Bump the gomod group with 3 updates

[dependabot]

Bumps the gomod group with 3 updates: github.com/labstack/echo/v4, github.com/nats-io/nats.go and modernc.org/sqlite.

Updates github.com/labstack/echo/v4 from 4.15.0 to 4.15.1

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

Changelog

v5.0.4 - 2026-02-15

Enhancements

• Remove unused import 'errors' from README example by @​kumapower17 in labstack/echo#2889
• Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @​aldas in labstack/echo#2898
• Update location of oapi-codegen in README by @​mromaszewicz in labstack/echo#2896
• Add Go 1.26 to CI flow by @​aldas in labstack/echo#2899
• Add new function echo.StatusCode by @​suwakei in labstack/echo#2892
• CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in labstack/echo#2894
• Add echo.ResolveResponseStatus function to help middleware/handlers determine HTTP status code and echo.Response by @​aldas in labstack/echo#2900

v5.0.3 - 2026-02-06

Security

• Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @​shblue21.

This applies to cases when:

• Windows is used as OS
• middleware.StaticConfig.Filesystem is nil (default)
• echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

v5.0.2 - 2026-02-02

Security

• Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in labstack/echo#2887

v5.0.1 - 2026-01-28

• Panic MW: will now return a custom PanicStackError with stack trace by @​aldas in labstack/echo#2871
• Docs: add missing err parameter to DenyHandler example by @​cgalibern in labstack/echo#2878
• improve: improve websocket checks in IsWebSocket() [per RFC 6455] by @​raju-mechatronics in labstack/echo#2875
• fix: Context.Json() should not send status code before serialization is complete by @​aldas in labstack/echo#2877

v5.0.0 - 2026-01-18

Echo v5 is maintenance release with major breaking changes

• Context is now struct instead of interface and we can add method to it in the future in minor versions.
• Adds new Router interface for possible new routing implementations.
• Drops old logging interface and uses moderm log/slog instead.

... (truncated)

Commits

• 6f3a84a Merge pull request #2905 from aldas/v4_crsf_token_fallback
• 24fa4d0 CSRF: support older token-based CSRF protection handler that want to render t...
• See full diff in compare view

Updates github.com/nats-io/nats.go from 1.48.0 to 1.49.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.49.0

Changelog

ADDED

• Core NATS:
  • IgnoreDiscoveredServers option for skipping advertised servers (#2022)
  • Reconnect to selected server callback option #1958)
  • Set custom server pool (#1958)
• KeyValue:
  • Config() method for KeyValueStatus (#2014)

FIXED

• Core NATS:
  • Only remove requested status listener (#1991)
• JetStream:
  • Cleanup JS Publisher Status Channel (#1993)
• Legacy JetStream:
  • Fix nil pointer dereference in ConsumerInfo. Thanks @​olde-ducke for the contribution (#1987)
• Object store:
  • Use default timeout on object Put when context has no deadline (#2013)

IMPROVED

• Various docs and test improvements across the codebase. Thanks @​jjpinto for the contribution! (#1995, #1996, #1997, #1998, #1999, #2000, #2001, #2002, #2003, #2004, #2005, #2007, #2008, #2009, #2010, #2011, #2012, #2016, #2017, #2018, #2019, #2020)
• Add JetStream migration guide (#2023)

Complete Changes

nats-io/nats.go@v1.48.0...v1.49.0

Commits

• d85a35e Release v1.49.0 (#2025)
• 0d5e984 [IMPROVED] Add JetStream migration guide (#2023)
• fff2d63 [FIXED] Use default timeout on object Put when context has no deadline (#2013)
• ca4790e [IMPROVED] Fix code examples, API signatures and technical typos in jetstream...
• e987dbe [IMPROVED] Fix bug in constant name TimeStampHeader (#2019)
• 5b2c617 [ADDED] Config method for KeyValueStatus (#2014)
• 4667f93 [ADDED] Reconnect to selected server and custom server pool (#1958)
• f89e0bd [ADDED] IgnoreDiscoveredServers option for skipping advertised servers (#2022)
• b9f59ec [IMPROVED] Use correct comparative form in PullMaxBytes validation messages (...
• aa67684 [IMPROVED] Fix doc comments for ListKeysFiltered and ListKeys methods (#2017)
• Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.45.0 to 1.46.1

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

• 2026-02-17 v1.46.1:

  • Ensure connection state is reset if Tx.Commit fails. Previously, errors like SQLITE_BUSY during COMMIT could leave the underlying connection inside a transaction, causing errors when the connection was reused by the database/sql pool. The driver now detects this state and forces a rollback internally.
  • Fixes [GitHub issue #2](modernc-org/sqlite#2), thanks Edoardo Spadolini!

• 2026-02-17 v1.46.0:

  • Enable ColumnTypeScanType to report time.Time instead of string for TEXT columns declared as DATE, DATETIME, TIME, or TIMESTAMP via a new _texttotime URI parameter.
  • See [GitHub pull request #1](modernc-org/sqlite#1), thanks devhaozi!

• 2026-02-09 v1.45.0:

  • Introduce vtab subpackage (modernc.org/sqlite/vtab) exposing Module, Table, Cursor, and IndexInfo API for Go virtual tables.
  • Wire vtab registration into the driver: vtab.RegisterModule installs modules globally and each new connection calls sqlite3_create_module_v2.
  • Implement vtab trampolines for xCreate/xConnect/xBestIndex/xDisconnect/xDestroy/xOpen/xClose/xFilter/xNext/xEof/xColumn/xRowid.
  • Map SQLite’s sqlite3_index_info into vtab.IndexInfo, including constraints, ORDER BY terms, and constraint usage (ArgIndex → xFilter argv[]).
  • Add an in‑repo dummy vtab module and test (module_test.go) that validates registration, basic scanning, and constraint visibility.
  • See [GitLab merge request #90](https://gitlab.com/cznic/sqlite/-/merge_requests/90), thanks Adrian Witas!

• 2026-01-19 v1.44.3: Resolves [GitLab issue #243](https://gitlab.com/cznic/sqlite/-/issues/243).

• 2026-01-18 v1.44.2: Upgrade to SQLite 3.51.2.

• 2026-01-13 v1.44.0: Upgrade to SQLite 3.51.1.

• 2025-10-10 v1.39.1: Upgrade to SQLite 3.50.4.

• 2025-06-09 v1.38.0: Upgrade to SQLite 3.50.1.

• 2025-02-26 v1.36.0: Upgrade to SQLite 3.49.0.

• 2024-11-16 v1.34.0: Implement ResetSession and IsValid methods in connection

• 2024-07-22 v1.31.0: Support windows/386.

• 2024-06-04 v1.30.0: Upgrade to SQLite 3.46.0, release notes at https://sqlite.org/releaselog/3_46_0.html.

• 2024-02-13 v1.29.0: Upgrade to SQLite 3.45.1, release notes at https://sqlite.org/releaselog/3_45_1.html.

• 2023-12-14: v1.28.0: Add (*Driver).RegisterConnectionHook, ConnectionHookFn, ExecQuerierContext, RegisterConnectionHook.

• 2023-08-03 v1.25.0: enable SQLITE_ENABLE_DBSTAT_VTAB.

• 2023-07-11 v1.24.0: Add (*conn).{Serialize,Deserialize,NewBackup,NewRestore} methods, add Backup type.

• 2023-06-01 v1.23.0: Allow registering aggregate functions.

... (truncated)

Commits

• c777b90 add GOVERNANCE.md
• 806ed2d fix inconsistent transaction state on failed Commit
• e124c3e CHANGELOG.md: document v1.46.0
• ba0b20f manually merge modernc-org/sqlite#1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions