Repository navigation
Update module github.com/labstack/echo/v4 to v5 - #153
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
3 times, most recently
from
July 12, 2026 20:52
0c55e45 to
a8ed333
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
2 times, most recently
from
July 21, 2026 18:42
c255ba8 to
0383717
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
August 10, 2026 12:35
0383717 to
949b840
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
August 18, 2026 12:41
949b840 to
8705b86
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
August 30, 2026 10:44
8705b86 to
eaf2250
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
2 times, most recently
from
August 31, 2026 18:15
eaf2250 to
14c37a8
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
September 7, 2026 22:34
14c37a8 to
5206d36
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
September 28, 2026 00:53
5206d36 to
78f9f39
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
October 8, 2026 20:11
78f9f39 to
f862616
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
2 times, most recently
from
October 22, 2026 20:26
79b5172 to
95c6cb0
Compare
renovate
Bot
force-pushed
the
renovate/github.com-labstack-echo-v4-5.x
branch
from
October 23, 2026 07:15
95c6cb0 to
27c1d8d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.16.0→v5.4.2Release Notes
labstack/echo (github.com/labstack/echo/v4)
v5.4.2Compare Source
Fixes
Basicauthentication scheme. Malformed schemes such asBasicXno longer reach credential validation or consumeAllowedCheckLimit. Valid credentials are still required. #3138, thanks to @Shubham-Padkonde.Upgrade
Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.
The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.
Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.
Full changelog: labstack/echo@v5.4.1...v5.4.2
v5.4.1Compare Source
Security fixes
Upgrade with
go get github.com/labstack/echo/v5@v5.4.1.X-Real-IPinExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rgBehavior to review when upgrading
The proxy removes incoming
Forwardedheaders as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests;wsandwsstargets remain supported.BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.
Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.
Other changes
This release also includes
ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.Thanks to @rm-Umar, @Duodum, @irisitymichaelgrundberg, @Hama1cco, @jakezwang, @Shubham-Padkonde and @rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.
Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.
Full changelog: labstack/echo@v5.4.0...v5.4.1
v5.4.0Compare Source
Security
This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.
Context.Scheme()now uses theX-Forwarded-Proto,X-Forwarded-Protocol,X-Forwarded-SslandX-Url-Schemeheaders only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could sendX-Forwarded-Proto: httpsover plain HTTP and skipHTTPSRedirect. WhenX-Forwarded-Protois present, only it is used (its last value), and the scheme is returned in lowercase.Echo#SchemeExtractor(andConfig.SchemeExtractor) selects the strategy:ExtractSchemeFromHeaders(...TrustOption)(default),ExtractSchemeDirect()orLegacySchemeExtractor(). The Secure middleware now sets HSTS based onContext.Scheme(). The Proxy middleware always setsX-Forwarded-ProtofromContext.Scheme()and removesX-Forwarded-Ssl,X-Forwarded-ProtocolandX-Url-Schemebefore forwarding. GHSA-2ffq-g2xg-c22pX-Real-IPfromContext.RealIP(), so a client can no longer pass a spoofedX-Real-IPto the upstream. GHSA-99jh-6h7p-pp36Context.JSONPandContext.JSONPBlobaccept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits,_and$). Any other callback returns a 400 Bad Request error that wraps the newErrInvalidJSONPCallback, and nothing is written. JSONP responses now carryX-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3gGET,HEAD,OPTIONS,TRACEorCONNECT. Before this, with theMethodFromFormorMethodFromQuerygetter and MethodOverride registered withUsebefore the CSRF middleware,_method=GETskipped the CSRF check. Register MethodOverride withEcho#Pre. GHSA-r7w9-592q-9vg4/%09/evil.example/redirected browsers toevil.example. GHSA-v753-g4cw-jm48/admin%2Fsecret.txtor/%61dmin/secret.txtcan no longer reach a file under a guarded/admin/*route. GHSA-375p-5qhx-8wq4 The Static middleware andStaticDirectoryHandler(used byEcho.Static,Echo.StaticFS,Group.StaticandGroup.StaticFS) no longer serve paths with a.,..or empty segment, such as/assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xrBehavior changes to check before upgrading
100.64.0.0/10) address, itsX-Forwarded-Protois now ignored:HTTPSRedirectredirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16,130.211.0.0/22), and networks that use100.64.0.0/10(such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges:echo.LegacySchemeExtractor()restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that setRemoteAddrto the client's address also makeX-Forwarded-Protoignored (or, if they take it from a header, spoofable).X-Forwarded-Proto. A proxy on a trusted address that passes the client'sX-Forwarded-Protothrough (for example nginx withoutproxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalidX-Forwarded-Protovalue now results inhttpinstead of falling back to the other scheme headers.httptest.NewRequestsetsRemoteAddrto192.0.2.1:1234, which is not trusted, so tests that setX-Forwarded-Protonow seehttp. Setreq.RemoteAddr = "10.0.0.1:1234"or usee.SchemeExtractor = echo.LegacySchemeExtractor()in such tests.X-Real-IPsent to the upstream is now alwaysContext.RealIP(). In a chain like nginx → Echo Proxy → upstream, configureEcho#IPExtractor(for exampleecho.ExtractIPFromRealIPHeader()) to pass the client address on.X-Forwarded-Ssl,X-Forwarded-ProtocolandX-Url-Schemeare no longer forwarded;X-Forwarded-Protocarries the scheme.GET(for example withX-HTTP-Method-Override: GETto send a long query in a POST body) is no longer done; such requests keep the POST method./assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example%2C,%40or lowercase hex like%c3%a9) unlessStaticConfig.EnablePathUnescapingis set;Echo.Statichas behaved this way since v5.2.1. WithStaticConfig.EnablePathUnescapingorConfig.EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.Context.JSONPreturns an error for callbacks that are not JavaScript identifiers.Documentation
IPExtractordocs: corrected the description of the default (the direct peer address has been used since v5.1.0).Echo#Useit runs before route and group middleware, so route guards do not protect the files it serves.v5.3.1Compare Source
Fixes
Enhancements
Anygodoc to reflect true arbitrary-method matching by @hyorimitsu in #3046v5.3.0Compare Source
Logic changes
PR #2996 revert back to
v4behavior for a group registering implicit 404 handlers.If you do not want this behavior, can do not want implicit 404 handlers for groups, use:
some other noteworthy echancements:
Enhancements
v5.2.1Compare Source
Security
Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.
Given following situation:
Then requests to
/admin%2fprivate.txtwould not be matched toGET /admin/*route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.Note: this way of "guarding" subfolders will never work for for paths like
/assets/../admin%2fprivate.txtwhich willpath.Clean("/assets/../admin%2fprivate.txt")to/admin/private.txtand are servable if static file serving is configured to unescape paths.If you want to guard routes - use middlewares on
Static*methods and beforeStaticmiddleware.Closes GHSA-vfp3-v2gw-7wfq more completely: the previous fix (#3009) rejected explicitly encoded
separators at the handler level; this patch makes the no-unescape behavior the default so new configurations are safe without extra opt-out steps.
What changed:
DisablePathUnescaping(onStaticConfigandStaticDirectoryHandlerConfig) is deprecated and replaced byEnablePathUnescaping(defaultfalse). Path unescaping is now opt-in.What this protects: With
EnablePathUnescaping: false(new default), encoded separators (%2F,%5C) are never decoded before routing or file lookup, so they cannotbypass route-level authentication or other middleware guards.
What this does NOT protect: Serving a directory with
Static,StaticFS, orStaticDirectoryHandlerexposes its entire subtree. Sibling routes are not a reliableACL boundary — attach authorization middleware directly to the static mount, or serve sensitive sub-trees under separate guarded routes.
Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g.,
/hello%20world.txt→hello world.txt), you must now opt in:v5.2.0Compare Source
Security
Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (
%2For%5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. BothStaticDirectoryHandler/StaticFSand theStaticmiddleware are affected. Thanks to @a-tt-om and @oran-gugu for reporting.Enhancements
New Contributors
Full Changelog: labstack/echo@v5.1.1...v5.2.0
v5.1.1Compare Source
Security
Context.Scheme()should validate values taken from header by @aldas in #2953Thanks to @shblue21 for reporting this issue.
Enhancements
v5.1.0Compare Source
Security
This change does not break the API contract, but it does introduce breaking changes in logic/behavior.
If your application is using
c.RealIP()beware and read https://echo.labstack.com/docs/ip-addressv4behavior can be restored with:Enhancements
v5.0.4Compare Source
Enhancements
http.Server.Servereturns we need to wait for graceful shutdown goroutine to finish by @aldas in #2898echo.StatusCodeby @suwakei in #2892echo.ResolveResponseStatusfunction to help middleware/handlers determine HTTP status code and echo.Response by @aldas in #2900v5.0.3Compare Source
Security
This applies to cases when:
middleware.StaticConfig.Filesystemisnil(default)echo.Filesystemis has not been set explicitly (default)Exposure is restricted to the active process working directory and its subfolders.
v5.0.2Compare Source
Security
config.Browse=truelists all files/subfolders fromconfig.Filesystemroot and not starting fromconfig.Rootin #2887v5.0.1Compare Source
v5.0.0Compare Source
Echo
v5is maintenance release with major breaking changesContextis now struct instead of interface and we can add method to it in the future in minor versions.Routerinterface for possible new routing implementations.log/sloginstead.Upgrade notes and
v4support:v4is supported with security* updates and bug fixes until 2026-12-31v5API changes will be addressed, even if this violates semantic versioning.See API_CHANGES_V5.md for public API changes between
v4andv5, notes on upgrading.Upgrading TLDR:
If you are using Linux you can migrate easier parts like that:
macOS
or in your favorite IDE
Replace all:
echo.Context->*echo.Contextecho/v4->echo/v5This should solve most of the issues. Probably the hardest part is updating all the tests.
v4.16.2Compare Source
Fixes
Basicauthentication scheme. Malformed schemes such asBasicXno longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @Shubham-Padkonde.CSRFConfig.TokenLookupconfigurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @orinnz; backport of the existing v5 validation in #3067.Upgrade
Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.
The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.
Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.
Full changelog: labstack/echo@v4.16.1...v4.16.2
v4.16.1Compare Source
Security fixes
Upgrade with
go get github.com/labstack/echo/v4@v4.16.1.Go 1.26 or later is now required to use patched
golang.org/x/dependencies. Build deployments with a supported, patched Go toolchain.golang.org/x/netto v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.Behavior to review when upgrading
BodyDumpConfig.MaxRequestBytesandMaxResponseBytescontrol capture limits. Zero selects the 5 MiB default;-1disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.DecompressConfig.MaxDecompressedSizecontrols the decompressed-body limit. Zero selects the 100 MiB default;-1disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.The proxy removes incoming
Forwardedheaders as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests;wsandwsstargets remain supported.Other changes
This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.
Thanks to @Duodum, @irisitymichaelgrundberg, @q490107865, @Hama1cco, @jakezwang and @Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.
Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained
golang.org/x/crypto/openpgppackage (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.Full changelog: labstack/echo@v4.16.0...v4.16.1
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.