[dependabot]

Bumps github.com/pires/go-proxyproto from 0.14.0 to 0.16.0.

Release notes

Sourced from github.com/pires/go-proxyproto's releases.

v0.16.0

Breaking changes

Not really breaking changes to the lib users but rather folks who adopted our HTTP2 helper/examples code. Upgrading golang.org/x/net to 0.61.0 required adopting the new API for HTTP2.

What's Changed

• fix: WriteTo empty buffer handling by @​mymmrac in pires/go-proxyproto#182
• fix(ci): drop Go 1.25, add 1.27 by @​pires in pires/go-proxyproto#185
• deps,ci: bump Go and fix CI validations by @​pires in pires/go-proxyproto#188
• deps,http2: bump golang.org/x/next from 0.58.0 to 0.61.0 by @​pires in pires/go-proxyproto#189

New Contributors

• @​mymmrac made their first contribution in pires/go-proxyproto#182

Full Changelog: pires/go-proxyproto@v0.15.0...v0.16.0

v0.15.0

This release aligns the library with PROXY protocol spec 3.4 (2026/04/27). It tightens parsing and trust behavior to match the spec's requirements — which makes some previously accepted inputs and configurations fail loudly — and adds first-class support for the PROXY protocol over UDP.

⚠️ Breaking changes

The PROXY header is now required by default (2cd5f00e2b3010a0fa64f52f077a20fb304b72fa)

• A new DefaultPolicy package variable, set to REQUIRE, is applied by NewConn and Listener.Accept when no policy is configured. The spec forbids guessing whether a header is present, so headerless connections now fail their first Read with ErrNoProxyProtocol.
• To restore the previous lax behavior: proxyproto.DefaultPolicy = proxyproto.USE.
• TrustProxyHeaderFrom is now strict: trusted peers get REQUIRE and untrusted peers are dropped by Accept with an error wrapping ErrInvalidUpstream. Previously, untrusted headerless clients could slip through as raw connections.

Stricter v1/v2 header parsing per spec 3.4 (5914db81c566830347865256ec22808fc39a0787)

• v1: the full PROXY token is validated; IPv6 zone IDs are rejected; plain IPv4 addresses in TCP6 lines are rejected (set V1AcceptIPv4InTCP6 for nginx interop); ports are parsed with leading zeros rejected and ranges validated on formatting.
• v2: the family/transport whitelist now applies to LOCAL commands too, rejecting undefined bytes per spec 2.2. LOCAL headers with a valid address block decode addresses and TLVs and round-trip; ill-fitting ones are normalized to UNSPEC.
• New MaxV2HeaderSize variable bounds the declared v2 length (default 4096) — raise it if you carry large TLVs such as PP2_SUBTYPE_SSL_CLIENT_CERT.

✨ New features

PROXY protocol over UDP (499ef90567292b68d14248845f4050f5d917fa5e, fixes #79)

• New ParseUDPDatagram and Header.FormatUDPDatagram implement the spec's per-datagram semantics (header and payload share a single datagram) for use with any net.PacketConn.
• The library deliberately ships no net.PacketConn wrapper — reply routing needs an application-policy flow table — but examples/udppacketconn is a runnable sketch of that pattern, alongside examples/udpserver and examples/udpclient for the plain paths.

Reworked trust policies (2cd5f00e2b3010a0fa64f52f077a20fb304b72fa)

• New PolicyFromRanges(ranges, matched, unmatched) and MustPolicyFromRanges supersede the whitelist policy family, which is deprecated and now delegates to them. The (REQUIRE, IGNORE) combination covers mixed proxied/direct traffic the old family couldn't express.
• New CIDR-capable TrustProxyHeaderFromRanges.
• All built-in policies wrap address-classification failures in ErrInvalidUpstream, so a single unclassifiable peer can no longer stop an accept loop.

TLV registry and PP2SSL caught up to spec 3.4 (4e80228ed95019bd7cba1d215fb169a008c146f5)

• Registered() now includes PP2_TYPE_GROUP, PP2_SUBTYPE_SSL_SIG_SCHEME, and PP2_SUBTYPE_SSL_CLIENT_CERT.
• New PP2SSL accessors: SSLSigAlg, SSLKeyAlg, SSLGroup, SSLSigScheme.

🐛 Fixes

• Header.EqualsTo no longer panics on nil addresses (5914db81c566830347865256ec22808fc39a0787).

... (truncated)

Commits

• 32ab355 deps,http2: bump golang.org/x/next from 0.58.0 to 0.61.0
• c7268fe ci: validate GHA config before anything else
• 4331312 ci: explicitly set GHA workflow permissions
• 2d70a5a deps,ci: bump Go and fix CI validations
• ec43bde fix(ci): drop Go 1.25, add 1.27
• c435999 build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
• a9aa477 fix: WriteTo empty buffer handling (#182)
• b987720 build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0
• 88dff81 fix dependabot for Go
• 86099fb enable dependabot
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/pires/go-proxyproto	[>= 0.15.a, < 0.16]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}