fix(deps): update module github.com/labstack/echo/v4 to v5 by renovate[bot] · Pull Request #181 · wasilak/tools

renovate · 2026-08-06T02:33:28Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/labstack/echo/v4	`v4.16.3` → `v5.4.4`

Release Notes

labstack/echo (github.com/labstack/echo/v4)

`v5.4.4`

Compare Source

Proxy identity hardening

Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

`v5.4.3`

Compare Source

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
Correct UseEscapedPathForMatching documentation without changing its behavior.
Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

Publish v4 support dates and the Echo Support offer (#3193).
Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

`v5.4.2`

Compare Source

Fixes

Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @Shubham-Padkonde.
Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3135, thanks to @hoangtaiki.

Upgrade

go get github.com/labstack/echo/v5@v5.4.2

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.

The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.

Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.

Full changelog: labstack/echo@v5.4.1...v5.4.2

`v5.4.1`

Compare Source

Security fixes

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

Behavior to review when upgrading

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

Other changes

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @rm-Umar, @Duodum, @irisitymichaelgrundberg, @Hama1cco, @jakezwang, @Shubham-Padkonde and @rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: labstack/echo@v5.4.0...v5.4.1

`v5.4.0`

Compare Source

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
Proxy middleware: always sets X-Real-IP from Context.RealIP(), so a client can no longer pass a spoofed X-Real-IP to the upstream. GHSA-99jh-6h7p-pp36
JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr

Behavior changes to check before upgrading

Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges:
```
_, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
_, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
```
Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
Proxy middleware headers. X-Real-IP sent to the upstream is now always Context.RealIP(). In a chain like nginx → Echo Proxy → upstream, configure Echo#IPExtractor (for example echo.ExtractIPFromRealIPHeader()) to pass the client address on. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded; X-Forwarded-Proto carries the scheme.
MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v5.2.1. With StaticConfig.EnablePathUnescaping or Config.EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

IPExtractor docs: corrected the description of the default (the direct peer address has been used since v5.1.0).
Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

`v5.3.1`

Compare Source

Fixes

fix(static): preserve matched handler 404s by @JSap0914 in #3043
fix(group): Implicitly registered group routes should be allowed overwritten in default routes by @aldas in #3049

Enhancements

docs: update HTTP badge URLs to HTTPS by @KeloYuan in #2968
docs: correct Any godoc to reflect true arbitrary-method matching by @hyorimitsu in #3046
refactor: use range-over-integer loops by @zxysilent in #3042
docs: add llms.txt and llms-full.txt for v5 documentation by @tamish560 in #3041
Update deps to latest versions by @aldas in #3050

`v5.3.0`

Compare Source

Logic changes
PR #2996 revert back to v4 behavior for a group registering implicit 404 handlers.

If you do not want this behavior, can do not want implicit 404 handlers for groups, use:

e :=  echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true})
g := e.Group("/api")

some other noteworthy echancements:

Adds first-class support for the QUERY HTTP method RFC 10008 in #3038

e.QUERY("/", func(c *Context) error {
  return c.String(http.StatusTeapot, "OK")
})

Router: automatically handle HEAD request by GET handlers in labtack#2949

e := echo.NewWithConfig(echo.Config{
  Router: echo.NewRouter(echo.RouterConfig{
    AutoHandleHEAD: true,
  }),
})

Enhancements

perf(json): pooled-buffer JSON deserialize by @vishr in #3023
perf(router): cache-friendly static child lookup by @vishr in #3024
update golang.org/x deps to latest versions by @aldas in #3034
pin GitHub Actions to full commit SHAs and rework actions SHAs to own variables by @aldas in #3035
docs(csrf): fix godoc typo in Generator default (tp -> to) by @DucMinhNe in #3026
docs(cors): note reverse-proxy header duplication by @vishr in #3027
feat: add support for HTTP QUERY method by @thdxg in #3038
docs: fix typos in API_CHANGES_V5.md by @maxtaran2010 in #3039
Router: auto HEAD to GET by @aldas in #2949
Revert back to v4 behavior for group registering implicit 404 handler… by @aldas in #2996

`v5.2.1`

Compare Source

Security

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

revert PR #3009 changes to just disabling path escaping by default in static methods/middleware by @aldas in #3016

Closes GHSA-vfp3-v2gw-7wfq more completely: the previous fix (#3009) rejected explicitly encoded
separators at the handler level; this patch makes the no-unescape behavior the default so new configurations are safe without extra opt-out steps.

What changed: DisablePathUnescaping (on StaticConfig and StaticDirectoryHandlerConfig) is deprecated and replaced by EnablePathUnescaping (default false). Path unescaping is now opt-in.

What this protects: With EnablePathUnescaping: false (new default), encoded separators (%2F, %5C) are never decoded before routing or file lookup, so they cannot
bypass route-level authentication or other middleware guards.

What this does NOT protect: Serving a directory with Static, StaticFS, or StaticDirectoryHandler exposes its entire subtree. Sibling routes are not a reliable
ACL boundary — attach authorization middleware directly to the static mount, or serve sensitive sub-trees under separate guarded routes.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

// Static middleware
e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
    EnablePathUnescaping: true, // only safe when NOT relying on route-based ACL guards
    ...
}))

// StaticDirectoryHandler
middleware.StaticDirectoryHandler(fs, &middleware.StaticDirectoryHandlerConfig{
    EnablePathUnescaping: true,
})

`v5.2.0`

Compare Source

Security

fix(static): reject encoded path separators that bypass route-level middleware by @vishr in #3009
fix(middleware/static): don't double-unescape request path (#2599) by @vishr in #3006

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler/StaticFS and the Static middleware are affected. Thanks to @a-tt-om and @oran-gugu for reporting.

Enhancements

feat(middleware): optional RateLimiterStoreContext for response headers (#2961) by @vishr in #3007
perf: optimize core hot paths (chain, context, binding, responses) by @vishr in #3008
fix(binder): include field name in bind conversion errors (#2629) by @vishr in #3005
fix(binder): serialize BindingError to structured JSON (#2771) by @vishr in #3004
fix(binder): MustUnixTime docs say time.Time, not time.Duration by @c-tonneslan in #2988
fix(middleware): reset ContentLength after gzip decompression by @shblue21 in #3000
fix(middleware/proxy): append RealIP to X-Forwarded-For for WebSocket requests by @kawaway in #2994
Fix proxy panic when balancer has no targets by @shblue21 in #2977
fix(middleware): correct documented KeyAuth KeyLookup default by @leestana01 in #2992
test: lock in v5 group route method-handling (405 + OPTIONS) by @vishr in #3003
docs: liveness signals in README + public ROADMAP by @vishr in #3002
Fix typos in CSRFConfig comments by @shblue21 in #2979
refactor: modernize code usage using gofix by @kumapower17 in #2970
refactor: replace Split in loops with more efficient SplitSeq by @box4wangjing in #2969
refactor: use the built-in max/min to simplify the code by @criciss in #2966
Update GitHub actions deps versions by @aldas in #2971

New Contributors

@criciss made their first contribution in #2966
@box4wangjing made their first contribution in #2969
@shblue21 made their first contribution in #2977
@c-tonneslan made their first contribution in #2988
@leestana01 made their first contribution in #2992
@kawaway made their first contribution in #2994

Full Changelog: labstack/echo@v5.1.1...v5.2.0

`v5.1.1`

Compare Source

Security

Context.Scheme() should validate values taken from header by @aldas in #2953

Thanks to @shblue21 for reporting this issue.

Enhancements

Add golangci linter configuration by @aldas in #2930
Make StartConfig listener creation context-aware by @EricGusmao in #2936
fix(lint): resolve staticcheck issues and improve code quality by @itsllyaz in #2941
Context.Scheme should validate values taken from header by @aldas in #2953
chore: fix typos in httperror.go by @tisonkun in #2958
Context.Json should not unwrap response by @aldas in #2964

`v5.1.0`

Compare Source

Security

This change does not break the API contract, but it does introduce breaking changes in logic/behavior.
If your application is using c.RealIP() beware and read https://echo.labstack.com/docs/ip-address

v4 behavior can be restored with:

e := echo.New()
e.IPExtractor = echo.LegacyIPExtractor()

Remove legacy IP extraction logic from context.RealIP method by @aldas in #2933

Enhancements

Add echo-opentelemetry to the README.md by @aldas in #2908
fix: correct spelling mistakes in comments and field name by @crawfordxx in #2916
Add https://github.com/labstack/echo-prometheus to the middleware list in README.md by @aldas in #2919
Add StartConfig.Listener so server with custom Listener is easier to create by @aldas in #2920
Fix rate limiter documentation for default burst value by @karesansui-u in #2925
Add doc comments to clarify usage of File related methods and leading slash handling by @aldas in #2928
Add NewDefaultFS function to help create filesystem that allows absolute paths by @aldas in #2931
Do not set http.Server.WriteTimeout in StartConfig by @aldas in #2932

`v5.0.4`

Compare Source

Enhancements

Remove unused import 'errors' from README example by @kumapower17 in #2889
Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @aldas in #2898
Update location of oapi-codegen in README by @mromaszewicz in #2896
Add Go 1.26 to CI flow by @aldas in #2899
Add new function echo.StatusCode by @suwakei in #2892
CSRF: support older token-based CSRF protection handler that want to render token into template by @aldas in #2894
Add echo.ResolveResponseStatus function to help middleware/handlers determine HTTP status code and echo.Response by @aldas in #2900

`v5.0.3`

Compare Source

Security

Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @shblue21.

This applies to cases when:

Windows is used as OS
middleware.StaticConfig.Filesystem is nil (default)
echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

`v5.0.2`

Compare Source

Security

Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in #2887

`v5.0.1`

Compare Source

Panic MW: will now return a custom PanicStackError with stack trace by @aldas in #2871
Docs: add missing err parameter to DenyHandler example by @cgalibern in #2878
improve: improve websocket checks in IsWebSocket() [per RFC 6455] by @raju-mechatronics in #2875
fix: Context.Json() should not send status code before serialization is complete by @aldas in #2877

`v5.0.0`

Compare Source

Echo v5 is maintenance release with major breaking changes

Context is now struct instead of interface and we can add method to it in the future in minor versions.
Adds new Router interface for possible new routing implementations.
Drops old logging interface and uses moderm log/slog instead.
Rearranges alot of methods/function signatures to make them more consistent.

Upgrade notes and v4 support:

Echo v4 is supported with security* updates and bug fixes until 2026-12-31
If you are using Echo in a production environment, it is recommended to wait until after 2026-03-31 before upgrading.
Until 2026-03-31, any critical issues requiring breaking v5 API changes will be addressed, even if this violates semantic versioning.

See API_CHANGES_V5.md for public API changes between v4 and v5, notes on upgrading.

Upgrading TLDR:

If you are using Linux you can migrate easier parts like that:

find . -type f -name "*.go" -exec sed -i 's/ echo.Context/ *echo.Context/g' {} +
find . -type f -name "*.go" -exec sed -i 's/echo\/v4/echo\/v5/g' {} +

macOS

find . -type f -name "*.go" -exec sed -i '' 's/ echo.Context/ *echo.Context/g' {} +
find . -type f -name "*.go" -exec sed -i '' 's/echo\/v4/echo\/v5/g' {} +

or in your favorite IDE

Replace all:

echo.Context -> *echo.Context
echo/v4 -> echo/v5

This should solve most of the issues. Probably the hardest part is updating all the tests.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codacy-production · 2026-08-06T02:34:26Z

Not up to standards ⛔

🔴 Issues 2 high · 1 medium

Alerts:
⚠ 3 issues (≤ 0 issues of at least minor severity)

Results:
3 new issues

Category Results

Security 1 medium
2 high

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

renovate Bot added renovate::dependencies renovate::go renovate::gomod renovate::major renovate::not-vulnerability labels Aug 6, 2026

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 2 times, most recently from 3a004d9 to 2acff83 Compare August 14, 2026 21:08

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch from 2acff83 to 2ef1401 Compare August 26, 2026 15:50

renovate Bot changed the title ~~fix(deps): update module github.com/labstack/echo/v4 to v5~~ fix(deps): update module github.com/labstack/echo/v4 to v5 - autoclosed Aug 27, 2026

renovate Bot closed this Aug 27, 2026

renovate Bot deleted the renovate/github.com-labstack-echo-v4-5.x branch August 27, 2026 08:15

renovate Bot changed the title ~~fix(deps): update module github.com/labstack/echo/v4 to v5 - autoclosed~~ fix(deps): update module github.com/labstack/echo/v4 to v5 Aug 27, 2026

renovate Bot reopened this Aug 27, 2026

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 2 times, most recently from 2ef1401 to addfe04 Compare August 27, 2026 10:54

renovate Bot changed the title ~~fix(deps): update module github.com/labstack/echo/v4 to v5~~ fix(deps): update module github.com/labstack/echo/v4 to v5 - autoclosed Aug 30, 2026

renovate Bot closed this Aug 30, 2026

renovate Bot changed the title ~~fix(deps): update module github.com/labstack/echo/v4 to v5 - autoclosed~~ fix(deps): update module github.com/labstack/echo/v4 to v5 Aug 31, 2026

renovate Bot reopened this Aug 31, 2026

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch from addfe04 to 9180369 Compare August 31, 2026 19:28

renovate Bot changed the title ~~fix(deps): update module github.com/labstack/echo/v4 to v5~~ fix(deps): update module github.com/labstack/echo/v4 to v5 - autoclosed Sep 2, 2026

renovate Bot closed this Sep 2, 2026

renovate Bot changed the title ~~fix(deps): update module github.com/labstack/echo/v4 to v5 - autoclosed~~ fix(deps): update module github.com/labstack/echo/v4 to v5 Sep 2, 2026

renovate Bot reopened this Sep 2, 2026

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 2 times, most recently from 9180369 to eaad913 Compare September 2, 2026 13:53

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 4 times, most recently from d9e63f3 to 3e7fb25 Compare October 1, 2026 03:29

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch from 3e7fb25 to 7dd86a6 Compare October 5, 2026 18:13

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 2 times, most recently from 6a9720a to 922555f Compare October 20, 2026 12:38

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 6 times, most recently from 994164a to a8143da Compare October 23, 2026 17:09

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch 3 times, most recently from 89768f0 to b4378ac Compare October 30, 2026 13:40

fix(deps): update module github.com/labstack/echo/v4 to v5

9cc3d34

renovate Bot force-pushed the renovate/github.com-labstack-echo-v4-5.x branch from b4378ac to 9cc3d34 Compare November 5, 2026 17:53

Navigation Menu

Repository navigation

fix(deps): update module github.com/labstack/echo/v4 to v5 - #181

fix(deps): update module github.com/labstack/echo/v4 to v5#181
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-labstack-echo-v4-5.x

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

Uh oh!

Release Notes

Security

Fixes

Documentation

Fixes

Upgrade

Security fixes

Behavior to review when upgrading

Other changes

Configuration

Uh oh!

Uh oh!

Not up to standards ⛔

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants