Bump the go_modules group across 3 directories with 2 updates
Open
Number: #21365
Type: Pull Request
State: Open
Type: Pull Request
State: Open
Author:
![dependabot[bot]](https://github.com/dependabot.png)
dependabot[bot]
Association: Unknown
Comments: 7
dependabot[bot]Association: Unknown
Comments: 7
Created:
February 25, 2026 at 06:11 AM UTC
(20 days ago)
(20 days ago)
Updated:
February 25, 2026 at 07:06 AM UTC
(19 days ago)
(19 days ago)
Labels:
documentation dependencies Go
documentation dependencies Go
Description:
Bumps the go_modules group with 1 update in the /go/ql/test/experimental/CWE-321-V2 directory: golang.org/x/crypto.
Bumps the go_modules group with 1 update in the /go/ql/test/experimental/CWE-525 directory: github.com/gofiber/fiber/v2.
Bumps the go_modules group with 1 update in the /go/ql/test/library-tests/semmle/go/frameworks/Fiber directory: github.com/gofiber/fiber/v2.
Updates golang.org/x/crypto from 0.12.0 to 0.45.0
Commits
4e0068cgo.mod: update golang.org/x dependenciese79546essh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7ssh/agent: prevent panic on malformed constraint2df4153acme/autocert: let automatic renewal work with short lifetime certsbcf6a84acme: pass context to requestb4f2b62ssh: fix error message on unsupported cipher79ec3a5ssh: allow to bind to a hostname in remote forwarding122a78fgo.mod: update golang.org/x dependenciesc0531f9all: eliminate vet diagnostics0997000all: fix some comments- Additional commits viewable in compare view
Updates github.com/gofiber/fiber/v2 from 2.51.0 to 2.52.12
Release notes
Sourced from github.com/gofiber/fiber/v2's releases.
v2.52.12
🐛 Fixes
- CVE fix GHSA-mrq8-rjmw-wpq3
Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12
v2.52.11
What's Changed
🧹 Updates
- Improve mount functionality by
@gabyin gofiber/fiber#3900🐛 Bug Fixes
- Backport defensive copying fixes from #3828 and #3829 to v2 by
@sixcolorsin gofiber/fiber#3888- Fixes and improvements for limiter middleware by
@gabyin gofiber/fiber#3899Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.10...v2.52.11
v2.52.10
🐛 Bug Fixes
- Handle invalid path in filesystem by
@rokostikin gofiber/fiber#3688- Fix recover middleware panic output formatting by
@ReneWerner87in gofiber/fiber#3818- Fix enforcement of Immutable config for some edge cases by
@gabyin gofiber/fiber#3835📚 Documentation
- Document RoutePatternMatch by
@ReneWerner87in gofiber/fiber#3723New Contributors
@rokostikmade their first contribution in gofiber/fiber#3688Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.10
v2.52.9
🐛 Bug Fixes
- Add upper index limit for parsers by
@gabyin gofiber/fiber#3503- Embedded struct parsing by
@ReneWerner87in gofiber/fiber#3478- Fix Content-Type comparison in
Is()by@gabyin gofiber/fiber#3537- Fix MIME type equality checks by
@gabyin gofiber/fiber#3603Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.8...v2.52.9
v2.52.8
👮 Security
- Fix for BodyParser - GHSA-hg3g-gphw-5hhm
... (truncated)
Commits
6cba195Bump fiber package version to 2.52.125ebbee7docs: update image paths to v2 in README files5028167Merge commit from fork42380aafix: adapt tests for v2 - use defer/recover pattern and correct Handler signa...7cffe29refactor: use helper function for param route generation in tests5494de8🐛 bug: add panic for routes with >30 parameters (GHSA-mrq8-rjmw-wpq3)65b0f3dBump version to 2.52.111b53334Modernize error handling in UUID functions (#3941)eb874b6Merge commit from fork4ff945a🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)- Additional commits viewable in compare view
Updates github.com/gofiber/fiber/v2 from 2.51.0 to 2.52.12
Release notes
Sourced from github.com/gofiber/fiber/v2's releases.
v2.52.12
🐛 Fixes
- CVE fix GHSA-mrq8-rjmw-wpq3
Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12
v2.52.11
What's Changed
🧹 Updates
- Improve mount functionality by
@gabyin gofiber/fiber#3900🐛 Bug Fixes
- Backport defensive copying fixes from #3828 and #3829 to v2 by
@sixcolorsin gofiber/fiber#3888- Fixes and improvements for limiter middleware by
@gabyin gofiber/fiber#3899Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.10...v2.52.11
v2.52.10
🐛 Bug Fixes
- Handle invalid path in filesystem by
@rokostikin gofiber/fiber#3688- Fix recover middleware panic output formatting by
@ReneWerner87in gofiber/fiber#3818- Fix enforcement of Immutable config for some edge cases by
@gabyin gofiber/fiber#3835📚 Documentation
- Document RoutePatternMatch by
@ReneWerner87in gofiber/fiber#3723New Contributors
@rokostikmade their first contribution in gofiber/fiber#3688Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.10
v2.52.9
🐛 Bug Fixes
- Add upper index limit for parsers by
@gabyin gofiber/fiber#3503- Embedded struct parsing by
@ReneWerner87in gofiber/fiber#3478- Fix Content-Type comparison in
Is()by@gabyin gofiber/fiber#3537- Fix MIME type equality checks by
@gabyin gofiber/fiber#3603Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.8...v2.52.9
v2.52.8
👮 Security
- Fix for BodyParser - GHSA-hg3g-gphw-5hhm
... (truncated)
Commits
6cba195Bump fiber package version to 2.52.125ebbee7docs: update image paths to v2 in README files5028167Merge commit from fork42380aafix: adapt tests for v2 - use defer/recover pattern and correct Handler signa...7cffe29refactor: use helper function for param route generation in tests5494de8🐛 bug: add panic for routes with >30 parameters (GHSA-mrq8-rjmw-wpq3)65b0f3dBump version to 2.52.111b53334Modernize error handling in UUID functions (#3941)eb874b6Merge commit from fork4ff945a🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)- Additional commits viewable in compare view
Updates github.com/gofiber/fiber/v2 from 2.48.0 to 2.52.12
Release notes
Sourced from github.com/gofiber/fiber/v2's releases.
v2.52.12
🐛 Fixes
- CVE fix GHSA-mrq8-rjmw-wpq3
Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12
v2.52.11
What's Changed
🧹 Updates
- Improve mount functionality by
@gabyin gofiber/fiber#3900🐛 Bug Fixes
- Backport defensive copying fixes from #3828 and #3829 to v2 by
@sixcolorsin gofiber/fiber#3888- Fixes and improvements for limiter middleware by
@gabyin gofiber/fiber#3899Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.10...v2.52.11
v2.52.10
🐛 Bug Fixes
- Handle invalid path in filesystem by
@rokostikin gofiber/fiber#3688- Fix recover middleware panic output formatting by
@ReneWerner87in gofiber/fiber#3818- Fix enforcement of Immutable config for some edge cases by
@gabyin gofiber/fiber#3835📚 Documentation
- Document RoutePatternMatch by
@ReneWerner87in gofiber/fiber#3723New Contributors
@rokostikmade their first contribution in gofiber/fiber#3688Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.10
v2.52.9
🐛 Bug Fixes
- Add upper index limit for parsers by
@gabyin gofiber/fiber#3503- Embedded struct parsing by
@ReneWerner87in gofiber/fiber#3478- Fix Content-Type comparison in
Is()by@gabyin gofiber/fiber#3537- Fix MIME type equality checks by
@gabyin gofiber/fiber#3603Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.8...v2.52.9
v2.52.8
👮 Security
- Fix for BodyParser - GHSA-hg3g-gphw-5hhm
... (truncated)
Commits
6cba195Bump fiber package version to 2.52.125ebbee7docs: update image paths to v2 in README files5028167Merge commit from fork42380aafix: adapt tests for v2 - use defer/recover pattern and correct Handler signa...7cffe29refactor: use helper function for param route generation in tests5494de8🐛 bug: add panic for routes with >30 parameters (GHSA-mrq8-rjmw-wpq3)65b0f3dBump version to 2.52.111b53334Modernize error handling in UUID functions (#3941)eb874b6Merge commit from fork4ff945a🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)- Additional commits viewable in compare view
Updates github.com/gofiber/fiber/v2 from 2.48.0 to 2.52.12
Release notes
Sourced from github.com/gofiber/fiber/v2's releases.
v2.52.12
🐛 Fixes
- CVE fix GHSA-mrq8-rjmw-wpq3
Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12
v2.52.11
What's Changed
🧹 Updates
- Improve mount functionality by
@gabyin gofiber/fiber#3900🐛 Bug Fixes
- Backport defensive copying fixes from #3828 and #3829 to v2 by
@sixcolorsin gofiber/fiber#3888- Fixes and improvements for limiter middleware by
@gabyin gofiber/fiber#3899Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.10...v2.52.11
v2.52.10
🐛 Bug Fixes
- Handle invalid path in filesystem by
@rokostikin gofiber/fiber#3688- Fix recover middleware panic output formatting by
@ReneWerner87in gofiber/fiber#3818- Fix enforcement of Immutable config for some edge cases by
@gabyin gofiber/fiber#3835📚 Documentation
- Document RoutePatternMatch by
@ReneWerner87in gofiber/fiber#3723New Contributors
@rokostikmade their first contribution in gofiber/fiber#3688Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.10
v2.52.9
🐛 Bug Fixes
- Add upper index limit for parsers by
@gabyin gofiber/fiber#3503- Embedded struct parsing by
@ReneWerner87in gofiber/fiber#3478- Fix Content-Type comparison in
Is()by@gabyin gofiber/fiber#3537- Fix MIME type equality checks by
@gabyin gofiber/fiber#3603Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.8...v2.52.9
v2.52.8
👮 Security
- Fix for BodyParser - GHSA-hg3g-gphw-5hhm
... (truncated)
Commits
6cba195Bump fiber package version to 2.52.125ebbee7docs: update image paths to v2 in README files5028167Merge commit from fork42380aafix: adapt tests for v2 - use defer/recover pattern and correct Handler signa...7cffe29refactor: use helper function for param route generation in tests5494de8🐛 bug: add panic for routes with >30 parameters (GHSA-mrq8-rjmw-wpq3)65b0f3dBump version to 2.52.111b53334Modernize error handling in UUID functions (#3941)eb874b6Merge commit from fork4ff945a🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.
Package Dependencies
Package:
github.com/gofiber/fiber/v2
Ecosystem:
go
go
Version Change:
2.51.0 → 2.52.12
Update Type:
Minor
Minor
Security Advisories
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
GHSA-hg3g-gphw-5hhm
CVE-2025-48075
HIGH
### Summary
When using the `fiber.Ctx.BodyParser` to parse into a struct with range values, a panic occurs when trying to parse a negative range index
### Details
`fiber.Ctx.BodyParser` can map fl...
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
GHSA-mrq8-rjmw-wpq3
CVE-2026-25882
MODERATE
A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability resul...
Technical Details
| ID: | 14114442 |
| UUID: | 3987436423 |
| Node ID: | PR_kwDOCIafrM7GH99q |
| Host: | GitHub |
| Repository: | github/codeql |