[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/labstack/echo/v5	v5.4.2 → v5.4.4

---

Release Notes

labstack/echo (github.com/labstack/echo/v5)

v5.4.4

Compare Source

Proxy identity hardening

• Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
• Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
• Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #​3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

v5.4.3

Compare Source

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

• Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
• Correct UseEscapedPathForMatching documentation without changing its behavior.
• Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

• Publish v4 support dates and the Echo Support offer (#​3193).
• Mention Echo Pro in the Sponsors section (#​3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​labstack/​echo/​v5@​v5.4.2 ⏵ v5.4.4	+1

View full report