diff --git a/go.mod b/go.mod
index b2d77df8..e547a133 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,8 @@ require (
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/goccy/go-json v0.11.2
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/labstack/echo/v4 v4.16.0
+	github.com/labstack/echo/v4 v4.15.4
+	github.com/labstack/echo/v5 v5.4.2
 	github.com/matrix-org/gomatrixserverlib v0.0.0-20260716140101-4fe595dc7f58
 	github.com/mattevans/postmark-go v1.0.0
 	github.com/microcosm-cc/bluemonday v1.0.27
diff --git a/go.sum b/go.sum
index ea465369..499b2eef 100644
--- a/go.sum
+++ b/go.sum
@@ -122,8 +122,11 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/labstack/echo/v4 v4.15.4 h1:DL45vVYa+BWE+XuW+zZNd9H0YEdZ80UAWJGcTVW4EVs=
+github.com/labstack/echo/v4 v4.15.4/go.mod h1:CuMetKIRwsuO/qlAgMq+KTAalwGoB/h4tC+yPdrTj1g=
 github.com/labstack/echo/v4 v4.16.0 h1:cFqqpqVNmSVyn4nvsXHp5rU4aVLYG3hx4fGWc3FngBk=
 github.com/labstack/echo/v4 v4.16.0/go.mod h1:VHAohjgM63iiTVI6EahEDjtRhQNXCMXFp0TMeIsFuW0=
+github.com/labstack/echo/v5 v5.4.2/go.mod h1:4iEGNQiPPZnkfYpNR/L6fINd3NLiGWUD5+eBotFALas=
 github.com/labstack/gommon v0.5.0 h1:6VSQ2NOzsnEJ5W6+84E0RbcaDDmgB6NIAzWCczTEe6c=
 github.com/labstack/gommon v0.5.0/go.mod h1:Rzlg7HHy1maLfzBYGg9NZcVuz1sA68HHhLjhcEllYE0=
 github.com/matrix-org/gomatrix v0.0.0-20220926102614-ceba4d9f7530 h1:kHKxCOLcHH8r4Fzarl4+Y3K5hjothkVW5z7T1dUM11U=
diff --git a/vendor/github.com/labstack/echo/v4/CHANGELOG.md b/vendor/github.com/labstack/echo/v4/CHANGELOG.md
index c8017d19..8388531e 100644
--- a/vendor/github.com/labstack/echo/v4/CHANGELOG.md
+++ b/vendor/github.com/labstack/echo/v4/CHANGELOG.md
@@ -1,50 +1,5 @@
 # Changelog
 
-## v4.16.0 - 2026-09-27
-
-**Security**
-
-This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.
-
-* **Request scheme:** `Context.Scheme()` now uses the `X-Forwarded-Proto`, `X-Forwarded-Protocol`, `X-Forwarded-Ssl` and `X-Url-Scheme` headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send `X-Forwarded-Proto: https` over plain HTTP and skip `HTTPSRedirect`. When `X-Forwarded-Proto` is present, only it is used (its last value), and the scheme is returned in lowercase. the new `Echo#SchemeExtractor` field selects the strategy: `ExtractSchemeFromHeaders(...TrustOption)` (default), `ExtractSchemeDirect()` or `LegacySchemeExtractor()`. The Secure middleware now sets HSTS based on `Context.Scheme()`. The Proxy middleware always sets `X-Forwarded-Proto` from `Context.Scheme()` and removes `X-Forwarded-Ssl`, `X-Forwarded-Protocol` and `X-Url-Scheme` before forwarding. [GHSA-2ffq-g2xg-c22p](https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p)
-* **JSONP:** `Context.JSONP` and `Context.JSONPBlob` accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, `_` and `$`). Any other callback returns a 400 Bad Request error that wraps the new `ErrInvalidJSONPCallback`, and nothing is written. JSONP responses now carry `X-Content-Type-Options: nosniff`. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. [GHSA-h9g5-28mm-hx3g](https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g)
-* **MethodOverride:** a POST can no longer be overridden to `GET`, `HEAD`, `OPTIONS`, `TRACE` or `CONNECT`. Before this, with the `MethodFromForm` or `MethodFromQuery` getter and MethodOverride registered with `Use` before the CSRF middleware, `_method=GET` skipped the CSRF check. Register MethodOverride with `Echo#Pre`. [GHSA-r7w9-592q-9vg4](https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4)
-* **Redirects:** the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, `/%09/evil.example/` redirected browsers to `evil.example`. [GHSA-v753-g4cw-jm48](https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48)
-* **Static files:** with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so `/admin%2Fsecret.txt` or `/%61dmin/secret.txt` can no longer reach a file under a guarded `/admin/*` route. [GHSA-375p-5qhx-8wq4](https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4) The Static middleware and `StaticDirectoryHandler` (used by `Echo.Static`, `Echo.StaticFS`, `Group.Static` and `Group.StaticFS`) no longer serve paths with a `.`, `..` or empty segment, such as `/assets/../admin/secret.txt`, also after path unescaping. [GHSA-3pmx-cf9f-34xr](https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr)
-* **Dependencies:** update `golang.org/x/text` to v0.40.0 ([GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970)).
-
-**Client IP address (no code change in v4)**
-
-Without `Echo#IPExtractor`, `Context.RealIP()` in v4 trusts the `X-Forwarded-For` and `X-Real-IP` headers from any client, so the rate limiter can be bypassed and the Proxy middleware forwards a spoofed `X-Real-IP` ([GHSA-246p-cpwv-v3jq](https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq), [GHSA-99jh-6h7p-pp36](https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36)). Changing this default in v4 would put all clients behind a proxy into one rate-limit bucket, so v4 keeps it. Set an extractor that matches your deployment:
-```go
-e.IPExtractor = echo.ExtractIPDirect()        // no proxy in front of the app
-e.IPExtractor = echo.ExtractIPFromXFFHeader() // behind proxies in private networks that set X-Forwarded-For
-// behind a proxy with public addresses (e.g. a CDN), also trust its ranges:
-// e.IPExtractor = echo.ExtractIPFromXFFHeader(echo.TrustIPRange(cdnRange))
-```
-v5 uses the direct peer address by default since v5.1.0.
-
-**Behavior changes to check before upgrading**
-
-* **Proxies or load balancers with public IP addresses.** If a proxy connects to your app from a public (or `100.64.0.0/10`) address, its `X-Forwarded-Proto` is now ignored: `HTTPSRedirect` redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (`35.191.0.0/16`, `130.211.0.0/22`), and networks that use `100.64.0.0/10` (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges:
-  ```go
-  _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
-  _, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
-  e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
-  ```
-  Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. `echo.LegacySchemeExtractor()` restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set `RemoteAddr` to the client's address also make `X-Forwarded-Proto` ignored (or, if they take it from a header, spoofable).
-* **Trusted proxies must set `X-Forwarded-Proto`.** A proxy on a trusted address that passes the client's `X-Forwarded-Proto` through (for example nginx without `proxy_set_header X-Forwarded-Proto $scheme;`) still lets the client choose the scheme. An invalid `X-Forwarded-Proto` value now results in `http` instead of falling back to the other scheme headers.
-* **Your own tests.** `httptest.NewRequest` sets `RemoteAddr` to `192.0.2.1:1234`, which is not trusted, so tests that set `X-Forwarded-Proto` now see `http`. Set `req.RemoteAddr = "10.0.0.1:1234"` or use `e.SchemeExtractor = echo.LegacySchemeExtractor()` in such tests.
-* **Proxy middleware headers.** `X-Forwarded-Ssl`, `X-Forwarded-Protocol` and `X-Url-Scheme` are no longer forwarded to the upstream; `X-Forwarded-Proto` carries the scheme.
-* **MethodOverride.** Overriding a POST to `GET` (for example with `X-HTTP-Method-Override: GET` to send a long query in a POST body) is no longer done; such requests keep the POST method.
-* **Static files.** Paths with a double slash or dot segment (for example `/assets//app.js`) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example `%2C`, `%40` or lowercase hex like `%c3%a9`) unless `StaticConfig.EnablePathUnescaping` is set; `Echo.Static` has behaved this way since v4.15.4. With `StaticConfig.EnablePathUnescaping` or `Echo#EnablePathUnescapingStaticFiles`, encoded dots (`%2e%2e`) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
-* **JSONP.** `Context.JSONP` returns an error for callbacks that are not JavaScript identifiers.
-
-**Documentation**
-
-* Static middleware: when registered with `Echo#Use` it runs before route and group middleware, so route guards do not protect the files it serves.
-
-
 ## v4.15.4 - 2026-06-15
 
 **Security**
diff --git a/vendor/github.com/labstack/echo/v4/context.go b/vendor/github.com/labstack/echo/v4/context.go
index dd5f11c4..6500e5ee 100644
--- a/vendor/github.com/labstack/echo/v4/context.go
+++ b/vendor/github.com/labstack/echo/v4/context.go
@@ -134,17 +134,10 @@ type Context interface {
 
 	// JSONP sends a JSONP response with status code. It uses `callback` to construct
 	// the JSONP payload.
-	//
-	// The callback must be empty, a JavaScript identifier or a dot-separated path of identifiers using only ASCII
-	// letters, digits, `_` and `$`. Otherwise nothing is written and a 400 Bad Request error wrapping
-	// ErrInvalidJSONPCallback is returned. The response has the `X-Content-Type-Options: nosniff` header.
-	//
-	// Any website can load a JSONP response with a <script> tag, including the user's cookies. Do not use JSONP for
-	// data that requires authentication; use JSON with CORS instead.
 	JSONP(code int, callback string, i any) error
 
 	// JSONPBlob sends a JSONP blob response with status code. It uses `callback`
-	// to construct the JSONP payload. The callback is validated like in Context.JSONP.
+	// to construct the JSONP payload.
 	JSONPBlob(code int, callback string, b []byte) error
 
 	// XML sends an XML response with status code.
@@ -279,20 +272,38 @@ func (c *context) IsWebSocket() bool {
 	return strings.EqualFold(upgrade, "websocket")
 }
 
-// Scheme returns the protocol scheme in lowercase: `http` or `https`, or `ws` or `wss` when a trusted proxy reports
-// them.
-//
-// Echo#SchemeExtractor decides how the scheme is determined. When it is not set, the forwarding headers
-// (`X-Forwarded-Proto`, `X-Forwarded-Protocol`, `X-Forwarded-Ssl` and `X-Url-Scheme`) are used only for requests
-// that come directly from a loopback, link-local or private network address or a unix socket.
-// See ExtractSchemeFromHeaders.
+func isValidProto(proto string) bool {
+	if proto == "" {
+		return false
+	}
+	for _, p := range []string{"http", "https", "ws", "wss"} {
+		if strings.EqualFold(proto, p) {
+			return true
+		}
+	}
+	return false
+}
+
+// Scheme returns the HTTP protocol scheme, `http` or `https`.
 func (c *context) Scheme() string {
 	// Can't use `r.Request.URL.Scheme`
 	// See: https://groups.google.com/forum/#!topic/golang-nuts/pMUkBlQBDF0
-	if c.echo != nil && c.echo.SchemeExtractor != nil {
-		return c.echo.SchemeExtractor(c.request)
+	if c.IsTLS() {
+		return "https"
+	}
+	if scheme := c.request.Header.Get(HeaderXForwardedProto); isValidProto(scheme) {
+		return scheme
 	}
-	return extractScheme(c.request, defaultSchemeChecker)
+	if scheme := c.request.Header.Get(HeaderXForwardedProtocol); isValidProto(scheme) {
+		return scheme
+	}
+	if ssl := c.request.Header.Get(HeaderXForwardedSsl); ssl == "on" {
+		return "https"
+	}
+	if scheme := c.request.Header.Get(HeaderXUrlScheme); isValidProto(scheme) {
+		return scheme
+	}
+	return "http"
 }
 
 func (c *context) RealIP() string {
@@ -482,54 +493,13 @@ func (c *context) String(code int, s string) (err error) {
 	return c.Blob(code, MIMETextPlainCharsetUTF8, []byte(s))
 }
 
-// isValidJSONPCallback reports whether callback can be used as a JSONP function name: an empty string, a JavaScript
-// identifier or a dot-separated path of identifiers (e.g. `cb`, `jQuery_123`, `ns.handlers.cb`). Only ASCII letters,
-// digits, `_` and `$` are allowed, so the callback cannot inject other JavaScript into the response.
-func isValidJSONPCallback(callback string) bool {
-	if callback == "" {
-		return true
-	}
-	atStart := true // at the start of an identifier
-	for i := 0; i < len(callback); i++ {
-		ch := callback[i]
-		switch {
-		case ch == '.':
-			if atStart {
-				return false
-			}
-			atStart = true
-		case ch == '_' || ch == '$' || ('a' <= ch && ch <= 'z') || ('A' <= ch && ch <= 'Z'):
-			atStart = false
-		case '0' <= ch && ch <= '9':
-			if atStart {
-				return false
-			}
-		default:
-			return false
-		}
-	}
-	return !atStart
-}
-
-// writeJSONPHeader validates the callback and writes the JSONP response headers.
-func (c *context) writeJSONPHeader(code int, callback string) error {
-	if !isValidJSONPCallback(callback) {
-		return ErrBadRequest.WithInternal(ErrInvalidJSONPCallback)
-	}
-	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
-	c.response.Header().Set(HeaderXContentTypeOptions, "nosniff")
-	c.response.WriteHeader(code)
-	return nil
-}
-
 func (c *context) jsonPBlob(code int, callback string, i any) (err error) {
 	indent := ""
 	if _, pretty := c.QueryParams()["pretty"]; c.echo.Debug || pretty {
 		indent = defaultIndent
 	}
-	if err = c.writeJSONPHeader(code, callback); err != nil {
-		return
-	}
+	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
+	c.response.WriteHeader(code)
 	if _, err = c.response.Write([]byte(callback + "(")); err != nil {
 		return
 	}
@@ -569,9 +539,8 @@ func (c *context) JSONP(code int, callback string, i any) (err error) {
 }
 
 func (c *context) JSONPBlob(code int, callback string, b []byte) (err error) {
-	if err = c.writeJSONPHeader(code, callback); err != nil {
-		return
-	}
+	c.writeContentType(MIMEApplicationJavaScriptCharsetUTF8)
+	c.response.WriteHeader(code)
 	if _, err = c.response.Write([]byte(callback + "(")); err != nil {
 		return
 	}
diff --git a/vendor/github.com/labstack/echo/v4/echo.go b/vendor/github.com/labstack/echo/v4/echo.go
index 85a467e7..f00fb10e 100644
--- a/vendor/github.com/labstack/echo/v4/echo.go
+++ b/vendor/github.com/labstack/echo/v4/echo.go
@@ -98,13 +98,7 @@ type Echo struct {
 	Renderer         Renderer
 	Logger           Logger
 	IPExtractor      IPExtractor
-	// SchemeExtractor defines the strategy for determining the request scheme (`http` or `https`),
-	// particularly important when behind proxies or load balancers that terminate TLS.
-	// Used by Context.Scheme and by the HTTPS redirect, Secure and Proxy middlewares.
-	// If not set, forwarding headers such as `X-Forwarded-Proto` are trusted only from loopback, link-local and
-	// private network addresses and unix sockets. See ExtractSchemeFromHeaders.
-	SchemeExtractor SchemeExtractor
-	ListenerNetwork string
+	ListenerNetwork  string
 
 	// OnAddRouteHandler is called when Echo adds new route to specific host router.
 	OnAddRouteHandler func(host string, route Route, handler HandlerFunc, middleware []MiddlewareFunc)
@@ -285,7 +279,7 @@ const (
 
 const (
 	// Version of Echo
-	Version = "4.16.0"
+	Version = "4.15.4"
 	website = "https://echo.labstack.com"
 	// http://patorjk.com/software/taag/#p=display&f=Small%20Slant&t=Echo
 	banner = `
@@ -360,10 +354,6 @@ var (
 	ErrValidatorNotRegistered = errors.New("validator not registered")
 	ErrRendererNotRegistered  = errors.New("renderer not registered")
 	ErrInvalidRedirectCode    = errors.New("invalid redirect status code")
-
-	// ErrInvalidJSONPCallback is wrapped in the 400 Bad Request error that Context.JSONP and Context.JSONPBlob
-	// return when the callback is not a valid JSONP function name. See Context.JSONP.
-	ErrInvalidJSONPCallback   = errors.New("invalid JSONP callback")
 	ErrCookieNotFound         = errors.New("cookie not found")
 	ErrInvalidCertOrKeyType   = errors.New("invalid cert or key type, must be string or []byte")
 	ErrInvalidListenerNetwork = errors.New("invalid listener network")
diff --git a/vendor/github.com/labstack/echo/v4/echo_fs.go b/vendor/github.com/labstack/echo/v4/echo_fs.go
index cd96a547..ed27b992 100644
--- a/vendor/github.com/labstack/echo/v4/echo_fs.go
+++ b/vendor/github.com/labstack/echo/v4/echo_fs.go
@@ -65,21 +65,12 @@ func (e *Echo) StaticFS(pathPrefix string, filesystem fs.FS) *Route {
 func StaticDirectoryHandler(fileSystem fs.FS, disablePathUnescaping bool) HandlerFunc {
 	return func(c Context) error {
 		p := c.Param("*")
-		// The router matches the path as it was sent, but the file name is resolved with path.Clean(). A path with a
-		// ".", ".." or empty segment could therefore reach a file under a route that the router never matched, for
-		// example `/assets/../admin/private.txt` bypassing a guarded `/admin/*` route (GHSA-3pmx-cf9f-34xr).
-		if hasUncleanPath(c.Request()) || hasDotOrEmptySegment(p) {
-			return ErrNotFound
-		}
 		if !disablePathUnescaping { // when router is already unescaping we do not want to do is twice
 			tmpPath, err := url.PathUnescape(p)
 			if err != nil {
 				return fmt.Errorf("failed to unescape path variable: %w", err)
 			}
 			p = tmpPath
-			if hasDotOrEmptySegment(p) { // unescaping can create new dot segments, e.g. `%2e%2e`
-				return ErrNotFound
-			}
 		}
 
 		// fs.FS.Open() already assumes that file names are relative to FS root path and considers name with prefix `/` as invalid.
@@ -173,10 +164,6 @@ func MustSubFS(currentFs fs.FS, fsRoot string) fs.FS {
 }
 
 func sanitizeURI(uri string) string {
-	// Browsers remove tab and newline characters from URLs, so `/\t/example.com` is `//example.com` to them and a
-	// control character could hide the double slash from the check below. Percent-encode C0 control characters and
-	// DEL first; the browser then requests the same path.
-	uri = escapeControlChars(uri)
 	// double slash `\\`, `//` or even `\/` is absolute uri for browsers and by redirecting request to that uri
 	// we are vulnerable to open redirect attack. so replace all slashes from the beginning with single slash
 	if len(uri) > 1 && (uri[0] == '\\' || uri[0] == '/') && (uri[1] == '\\' || uri[1] == '/') {
@@ -184,56 +171,3 @@ func sanitizeURI(uri string) string {
 	}
 	return uri
 }
-
-// escapeControlChars percent-encodes C0 control characters and DEL in s.
-// Keep in sync with the copy in middleware/slash.go.
-func escapeControlChars(s string) string {
-	i := 0
-	for i < len(s) && s[i] >= 0x20 && s[i] != 0x7f {
-		i++
-	}
-	if i == len(s) {
-		return s
-	}
-	const hexDigits = "0123456789ABCDEF"
-	var b strings.Builder
-	b.Grow(len(s) + 8)
-	b.WriteString(s[:i])
-	for ; i < len(s); i++ {
-		if ch := s[i]; ch < 0x20 || ch == 0x7f {
-			b.WriteByte('%')
-			b.WriteByte(hexDigits[ch>>4])
-			b.WriteByte(hexDigits[ch&0x0f])
-		} else {
-			b.WriteByte(ch)
-		}
-	}
-	return b.String()
-}
-
-// hasDotOrEmptySegment reports whether URL path p has a ".", ".." or empty segment. A single leading and a single
-// trailing slash are allowed.
-// Keep in sync with the copy in middleware/static.go.
-func hasDotOrEmptySegment(p string) bool {
-	p = strings.TrimPrefix(p, "/")
-	p = strings.TrimSuffix(p, "/")
-	if p == "" {
-		return false
-	}
-	for segment := range strings.SplitSeq(p, "/") {
-		if segment == "" || segment == "." || segment == ".." {
-			return true
-		}
-	}
-	return false
-}
-
-// hasUncleanPath reports whether the request path, in the form the router matches by default (the escaped path when it
-// differs from the default encoding), has a ".", ".." or empty segment. Encoded dots such as `%2E%2E` are not
-// segments here; they only act as `..` when path unescaping for static files is enabled.
-func hasUncleanPath(req *http.Request) bool {
-	if req.URL.RawPath != "" {
-		return hasDotOrEmptySegment(req.URL.RawPath)
-	}
-	return hasDotOrEmptySegment(req.URL.Path)
-}
diff --git a/vendor/github.com/labstack/echo/v4/middleware/body_limit.go b/vendor/github.com/labstack/echo/v4/middleware/body_limit.go
index e48aff61..d13ad2c4 100644
--- a/vendor/github.com/labstack/echo/v4/middleware/body_limit.go
+++ b/vendor/github.com/labstack/echo/v4/middleware/body_limit.go
@@ -92,18 +92,12 @@ func BodyLimitWithConfig(config BodyLimitConfig) echo.MiddlewareFunc {
 }
 
 func (r *limitedReader) Read(b []byte) (n int, err error) {
-	if r.limit > 0 && r.read > r.limit {
-		return 0, echo.ErrStatusRequestEntityTooLarge
-	}
-
 	n, err = r.reader.Read(b)
 	r.read += int64(n)
-
-	if r.limit > 0 && r.read > r.limit {
+	if r.read > r.limit {
 		return n, echo.ErrStatusRequestEntityTooLarge
 	}
-
-	return n, err
+	return
 }
 
 func (r *limitedReader) Close() error {
diff --git a/vendor/github.com/labstack/echo/v4/middleware/method_override.go b/vendor/github.com/labstack/echo/v4/middleware/method_override.go
index 92ba99d8..3991e102 100644
--- a/vendor/github.com/labstack/echo/v4/middleware/method_override.go
+++ b/vendor/github.com/labstack/echo/v4/middleware/method_override.go
@@ -5,7 +5,6 @@ package middleware
 
 import (
 	"net/http"
-	"strings"
 
 	"github.com/labstack/echo/v4"
 )
@@ -33,11 +32,7 @@ var DefaultMethodOverrideConfig = MethodOverrideConfig{
 // MethodOverride  middleware checks for the overridden method from the request and
 // uses it instead of the original method.
 //
-// For security reasons, only `POST` method can be overridden, and it cannot be overridden to `GET`, `HEAD`,
-// `OPTIONS`, `TRACE` or `CONNECT`. Otherwise a cross-site form POST could skip checks that apply only to
-// state-changing methods, such as the CSRF middleware.
-//
-// Register it with Echo#Pre so that routing uses the overridden method.
+// For security reasons, only `POST` method can be overridden.
 func MethodOverride() echo.MiddlewareFunc {
 	return MethodOverrideWithConfig(DefaultMethodOverrideConfig)
 }
@@ -62,7 +57,7 @@ func MethodOverrideWithConfig(config MethodOverrideConfig) echo.MiddlewareFunc {
 			req := c.Request()
 			if req.Method == http.MethodPost {
 				m := config.Getter(c)
-				if m != "" && !isForbiddenOverrideMethod(m) {
+				if m != "" {
 					req.Method = m
 				}
 			}
@@ -94,14 +89,3 @@ func MethodFromQuery(param string) MethodOverrideGetter {
 		return c.QueryParam(param)
 	}
 }
-
-// isForbiddenOverrideMethod reports whether POST must not be overridden to method m. Safe methods (and CONNECT) are
-// forbidden because middlewares such as CSRF do not check them.
-func isForbiddenOverrideMethod(m string) bool {
-	for _, forbidden := range []string{http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace, http.MethodConnect} {
-		if strings.EqualFold(m, forbidden) {
-			return true
-		}
-	}
-	return false
-}
diff --git a/vendor/github.com/labstack/echo/v4/middleware/proxy.go b/vendor/github.com/labstack/echo/v4/middleware/proxy.go
index 2c7c333e..f2687007 100644
--- a/vendor/github.com/labstack/echo/v4/middleware/proxy.go
+++ b/vendor/github.com/labstack/echo/v4/middleware/proxy.go
@@ -349,14 +349,9 @@ func ProxyWithConfig(config ProxyConfig) echo.MiddlewareFunc {
 			if req.Header.Get(echo.HeaderXRealIP) == "" || c.Echo().IPExtractor != nil {
 				req.Header.Set(echo.HeaderXRealIP, c.RealIP())
 			}
-			// Always overwrite X-Forwarded-Proto. c.Scheme() uses an incoming X-Forwarded-Proto header only when it comes
-			// from a trusted address (see Echo#SchemeExtractor), so clients cannot spoof the scheme seen by the upstream.
-			// Remove the other scheme headers: X-Forwarded-Proto carries the scheme, and some upstreams (e.g. Rack) would
-			// otherwise trust a client-supplied X-Forwarded-Ssl.
-			req.Header.Set(echo.HeaderXForwardedProto, c.Scheme())
-			req.Header.Del(echo.HeaderXForwardedSsl)
-			req.Header.Del(echo.HeaderXForwardedProtocol)
-			req.Header.Del(echo.HeaderXUrlScheme)
+			if req.Header.Get(echo.HeaderXForwardedProto) == "" {
+				req.Header.Set(echo.HeaderXForwardedProto, c.Scheme())
+			}
 			if c.IsWebSocket() && req.Header.Get(echo.HeaderXForwardedFor) == "" { // For HTTP, it is automatically set by Go HTTP reverse proxy.
 				req.Header.Set(echo.HeaderXForwardedFor, c.RealIP())
 			}
diff --git a/vendor/github.com/labstack/echo/v4/middleware/secure.go b/vendor/github.com/labstack/echo/v4/middleware/secure.go
index 91bd31d7..c904abf1 100644
--- a/vendor/github.com/labstack/echo/v4/middleware/secure.go
+++ b/vendor/github.com/labstack/echo/v4/middleware/secure.go
@@ -106,6 +106,7 @@ func SecureWithConfig(config SecureConfig) echo.MiddlewareFunc {
 				return next(c)
 			}
 
+			req := c.Request()
 			res := c.Response()
 
 			if config.XSSProtection != "" {
@@ -117,7 +118,7 @@ func SecureWithConfig(config SecureConfig) echo.MiddlewareFunc {
 			if config.XFrameOptions != "" {
 				res.Header().Set(echo.HeaderXFrameOptions, config.XFrameOptions)
 			}
-			if config.HSTSMaxAge != 0 && c.Scheme() == "https" {
+			if (c.IsTLS() || (req.Header.Get(echo.HeaderXForwardedProto) == "https")) && config.HSTSMaxAge != 0 {
 				subdomains := ""
 				if !config.HSTSExcludeSubdomains {
 					subdomains = "; includeSubdomains"
diff --git a/vendor/github.com/labstack/echo/v4/middleware/slash.go b/vendor/github.com/labstack/echo/v4/middleware/slash.go
index a0736b32..53b30527 100644
--- a/vendor/github.com/labstack/echo/v4/middleware/slash.go
+++ b/vendor/github.com/labstack/echo/v4/middleware/slash.go
@@ -120,10 +120,6 @@ func RemoveTrailingSlashWithConfig(config TrailingSlashConfig) echo.MiddlewareFu
 }
 
 func sanitizeURI(uri string) string {
-	// Browsers remove tab and newline characters from URLs, so `/\t/example.com` is `//example.com` to them and a
-	// control character could hide the double slash from the check below. Percent-encode C0 control characters and
-	// DEL first; the browser then requests the same path.
-	uri = escapeControlChars(uri)
 	// double slash `\\`, `//` or even `\/` is absolute uri for browsers and by redirecting request to that uri
 	// we are vulnerable to open redirect attack. so replace all slashes from the beginning with single slash
 	if len(uri) > 1 && (uri[0] == '\\' || uri[0] == '/') && (uri[1] == '\\' || uri[1] == '/') {
@@ -131,29 +127,3 @@ func sanitizeURI(uri string) string {
 	}
 	return uri
 }
-
-// escapeControlChars percent-encodes C0 control characters and DEL in s.
-// Keep in sync with the copy in echo_fs.go.
-func escapeControlChars(s string) string {
-	i := 0
-	for i < len(s) && s[i] >= 0x20 && s[i] != 0x7f {
-		i++
-	}
-	if i == len(s) {
-		return s
-	}
-	const hexDigits = "0123456789ABCDEF"
-	var b strings.Builder
-	b.Grow(len(s) + 8)
-	b.WriteString(s[:i])
-	for ; i < len(s); i++ {
-		if ch := s[i]; ch < 0x20 || ch == 0x7f {
-			b.WriteByte('%')
-			b.WriteByte(hexDigits[ch>>4])
-			b.WriteByte(hexDigits[ch&0x0f])
-		} else {
-			b.WriteByte(ch)
-		}
-	}
-	return b.String()
-}
diff --git a/vendor/github.com/labstack/echo/v4/middleware/static.go b/vendor/github.com/labstack/echo/v4/middleware/static.go
index ac36bee6..16a98389 100644
--- a/vendor/github.com/labstack/echo/v4/middleware/static.go
+++ b/vendor/github.com/labstack/echo/v4/middleware/static.go
@@ -49,26 +49,13 @@ type StaticConfig struct {
 	// Optional. Defaults to http.Dir(config.Root)
 	Filesystem http.FileSystem `yaml:"-"`
 
-	// EnablePathUnescaping enables unescaping of the request path (or of the wildcard param `*` when the middleware is
-	// used on a wildcard route) before the file is looked up.
-	// Default false (safe): the path is used in the same form as the router matched it, so encoded characters such as
-	// encoded slashes (%2f) are NOT decoded, preventing ACL bypass where /admin%2fprivate.txt bypasses a /admin/* route
-	// guard by not matching that route but being decoded to admin/private.txt. As a consequence, file names that the
-	// client sends with non-default escaping (e.g. `%2C`, `%40` or lowercase hex like `%c3%a9`) are not found.
-	// Set to true only when serving files whose names need such unescaping and you are not relying on route-based
-	// ACL guards to restrict access. Paths with ".", ".." or empty segments are never served, also after unescaping.
-	//
-	// Enabling echo.RouterConfig.UseEscapedPathForMatching makes this field irrelevant and can lead to security issues when
-	// using different Routes to exclude some of the files from being served.
-	// e.g. if you serve files from directory as such and use different route to exclude some of the files from being served.
-	// 0. given folder structure:
-	//   public/
-	//   public/index.html
-	//   public/admin/private.txt
-	// 1. share `public/` folder contents from the server root with `e.Static("/", "public")`
-	// 2. naively assume that everything under /admin folder is now forbidden
-	//       e.GET("/admin/*", func(c *Context) error { return echo.ErrForbidden })
-	// Then request to `/assets/../admin%2fprivate.txt` will be served as router does not match it to guarded route.
+	// EnablePathUnescaping enables path parameter (param: *) unescaping.
+	// Default false (safe): encoded slashes (%2f) in the wildcard param are NOT decoded,
+	// preventing ACL bypass where /admin%2fprivate.txt bypasses a /admin/* route guard by
+	// not matching that route but having its wildcard param decoded to admin/private.txt.
+	// Set to true only when serving files whose names contain URL-encoded characters
+	// (e.g. "hello world.txt" via /hello%20world.txt) and you are not relying on
+	// route-based ACL guards to restrict access.
 	EnablePathUnescaping bool `yaml:"enablePathUnescaping"`
 }
 
@@ -152,10 +139,6 @@ var DefaultStaticConfig = StaticConfig{
 
 // Static returns a Static middleware to serves static content from the provided
 // root directory.
-//
-// Security: when registered with Echo#Use, the middleware runs before route and group middleware, so guards on routes
-// or groups (for example authentication on an `/admin` group) do not protect the files it serves. Keep files that
-// need protection outside the root directory, or serve them with Echo#Static / Group#Static behind the guard.
 func Static(root string) echo.MiddlewareFunc {
 	c := DefaultStaticConfig
 	c.Root = root
@@ -192,27 +175,15 @@ func StaticWithConfig(config StaticConfig) echo.MiddlewareFunc {
 				return next(c)
 			}
 
-			req := c.Request()
-			// Resolve the file from the same form of the path that the router matched: the escaped path when it
-			// differs from the default encoding. Using the decoded path would let `/admin%2Fsecret.txt` reach a file
-			// under a guarded `/admin/*` route (GHSA-375p-5qhx-8wq4).
-			p := req.URL.Path
-			if req.URL.RawPath != "" {
-				p = req.URL.RawPath
-			}
-			// A path with a ".", ".." or empty segment is resolved by path.Clean() to a different file than the path
-			// the router matched, so it is not served as a file (GHSA-3pmx-cf9f-34xr).
-			unclean := hasUncleanPath(req)
+			p := c.Request().URL.Path
 			if strings.HasSuffix(c.Path(), "*") { // When serving from a group, e.g. `/static*`.
 				p = c.Param("*")
-				unclean = unclean || hasDotOrEmptySegment(p)
 			}
-			if !unclean && config.EnablePathUnescaping {
+			if config.EnablePathUnescaping {
 				p, err = url.PathUnescape(p)
 				if err != nil {
 					return
 				}
-				unclean = hasDotOrEmptySegment(p) // unescaping can create new dot segments, e.g. `%2e%2e`
 			}
 			// Security: We use path.Clean() (not filepath.Clean()) because:
 			// 1. HTTP URLs always use forward slashes, regardless of server OS
@@ -231,12 +202,7 @@ func StaticWithConfig(config StaticConfig) echo.MiddlewareFunc {
 				}
 			}
 
-			var file http.File
-			if unclean {
-				err = os.ErrNotExist // handle like a missing file, so HTML5 mode can still serve the index
-			} else {
-				file, err = config.Filesystem.Open(name)
-			}
+			file, err := config.Filesystem.Open(name)
 			if err != nil {
 				if !isIgnorableOpenFileError(err) {
 					return err
@@ -319,30 +285,3 @@ func listDir(t *template.Template, name string, dir http.File, res *echo.Respons
 	}
 	return t.Execute(res, data)
 }
-
-// hasDotOrEmptySegment reports whether URL path p has a ".", ".." or empty segment. A single leading and a single
-// trailing slash are allowed.
-// Keep in sync with the copy in echo_fs.go.
-func hasDotOrEmptySegment(p string) bool {
-	p = strings.TrimPrefix(p, "/")
-	p = strings.TrimSuffix(p, "/")
-	if p == "" {
-		return false
-	}
-	for segment := range strings.SplitSeq(p, "/") {
-		if segment == "" || segment == "." || segment == ".." {
-			return true
-		}
-	}
-	return false
-}
-
-// hasUncleanPath reports whether the request path, in the form the router matches by default (the escaped path when it
-// differs from the default encoding), has a ".", ".." or empty segment. Encoded dots such as `%2E%2E` are not
-// segments here; they only act as `..` when path unescaping for static files is enabled.
-func hasUncleanPath(req *http.Request) bool {
-	if req.URL.RawPath != "" {
-		return hasDotOrEmptySegment(req.URL.RawPath)
-	}
-	return hasDotOrEmptySegment(req.URL.Path)
-}
diff --git a/vendor/github.com/labstack/echo/v4/scheme.go b/vendor/github.com/labstack/echo/v4/scheme.go
deleted file mode 100644
index 1ba4d642..00000000
--- a/vendor/github.com/labstack/echo/v4/scheme.go
+++ /dev/null
@@ -1,134 +0,0 @@
-// SPDX-License-Identifier: MIT
-// SPDX-FileCopyrightText: © 2015 LabStack LLC and Echo contributors
-
-package echo
-
-import (
-	"net"
-	"net/http"
-	"strings"
-)
-
-// SchemeExtractor is a function to determine the scheme (for example `http` or `https`) of http.Request.
-// Set appropriate one to Echo#SchemeExtractor.
-//
-// When Echo#SchemeExtractor is not set, Context.Scheme uses ExtractSchemeFromHeaders with the default trust options.
-type SchemeExtractor func(*http.Request) string
-
-// ExtractSchemeDirect returns a SchemeExtractor that uses only the actual connection: `https` for TLS connections
-// and `http` otherwise. Forwarding headers are ignored.
-// Use this if your server faces the internet directly (i.e.: uses no proxy).
-func ExtractSchemeDirect() SchemeExtractor {
-	return extractSchemeDirect
-}
-
-func extractSchemeDirect(req *http.Request) string {
-	if req.TLS != nil {
-		return "https"
-	}
-	return "http"
-}
-
-// ExtractSchemeFromHeaders returns a SchemeExtractor that uses the `X-Forwarded-Proto`, `X-Forwarded-Protocol`,
-// `X-Forwarded-Ssl` and `X-Url-Scheme` headers only when the request comes directly from a trusted address
-// (http.Request.RemoteAddr). For requests from other addresses the headers are ignored and the scheme of the actual
-// connection is used.
-//
-// By default, loopback, link-local and private network addresses and unix socket peers are trusted. Use TrustOption
-// to change this, for example TrustIPRange to trust a proxy that connects from a public address (such as a CDN or a
-// cloud load balancer). TrustLoopback(false) also stops trusting unix socket peers.
-//
-// When `X-Forwarded-Proto` is present, the other headers are ignored, and the last value is used. The trusted proxy
-// must therefore set (overwrite) `X-Forwarded-Proto` rather than pass through the value sent by the client.
-//
-// This is the default strategy when Echo#SchemeExtractor is not set.
-func ExtractSchemeFromHeaders(options ...TrustOption) SchemeExtractor {
-	checker := newIPChecker(options)
-	return func(req *http.Request) string {
-		return extractScheme(req, checker)
-	}
-}
-
-// LegacySchemeExtractor returns a SchemeExtractor that uses the forwarding headers from any client. This was the
-// behavior of Context.Scheme before the address of the client was checked.
-//
-// It is not safe against spoofing unless every request passes through a proxy that sets or removes the
-// `X-Forwarded-Proto`, `X-Forwarded-Protocol`, `X-Forwarded-Ssl` and `X-Url-Scheme` headers.
-// Use ExtractSchemeFromHeaders instead.
-func LegacySchemeExtractor() SchemeExtractor {
-	return legacySchemeExtractor
-}
-
-func legacySchemeExtractor(req *http.Request) string {
-	if req.TLS != nil {
-		return "https"
-	}
-	return schemeFromHeaders(req)
-}
-
-// defaultSchemeChecker is used by Context.Scheme when Echo#SchemeExtractor is not set.
-var defaultSchemeChecker = newIPChecker(nil)
-
-func extractScheme(req *http.Request, checker *ipChecker) string {
-	if req.TLS != nil {
-		return "https"
-	}
-	if !isTrustedPeer(req.RemoteAddr, checker) {
-		return "http"
-	}
-	return schemeFromHeaders(req)
-}
-
-// isTrustedPeer reports whether the direct peer of the request is trusted to set forwarding headers.
-func isTrustedPeer(remoteAddr string, checker *ipChecker) bool {
-	// Unix socket peers are on the same host, so they are trusted like loopback addresses. net/http reports them
-	// as an empty string, as "@" or "@name" (Linux, unnamed or abstract socket) or as the path of a bound socket.
-	if remoteAddr == "" || remoteAddr[0] == '@' || remoteAddr[0] == '/' {
-		return checker.trustLoopback
-	}
-	host, _, err := net.SplitHostPort(remoteAddr)
-	if err != nil {
-		host = remoteAddr
-	}
-	if i := strings.IndexByte(host, '%'); i != -1 { // IPv6 zone, e.g. "fe80::1%eth0"
-		host = host[:i]
-	}
-	ip := net.ParseIP(host)
-	return ip != nil && checker.trust(ip)
-}
-
-func schemeFromHeaders(req *http.Request) string {
-	// When X-Forwarded-Proto is present it is the only header used: a trusted proxy sets it, and the other headers
-	// might be client-supplied values that the proxy did not remove. With several values (repeated header lines or a
-	// comma-separated list) the last one was added by the nearest proxy.
-	if values := req.Header.Values(HeaderXForwardedProto); len(values) > 0 && values[len(values)-1] != "" {
-		last := values[len(values)-1]
-		if i := strings.LastIndexByte(last, ','); i != -1 {
-			last = last[i+1:]
-		}
-		if scheme, ok := canonicalProto(strings.TrimSpace(last)); ok {
-			return scheme
-		}
-		return "http"
-	}
-	if scheme, ok := canonicalProto(req.Header.Get(HeaderXForwardedProtocol)); ok {
-		return scheme
-	}
-	if ssl := req.Header.Get(HeaderXForwardedSsl); ssl == "on" {
-		return "https"
-	}
-	if scheme, ok := canonicalProto(req.Header.Get(HeaderXUrlScheme)); ok {
-		return scheme
-	}
-	return "http"
-}
-
-// canonicalProto returns the lowercase form of proto if it is `http`, `https`, `ws` or `wss` (in any case).
-func canonicalProto(proto string) (string, bool) {
-	for _, p := range [...]string{"http", "https", "ws", "wss"} {
-		if strings.EqualFold(proto, p) {
-			return p, true
-		}
-	}
-	return "", false
-}
diff --git a/vendor/github.com/rs/zerolog/.gitignore b/vendor/github.com/rs/zerolog/.gitignore
index c3622a0a..1a2fc214 100644
--- a/vendor/github.com/rs/zerolog/.gitignore
+++ b/vendor/github.com/rs/zerolog/.gitignore
@@ -23,5 +23,5 @@ _testmain.go
 *.exe
 *.test
 *.prof
-
-coverage.out
+
+coverage.out
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 6d96f60b..f8d05b5a 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -293,10 +293,12 @@ github.com/hashicorp/golang-lru/v2/internal
 # github.com/json-iterator/go v1.1.12
 ## explicit; go 1.12
 github.com/json-iterator/go
-# github.com/labstack/echo/v4 v4.16.0
+# github.com/labstack/echo/v4 v4.15.4
 ## explicit; go 1.25.0
 github.com/labstack/echo/v4
 github.com/labstack/echo/v4/middleware
+# github.com/labstack/echo/v5 v5.4.2
+## explicit; go 1.25.0
 # github.com/labstack/gommon v0.5.0
 ## explicit; go 1.23.0
 github.com/labstack/gommon/bytes