[PLAT-3444] Security Updates - upgrade logger-go, echo, x/crypto, x/net - 2026-08

[wernermorgenstern]

PLAT-3444

What this does

Clears 36 of 37 open Dependabot alerts on main: 9 of 9 critical, 12 of 13 high, 15 of 15 medium.

Module	From	To	Alerts closed
golang.org/x/crypto	v0.0.0-20210817164053	v0.55.0	8 critical, 5 high, 7 medium
golang.org/x/net	v0.0.0-20211015210444	v0.58.0	4 high, 7 medium
github.com/labstack/echo/v4	v4.7.2	v4.15.3	1 critical, 1 high
golang.org/x/text	v0.3.7	v0.41.0	1 high
gopkg.in/yaml.v3	v3.0.0-20210107192922	v3.0.1	1 high
golang.org/x/sys	v0.0.0-20211103235746	v0.47.0	1 medium

testify moves v1.7.0 to v1.11.1 as a consequence of go mod tidy resolving the new graph. Test-only.

Counts were measured against the GitHub Dependabot API on the default branch, not read off a vendor export.

The go directive moves 1.21 to 1.25, and it has to

Every one of the fix versions above declares go 1.25.0 in its own go.mod, confirmed against proxy.golang.org:

Module version	Declared go directive
golang.org/x/crypto v0.52.0 (first patched)	go 1.25.0
golang.org/x/net v0.55.0 (first patched)	go 1.25.0
github.com/labstack/echo/v4 v4.15.3	go 1.25.0

There is no combination of patched releases that resolves under go 1.21. Since this is a published library, the directive propagates to consumers.

Consumers, found via gh search code "lob/sentry-echo" --owner lob:

• lob/sid
• lob/tracking-api
• lob/mock

All three already depend on lob/logger-go, which is itself at go 1.25.14, so in practice they are on a toolchain that satisfies this. Flagging it explicitly rather than leaving it to be discovered.

ci.yml reads go-version-file: go.mod, so CI picks the new toolchain up with no workflow edit.

Why the lint step changed

golangci-lint-action@v6 installs golangci-lint v1.64.8, which is built with go1.24 and aborts on a module targeting anything newer:

can't load config: the Go language version (go1.24) used to build golangci-lint
is lower than the targeted Go version (1.25.0)

v1.64.x is the end of the v1 line, so no v1 release can lint this module. The action moves to @v9 with version: v2.13.

This is not an unrelated cleanup. Dependabot's own echo/v4 4.15.3 pull request (#23) hit this exact failure on 2026-08-25, with the Test step green and only Lint red. Verified locally against golangci-lint v2.13.1 (built with go1.27.0): 0 issues, and no .golangci.yml is needed since the repo has none.

The one alert this does not close

github.com/labstack/echo v3.3.10+incompatible, CVE-2026-55677 (high) — encoded slash bypasses route-level protection.

Echo v3 is end of life. GitHub reports no patched version, and none will be published, so it cannot be bumped.

It is not a direct dependency. go mod why traces it to exactly one path:

github.com/lob/sentry-echo/pkg
github.com/lob/logger-go
github.com/labstack/echo

logger-go's own root package imports Echo v3, and our pkg imports logger-go. The fix would be logger-go@v1.11.0, which no longer requires Echo v3 at all.

That upgrade is not reachable from this repo. lob/logger-go is private, and proxy.golang.org serves only up to v1.5.0 for it (the module went private after that release). Every proxy-reachable version, v1.0.0 through v1.5.0, still requires github.com/labstack/echo v3.3.10+incompatible — so bumping to the highest fetchable version buys nothing. This repo is public and has zero organization secrets and zero repo secrets, so CI cannot authenticate to fetch a private module.

Options for closing it are recorded on PLAT-3444 for a decision. Nothing here suppresses or hides the alert.

Verification

Run in the worktree against this branch:

Check	Result
go build ./...	exit 0
ENVIRONMENT=test go test ./... -race	pass
go vet ./...	clean
golangci-lint v2.13.1	0 issues
go mod graph for labstack/echo@v3	2 rows, expected, see above

Coverage is unchanged: pkg 97.1%, pkg/sentry 97.4%, internal/test 0.0%, total 81%.

Note the repo's make enforce threshold is 90% and the total fails it at 81% on origin/main too — measured on a clean detached checkout of ac1e883, with byte-identical per-package numbers. It is pre-existing, driven by the internal/test helper package having no tests, and make enforce is not a step in ci.yml so it gates nothing. This change neither causes nor fixes it.

No new tests were added. The bumps are all transitive infrastructure (TLS, HTTP/2, YAML, text encoding) plus one framework minor. The existing suite already exercises the two call paths that touch the upgraded packages — pkg/logger_test.go for logger.New / logger.Data and pkg/handler_test.go for the Echo handler — at 97% coverage, and both pass with the race detector.

Also included

.github/dependabot.yml, which the repo did not have. Mirrors lob/lob-nomad-autoscaler, the only Go sibling that has one, minus its docker block. Covers gomod and github-actions.

The github-actions ecosystem will pick up the stale actions/checkout@v4 and actions/setup-go@v5 pins that currently emit Node 20 deprecation warnings. Deliberately left to Dependabot rather than bundled here.

Out of scope

• Replacing github.com/getsentry/raven-go v0.2.0, Sentry's deprecated legacy SDK, with sentry-go. No Dependabot alert against it, and the swap is a rewrite.
• Self-hosted lob-runner. This repo is public and the org's Ephemeral runner group is private-repo-only, which was diagnosed and reverted here in August 2026. Stays on ubuntu-latest.
• Closing superseded Dependabot pull requests chore(deps): bump golang.org/x/net from 0.0.0-20211015210444-4f30a5c0130f to 0.55.0 #21, chore(deps): bump gopkg.in/yaml.v3 from 3.0.0-20210107192922-496545a6307b to 3.0.1 #22 and chore(deps): bump github.com/labstack/echo/v4 from 4.7.2 to 4.15.3 #23. This branch covers all three; flagging rather than closing them.

[wernermorgenstern]

8098778: now 37 of 37 — the last alert is closed

The one high this PR previously could not fix is fixed.

	Before this commit	After
Critical	0 of 9 open	0 of 9 open
High	1 of 13 open (echo v3)	0 of 13 open
Medium	0 of 15 open	0 of 15 open
go mod graph rows for labstack/echo@v3	2	0

logger-go v1.3.0 to v1.11.0 is what removes it. That version no longer requires Echo v3, and since sentry-echo uses only logger.Logger, logger.New and logger.Data — all stable across v1 — no source file changed.

Why vendor/ is in this PR

github.com/lob/logger-go is private, and proxy.golang.org only serves up to v1.5.0 for it — every one of which still requires Echo v3, so the highest fetchable proxy version buys nothing. This repo is public, so CI has no way to authenticate.

That was verified rather than assumed:

• All nine organization Actions secrets are visibility=private. None is scoped all or selected, so this is a structural limit, not a misconfiguration.
• Of the 23 non-archived public Lob repos, 10 carry repo-level secrets. Every one is a Lob API key for integration tests or a publish/deploy credential. The only two GitHub tokens, both in lob-openapi, are an actions/checkout push token and a workflow-dispatch token — neither reads another repo's private source.
• sentry-echo is the only public Lob Go repo that depends on a private Lob module. lob-go and nomad-autoscaler-cloudwatch-apm have no github.com/lob/* requirement at all.

So there was no existing pattern to copy. Vendoring is the option that needs nobody else's approval.

Proof that CI needs no credentials

Run locally with GOPRIVATE unset and GOPROXY=off, which is stricter than CI's real conditions:

Check	Result
go build ./...	exit 0
go test ./... -race	pass
go vet ./...	clean
golangci-lint v2.13.1	0 issues

And confirmed on the real thing: workflow run 33035589546 on this branch is green on every step — Checkout, Setup Go, Test, Lint, Build.

The cost, stated plainly

627 vendored files, about 14 MB, committed to a public repo. Every future dependency bump will churn that tree, which makes future Dependabot PRs here noisier to read.

The alternative that avoids all of it is making lob/logger-go public, after which this becomes a one-line bump and vendor/ can be deleted. That needs an owner decision and is deliberately left open rather than assumed — see PLAT-3444.

.gitignore's vendor/* entry is removed and replaced with a comment explaining why the tree is committed, so a future reader does not delete it as accidental.

Review guidance

The reviewable diff is three files: .gitignore (5 lines), go.mod (9) and go.sum (63). The other 626 files are machine-generated by go mod vendor and can be regenerated at any time with GOPRIVATE=github.com/lob/* and go mod vendor.