do context.reset() #​3123
ENHANCEMENTS
  • Use Header() instead of deprecated HeaderMap #​2694
  • RouterGroup.Handle regular match optimization of http method #​2685
  • Add support go-json, another drop-in json replacement #​2680
  • Use errors.New to replace fmt.Errorf will much better #​2707
  • Use Duration.Truncate for truncating precision #​2711
  • Get client IP when using Cloudflare #​2723
  • Optimize code adjust #​2700
  • Optimize code and reduce code cyclomatic complexity #​2737
  • Improve sliceValidateError.Error performance #​2765
  • Support custom struct tag #​2720
  • Improve router group tests #​2787
  • Fallback Context.Deadline() Context.Done() Context.Err() to Context.Request.Context() #​2769
  • Some codes optimize #​2830 #​2834 #​2838 #​2837 #​2788 #​2848 #​2851 #​2701
  • TrustedProxies: Add default IPv6 support and refactor #​2967
  • Test(route): expose performRequest func #​3012
  • Support h2c with prior knowledge #​1398
  • Feat attachment filename support utf8 #​3071
  • Feat: add StaticFileFS #​2749
  • Feat(context): return GIN Context from Value method #​2825
  • Feat: automatically SetMode to TestMode when run go test #​3139
  • Add TOML bining for gin #​3081
  • IPv6 add default trusted proxies #​3033
DOCS
  • Add note about nomsgpack tag to the readme #​2703

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Author

renovate bot commented Nov 26, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: downloading github.com/gin-contrib/cors v1.3.0
go: downloading github.com/stretchr/testify v1.8.3
go: downloading github.com/mattn/go-isatty v0.0.19
go: downloading golang.org/x/net v0.10.0
go: downloading github.com/go-playground/validator/v10 v10.14.0
go: downloading github.com/pelletier/go-toml/v2 v2.0.8
go: downloading github.com/ugorji/go/codec v1.2.11
go: downloading github.com/ugorji/go v1.1.4
go: downloading google.golang.org/protobuf v1.30.0
go: downloading github.com/bytedance/sonic v1.9.1
go: downloading golang.org/x/sys v0.8.0
go: downloading github.com/gabriel-vasile/mimetype v1.4.2
go: downloading github.com/leodido/go-urn v1.2.4
go: downloading golang.org/x/crypto v0.9.0
go: downloading golang.org/x/text v0.9.0
go: downloading github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311
go: downloading golang.org/x/arch v0.3.0
go: downloading github.com/klauspost/cpuid/v2 v2.2.4
go: downloading github.com/ugorji/go/codec v1.3.1
go: downloading github.com/ugorji/go v1.2.14
go: github.com/nethesis/icaro/ade/ade-api imports
	github.com/gin-gonic/gin imports
	github.com/gin-gonic/gin/binding imports
	github.com/ugorji/go/codec: ambiguous import: found package github.com/ugorji/go/codec in multiple modules:
	github.com/ugorji/go v1.1.4 (/runner/cache/others/go/pkg/mod/github.com/ugorji/[email protected]/codec)
	github.com/ugorji/go/codec v1.3.1 (/runner/cache/others/go/pkg/mod/github.com/ugorji/go/[email protected])

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant