gorest

Updated Dependencies

• github.com/pilinux/argon2 from v0.14.0 to v0.15.0
• github.com/pilinux/crypt from v0.0.8 to v0.0.9
• github.com/pilinux/twofactor from v1.1.5 to v1.1.6
• golang.org/x/crypto from v0.25.0 to v0.26.0
• github.com/pilinux/cryptoengine from v0.1.5 to v0.1.6
• golang.org/x/sync from v0.7.0 to v0.8.0
• golang.org/x/sys from v0.22.0 to v0.23.0
• golang.org/x/text from v0.16.0 to v0.17.0
• golang.org/x/net from v0.25.0 to v0.28.0
• golang.org/x/arch from v0.8.0 to v0.9.0

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.40...v1.6.41

Important

• minimum required go version is 1.20 10e0714

What's Changed

• chore(deps): bump golang.org/x/crypto from 0.24.0 to 0.25.0 by @dependabot in https://github.com/pilinux/gorest/pull/212
• chore(deps): bump gorm.io/gorm from 1.25.10 to 1.25.11 by @dependabot in https://github.com/pilinux/gorest/pull/213
• chore(deps): bump go.mongodb.org/mongo-driver from 1.15.1 to 1.16.0 by @dependabot in https://github.com/pilinux/gorest/pull/211
• improve sentry logger 4f9db84, 891e91c, 14ca876

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.39...v1.6.40

What's Changed

• chore(deps): bump github.com/pilinux/twofactor from 1.1.3 to 1.1.4 by @dependabot in https://github.com/pilinux/gorest/pull/199
• chore(deps): bump github.com/pilinux/crypt from 0.0.6 to 0.0.7 by @dependabot in https://github.com/pilinux/gorest/pull/201
• chore(deps): bump github.com/pilinux/argon2 from 0.12.0 to 0.13.0 by @dependabot in https://github.com/pilinux/gorest/pull/200
• chore(deps): bump github.com/pilinux/crypt from 0.0.7 to 0.0.8 by @dependabot in https://github.com/pilinux/gorest/pull/210
• chore(deps): bump github.com/pilinux/argon2 from 0.13.0 to 0.14.0 by @dependabot in https://github.com/pilinux/gorest/pull/209
• chore(deps): bump github.com/pilinux/twofactor from 1.1.4 to 1.1.5 by @dependabot in https://github.com/pilinux/gorest/pull/208
• chore(deps): bump github.com/mrz1836/postmark from 1.6.4 to 1.6.5 by @dependabot in https://github.com/pilinux/gorest/pull/206
• chore(deps): bump go.mongodb.org/mongo-driver from 1.15.0 to 1.15.1 by @dependabot in https://github.com/pilinux/gorest/pull/207
• chore(deps): bump gorm.io/driver/mysql from 1.5.6 to 1.5.7 by @dependabot in https://github.com/pilinux/gorest/pull/204
• chore(deps): bump gorm.io/driver/sqlite from 1.5.5 to 1.5.6 by @dependabot in https://github.com/pilinux/gorest/pull/203
• chore(deps): bump gorm.io/driver/postgres from 1.5.7 to 1.5.9 by @dependabot in https://github.com/pilinux/gorest/pull/205

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.38...v1.6.39

What's Changed

• chore(deps): bump github.com/gin-gonic/gin from 1.9.1 to 1.10.0 by @dependabot in https://github.com/pilinux/gorest/pull/198

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.37...v1.6.38

What's Changed

• chore(deps): bump github.com/pilinux/crypt from 0.0.5 to 0.0.6 by @dependabot in https://github.com/pilinux/gorest/pull/190
• chore(deps): bump github.com/pilinux/argon2 from 0.11.0 to 0.12.0 by @dependabot in https://github.com/pilinux/gorest/pull/189
• chore(deps): bump golangci/golangci-lint-action from 4 to 5 by @dependabot in https://github.com/pilinux/gorest/pull/193
• chore(deps): bump github.com/pilinux/twofactor from 1.1.2 to 1.1.3 by @dependabot in https://github.com/pilinux/gorest/pull/195
• chore(deps): bump gorm.io/gorm from 1.25.9 to 1.25.10 by @dependabot in https://github.com/pilinux/gorest/pull/194
• chore(deps): bump go.mongodb.org/mongo-driver from 1.14.0 to 1.15.0 by @dependabot in https://github.com/pilinux/gorest/pull/191
• chore: bump golang.org/x/net from 0.22.0 to 0.24.0 f43dad6 [security patch: CVE-2023-45288]

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.36...v1.6.37

What's Changed

• bug fix: deleting existing cookies for specific routes (now, with any AUTH_COOKIE_SameSite policy: strict, lax, none, or empty value, it works as expected) 7d9a6b5

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.35...v1.6.36

What's Changed

• bug fix: middleware - verify origin of the request 3a8c4f7
• bug fix: connection to PostgreSQL over TLS 044f75a
• improvement: reduce code complexity of middleware.GetJWT() 8418573
• chore(deps): bump gorm.io/driver/mysql from 1.5.5 to 1.5.6 by @dependabot in https://github.com/pilinux/gorest/pull/182
• chore(deps): bump codecov/codecov-action from 4.1.0 to 4.1.1 by @dependabot in https://github.com/pilinux/gorest/pull/184
• chore(deps): bump github.com/go-sql-driver/mysql from 1.8.0 to 1.8.1 by @dependabot in https://github.com/pilinux/gorest/pull/183
• chore(deps): bump gorm.io/gorm from 1.25.8 to 1.25.9 by @dependabot in https://github.com/pilinux/gorest/pull/185
• README: added info on how to generate keys using openssl 37bb9d4

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.34...v1.6.35

What's Changed

• chore(deps): bump gorm.io/driver/mysql from 1.5.4 to 1.5.5 by @dependabot in https://github.com/pilinux/gorest/pull/180
• chore(deps): bump gorm.io/gorm from 1.25.7 to 1.25.8 by @dependabot in https://github.com/pilinux/gorest/pull/179
• chore(deps): bump actions/cache from 4.0.1 to 4.0.2 by @dependabot in https://github.com/pilinux/gorest/pull/181
• chore: bump github.com/pilinux/twofactor from 1.1.1 to 1.1.2
• chore: bump github.com/bytedance/sonic from 1.9.2 to 1.11.2
• chore: bump github.com/pilinux/cryptoengine from 0.1.1 to 0.1.2
• chore: bump golang.org/x/arch from 0.4.0 to 0.7.0
• chore: bump golang.org/x/net from 0.21.0 to 0.22.0
• chore: bump golang.org/x/sync from 0.5.0 to 0.6.0

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.33...v1.6.34

What's Changed

• chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 by @dependabot in https://github.com/pilinux/gorest/pull/177 [fixed vulnerability: CVE-2024-24786]
• chore(deps): bump gorm.io/driver/postgres from 1.5.6 to 1.5.7 by @dependabot in https://github.com/pilinux/gorest/pull/175
• chore(deps): bump github.com/jackc/pgx/v5 from 5.4.3 to 5.5.4 by @dependabot in https://github.com/pilinux/gorest/pull/178 [fixed vulnerabilities: GHSA-7jwh-3vrq-q3m8, CVE-2024-27304]
• chore(deps): bump github.com/go-sql-driver/mysql from 1.7.1 to 1.8.0 by @dependabot in https://github.com/pilinux/gorest/pull/176

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.32...v1.6.33

What's Changed

• chore(deps): bump github.com/pilinux/crypt from 0.0.4 to 0.0.5 by @dependabot in https://github.com/pilinux/gorest/pull/174
• chore(deps): bump github.com/pilinux/argon2 from 0.10.0 to 0.11.0 by @dependabot in https://github.com/pilinux/gorest/pull/173
• feat: option to easily create/drop mongoDB indexes 16fff60

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.31...v1.6.32

What's Changed

• chore(deps): bump github.com/mrz1836/postmark from 1.6.3 to 1.6.4 by @dependabot in https://github.com/pilinux/gorest/pull/170
• improvement: tautological conditions 15a1f7d
• ci: github action updated e059290 & 2eb77d3
• chore: bumped dependencies 532c511

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.30...v1.6.31

What's Changed

• bumped to gorm.io/driver/postgres v1.5.6
• For PostgreSQL connection, sql.Open(driverName string, dataSourceName string) => driverName changed from postgres to pqx

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.29...v1.6.30

What's Changed

• chore(deps): bump github.com/pilinux/crypt from 0.0.2 to 0.0.3 by @dependabot in https://github.com/pilinux/gorest/pull/164
• chore(deps): bump github.com/pilinux/argon2 from 0.8.0 to 0.9.0 by @dependabot in https://github.com/pilinux/gorest/pull/165
• chore(deps): bump go.mongodb.org/mongo-driver from 1.13.1 to 1.13.2 by @dependabot in https://github.com/pilinux/gorest/pull/166
• chore(deps): bump go.mongodb.org/mongo-driver from 1.13.2 to 1.14.0 by @dependabot in https://github.com/pilinux/gorest/pull/168

Bugfix

• #167

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.28...v1.6.29

What's Changed

• chore(deps): bump github.com/google/uuid from 1.5.0 to 1.6.0 by @dependabot in https://github.com/pilinux/gorest/pull/153
• chore(deps): bump github.com/mrz1836/postmark from 1.6.1 to 1.6.2 by @dependabot in https://github.com/pilinux/gorest/pull/155
• chore(deps): bump gorm.io/gorm from 1.25.5 to 1.25.6 by @dependabot in https://github.com/pilinux/gorest/pull/154
• chore(deps): bump gorm.io/gorm from 1.25.6 to 1.25.7 by @dependabot in https://github.com/pilinux/gorest/pull/158
• chore(deps): bump gorm.io/driver/mysql from 1.5.2 to 1.5.4 by @dependabot in https://github.com/pilinux/gorest/pull/157
• chore(deps): bump gorm.io/driver/postgres from 1.5.4 to 1.5.6 by @dependabot in https://github.com/pilinux/gorest/pull/160
• chore(deps): bump gorm.io/driver/sqlite from 1.5.4 to 1.5.5 by @dependabot in https://github.com/pilinux/gorest/pull/159
• chore(deps): bump github.com/mrz1836/postmark from 1.6.2 to 1.6.3 by @dependabot in https://github.com/pilinux/gorest/pull/161
• chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 by @dependabot in https://github.com/pilinux/gorest/pull/162
• chore(deps): bump golangci/golangci-lint-action from 3 to 4 by @dependabot in https://github.com/pilinux/gorest/pull/163

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.27...v1.6.28

What's Changed

• chore(deps): bump github.com/pilinux/crypt from 0.0.1 to 0.0.2 by @dependabot in https://github.com/pilinux/gorest/pull/148
• chore(deps): bump github.com/pilinux/argon2 from 0.7.0 to 0.8.0 by @dependabot in https://github.com/pilinux/gorest/pull/149
• chore(deps): bump actions/cache from 3.3.2 to 3.3.3 by @dependabot in https://github.com/pilinux/gorest/pull/150
• chore(deps): bump actions/cache from 3.3.3 to 4.0.0 by @dependabot in https://github.com/pilinux/gorest/pull/151
• chore(deps): bump actions/dependency-review-action from 3 to 4 by @dependabot in https://github.com/pilinux/gorest/pull/152

New Features

• rate limiting (IP-based)
• option to validate origin of the request

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.26...v1.6.27

What's Changed

• chore(deps): bump go.mongodb.org/mongo-driver from 1.13.0 to 1.13.1 by @dependabot in https://github.com/pilinux/gorest/pull/141
• chore(deps): bump actions/setup-go from 4 to 5 by @dependabot in https://github.com/pilinux/gorest/pull/140
• chore(deps): bump github/codeql-action from 2 to 3 by @dependabot in https://github.com/pilinux/gorest/pull/143
• chore(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 by @dependabot in https://github.com/pilinux/gorest/pull/142
• chore(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in https://github.com/pilinux/gorest/pull/144
• chore(deps): bump github.com/pilinux/crypt from 0.0.0 to 0.0.1 by @dependabot in https://github.com/pilinux/gorest/pull/145
• chore(deps): bump github.com/pilinux/argon2 from 0.6.0 to 0.7.0 by @dependabot in https://github.com/pilinux/gorest/pull/146

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.25...v1.6.26

What's Changed

Bugfix

• use different key prefixes for email verifications (new account registration and updating existing verified email) to avoid key collision in Redis

Improvement

• option to use UUIDv4 for email verification and password recovery codes
• sentry performance tracing
• dependency changed: github.com/onrik/logrus -> github.com/pilinux/logrus
• chore(deps): bump github.com/pilinux/argon2 from 0.5.0 to 0.6.0 by @dependabot in https://github.com/pilinux/gorest/pull/139

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.24...v1.6.25

What's Changed

Improvement

• update error messages
• update return responses
  • for 2FA setup, activation, deactivation, where password is required and user-provided password is wrong --> return 400
  • return same response message for the same cause (keep consistency throughout the codebase)

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.23...v1.6.24

What's Changed

Dependencies

• chore(deps): bump github.com/google/uuid from 1.3.1 to 1.4.0 by @dependabot in https://github.com/pilinux/gorest/pull/134
• chore(deps): bump gorm.io/driver/postgres from 1.5.3 to 1.5.4 by @dependabot in https://github.com/pilinux/gorest/pull/135
• chore(deps): bump go.mongodb.org/mongo-driver from 1.12.1 to 1.13.0 by @dependabot in https://github.com/pilinux/gorest/pull/136
• bump github.com/pilinux/argon2 from v0.4.0 to v0.5.0 https://github.com/pilinux/gorest/commit/0fe19a7fa88b9ccb225740b3d8cda6ef9d194191

Security Fix

• verify that the new email is not used by any user before replacing the current email https://github.com/pilinux/gorest/commit/d061f18a5d0ebe200b5767d25eab74ff00a3f324
• replace github.com/sec51/twofactor by github.com/pilinux/twofactor https://github.com/pilinux/gorest/commit/fa293b76a7c6a7d4d76ddb61ab20d7ece2e88ad0

Feature

• add flexibility to add more info when sending emails https://github.com/pilinux/gorest/commit/92d953f3358e3a8157c1ad71c9078078e9801be9
• new function IsProd() to get server mode (dev/prod) https://github.com/pilinux/gorest/commit/9526e277bfb82291bf6874bc320fdb6aa4b923cc

Improvement

• when reading env variables, lowercase letters where required https://github.com/pilinux/gorest/commit/c3ab00d5779a65979ad1410b6f63356bb9841f0a

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.22...v1.6.23

security update!

• chore(deps): bump golang.org/x/net from 0.12.0 to 0.17.0 by @dependabot in https://github.com/pilinux/gorest/pull/133

To learn more about it:

• GHSA-4374-p667-p6c8
• GHSA-2wrh-6pvc-2jm9

Full Changelog: https://github.com/pilinux/gorest/compare/v1.6.21...v1.6.22