maxpeterkaya/web-proxy

Watch

Fork 0

chore(deps): update module github.com/labstack/echo/v5 to v5.3.1 #44

Open

renovate-bot wants to merge 1 commit from renovate/github.com-labstack-echo-v5-5.x into main

renovate-bot commented

2026-03-31 18:09:24 -04:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
github.com/labstack/echo/v5	require	minor	`v5.0.4` → `v5.3.1`

Release Notes

labstack/echo (github.com/labstack/echo/v5)

`v5.3.1`

Compare Source

Fixes

fix(static): preserve matched handler 404s by @JSap0914 in #3043
fix(group): Implicitly registered group routes should be allowed overwritten in default routes by @aldas in #3049

Enhancements

docs: update HTTP badge URLs to HTTPS by @KeloYuan in #2968
docs: correct Any godoc to reflect true arbitrary-method matching by @hyorimitsu in #3046
refactor: use range-over-integer loops by @zxysilent in #3042
docs: add llms.txt and llms-full.txt for v5 documentation by @tamish560 in #3041
Update deps to latest versions by @aldas in #3050

`v5.3.0`

Compare Source

Logic changes
PR #2996 revert back to v4 behavior for a group registering implicit 404 handlers.

If you do not want this behavior, can do not want implicit 404 handlers for groups, use:

e :=  echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true})
g := e.Group("/api")

some other noteworthy echancements:

Adds first-class support for the QUERY HTTP method RFC 10008 in #3038

e.QUERY("/", func(c *Context) error {
  return c.String(http.StatusTeapot, "OK")
})

Router: automatically handle HEAD request by GET handlers in labtack#2949

e := echo.NewWithConfig(echo.Config{
  Router: echo.NewRouter(echo.RouterConfig{
    AutoHandleHEAD: true,
  }),
})

Enhancements

perf(json): pooled-buffer JSON deserialize by @vishr in #3023
perf(router): cache-friendly static child lookup by @vishr in #3024
update golang.org/x deps to latest versions by @aldas in #3034
pin GitHub Actions to full commit SHAs and rework actions SHAs to own variables by @aldas in #3035
docs(csrf): fix godoc typo in Generator default (tp -> to) by @DucMinhNe in #3026
docs(cors): note reverse-proxy header duplication by @vishr in #3027
feat: add support for HTTP QUERY method by @thdxg in #3038
docs: fix typos in API_CHANGES_V5.md by @maxtaran2010 in #3039
Router: auto HEAD to GET by @aldas in #2949
Revert back to v4 behavior for group registering implicit 404 handler… by @aldas in #2996

`v5.2.1`

Compare Source

Security

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

revert PR #3009 changes to just disabling path escaping by default in static methods/middleware by @aldas in #3016

Closes GHSA-vfp3-v2gw-7wfq more completely: the previous fix (#3009) rejected explicitly encoded
separators at the handler level; this patch makes the no-unescape behavior the default so new configurations are safe without extra opt-out steps.

What changed: DisablePathUnescaping (on StaticConfig and StaticDirectoryHandlerConfig) is deprecated and replaced by EnablePathUnescaping (default false). Path unescaping is now opt-in.

What this protects: With EnablePathUnescaping: false (new default), encoded separators (%2F, %5C) are never decoded before routing or file lookup, so they cannot
bypass route-level authentication or other middleware guards.

What this does NOT protect: Serving a directory with Static, StaticFS, or StaticDirectoryHandler exposes its entire subtree. Sibling routes are not a reliable
ACL boundary — attach authorization middleware directly to the static mount, or serve sensitive sub-trees under separate guarded routes.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

// Static middleware
e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
    EnablePathUnescaping: true, // only safe when NOT relying on route-based ACL guards
    ...
}))

// StaticDirectoryHandler
middleware.StaticDirectoryHandler(fs, &middleware.StaticDirectoryHandlerConfig{
    EnablePathUnescaping: true,
})

Full Changelog: https://github.com/labstack/echo/compare/v5.2.0...v5.2.1

`v5.2.0`

Compare Source

Security

fix(static): reject encoded path separators that bypass route-level middleware by @vishr in #3009
fix(middleware/static): don't double-unescape request path (#2599) by @vishr in #3006

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler/StaticFS and the Static middleware are affected. Thanks to @a-tt-om and @oran-gugu for reporting.

Enhancements

feat(middleware): optional RateLimiterStoreContext for response headers (#2961) by @vishr in #3007
perf: optimize core hot paths (chain, context, binding, responses) by @vishr in #3008
fix(binder): include field name in bind conversion errors (#2629) by @vishr in #3005
fix(binder): serialize BindingError to structured JSON (#2771) by @vishr in #3004
fix(binder): MustUnixTime docs say time.Time, not time.Duration by @c-tonneslan in #2988
fix(middleware): reset ContentLength after gzip decompression by @shblue21 in #3000
fix(middleware/proxy): append RealIP to X-Forwarded-For for WebSocket requests by @kawaway in #2994
Fix proxy panic when balancer has no targets by @shblue21 in #2977
fix(middleware): correct documented KeyAuth KeyLookup default by @leestana01 in #2992
test: lock in v5 group route method-handling (405 + OPTIONS) by @vishr in #3003
docs: liveness signals in README + public ROADMAP by @vishr in #3002
Fix typos in CSRFConfig comments by @shblue21 in #2979
refactor: modernize code usage using gofix by @kumapower17 in #2970
refactor: replace Split in loops with more efficient SplitSeq by @box4wangjing in #2969
refactor: use the built-in max/min to simplify the code by @criciss in #2966
Update GitHub actions deps versions by @aldas in #2971

New Contributors

@criciss made their first contribution in #2966
@box4wangjing made their first contribution in #2969
@shblue21 made their first contribution in #2977
@c-tonneslan made their first contribution in #2988
@leestana01 made their first contribution in #2992
@kawaway made their first contribution in #2994

Full Changelog: https://github.com/labstack/echo/compare/v5.1.1...v5.2.0

`v5.1.1`

Compare Source

Security

Context.Scheme() should validate values taken from header by @aldas in #2953

Thanks to @shblue21 for reporting this issue.

Enhancements

Add golangci linter configuration by @aldas in #2930
Make StartConfig listener creation context-aware by @EricGusmao in #2936
fix(lint): resolve staticcheck issues and improve code quality by @itsllyaz in #2941
Context.Scheme should validate values taken from header by @aldas in #2953
chore: fix typos in httperror.go by @tisonkun in #2958
Context.Json should not unwrap response by @aldas in #2964

`v5.1.0`

Compare Source

Security

This change does not break the API contract, but it does introduce breaking changes in logic/behavior.
If your application is using c.RealIP() beware and read https://echo.labstack.com/docs/ip-address

v4 behavior can be restored with:

e := echo.New()
e.IPExtractor = echo.LegacyIPExtractor()

Remove legacy IP extraction logic from context.RealIP method by @aldas in #2933

Enhancements

Add echo-opentelemetry to the README.md by @aldas in #2908
fix: correct spelling mistakes in comments and field name by @crawfordxx in #2916
Add https://github.com/labstack/echo-prometheus to the middleware list in README.md by @aldas in #2919
Add StartConfig.Listener so server with custom Listener is easier to create by @aldas in #2920
Fix rate limiter documentation for default burst value by @karesansui-u in #2925
Add doc comments to clarify usage of File related methods and leading slash handling by @aldas in #2928
Add NewDefaultFS function to help create filesystem that allows absolute paths by @aldas in #2931
Do not set http.Server.WriteTimeout in StartConfig by @aldas in #2932

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/labstack/echo/v5](https://github.com/labstack/echo) | require | minor | `v5.0.4` → `v5.3.1` | --- ### Release Notes <details> <summary>labstack/echo (github.com/labstack/echo/v5)</summary> ### [`v5.3.1`](https://github.com/labstack/echo/blob/HEAD/CHANGELOG.md#v531---2026-07-21) [Compare Source](https://github.com/labstack/echo/compare/v5.3.0...v5.3.1) **Fixes** - fix(static): preserve matched handler 404s by [@JSap0914](https://github.com/JSap0914) in [#3043](https://github.com/labstack/echo/pull/3043) - fix(group): Implicitly registered group routes should be allowed overwritten in default routes by [@aldas](https://github.com/aldas) in [#3049](https://github.com/labstack/echo/pull/3049) **Enhancements** - docs: update HTTP badge URLs to HTTPS by [@KeloYuan](https://github.com/KeloYuan) in [#2968](https://github.com/labstack/echo/pull/2968) - docs: correct `Any` godoc to reflect true arbitrary-method matching by [@hyorimitsu](https://github.com/hyorimitsu) in [#3046](https://github.com/labstack/echo/pull/3046) - refactor: use range-over-integer loops by [@zxysilent](https://github.com/zxysilent) in [#3042](https://github.com/labstack/echo/pull/3042) - docs: add llms.txt and llms-full.txt for v5 documentation by [@tamish560](https://github.com/tamish560) in [#3041](https://github.com/labstack/echo/pull/3041) - Update deps to latest versions by [@aldas](https://github.com/aldas) in [#3050](https://github.com/labstack/echo/pull/3050) ### [`v5.3.0`](https://github.com/labstack/echo/blob/HEAD/CHANGELOG.md#v530---2026-07-12) [Compare Source](https://github.com/labstack/echo/compare/v5.2.1...v5.3.0) **Logic changes** PR [#2996](https://github.com/labstack/echo/pull/2996) revert back to `v4` behavior for a group registering implicit 404 handlers. If you do not want this behavior, can do not want implicit 404 handlers for groups, use: ```go e := echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true}) g := e.Group("/api") ``` some other noteworthy echancements: - Adds first-class support for the QUERY HTTP method [RFC 10008](https://www.rfc-editor.org/info/rfc10008/) in [#3038](https://github.com/labstack/echo/pull/3038) ```go e.QUERY("/", func(c *Context) error { return c.String(http.StatusTeapot, "OK") }) ``` - Router: automatically handle HEAD request by GET handlers in [labtack#2949](https://github.com/labtack/echo/pull/2949) ```go e := echo.NewWithConfig(echo.Config{ Router: echo.NewRouter(echo.RouterConfig{ AutoHandleHEAD: true, }), }) ``` **Enhancements** - perf(json): pooled-buffer JSON deserialize by [@vishr](https://github.com/vishr) in [#3023](https://github.com/labstack/echo/pull/3023) - perf(router): cache-friendly static child lookup by [@vishr](https://github.com/vishr) in [#3024](https://github.com/labstack/echo/pull/3024) - update golang.org/x deps to latest versions by [@aldas](https://github.com/aldas) in [#3034](https://github.com/labstack/echo/pull/3034) - pin GitHub Actions to full commit SHAs and rework actions SHAs to own variables by [@aldas](https://github.com/aldas) in [#3035](https://github.com/labstack/echo/pull/3035) - docs(csrf): fix godoc typo in Generator default (tp -> to) by [@DucMinhNe](https://github.com/DucMinhNe) in [#3026](https://github.com/labstack/echo/pull/3026) - docs(cors): note reverse-proxy header duplication by [@vishr](https://github.com/vishr) in [#3027](https://github.com/labstack/echo/pull/3027) - feat: add support for HTTP QUERY method by [@thdxg](https://github.com/thdxg) in [#3038](https://github.com/labstack/echo/pull/3038) - docs: fix typos in API\_CHANGES\_V5.md by [@maxtaran2010](https://github.com/maxtaran2010) in [#3039](https://github.com/labstack/echo/pull/3039) - Router: auto HEAD to GET by [@aldas](https://github.com/aldas) in [#2949](https://github.com/labstack/echo/pull/2949) - Revert back to v4 behavior for group registering implicit 404 handler… by [@aldas](https://github.com/aldas) in [#2996](https://github.com/labstack/echo/pull/2996) ### [`v5.2.1`](https://github.com/labstack/echo/releases/tag/v5.2.1) [Compare Source](https://github.com/labstack/echo/compare/v5.2.0...v5.2.1) **Security** Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent. Given following situation: ```go // 0. // given folder structure: // private.txt // public/ // public/index.html // public/text.txt // public/admin/private.txt // 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which // contents we want to forbid from downloading e.Static("/", "public") // 2. naively assume that everything under /admin folder is now forbidden e.GET("/admin/*", func(c *Context) error { return ErrForbidden }) ``` Then requests to `/admin%2fprivate.txt` would not be matched to `GET /admin/*` route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file. Note: this way of "guarding" subfolders will never work for for paths like `/assets/../admin%2fprivate.txt` which will `path.Clean("/assets/../admin%2fprivate.txt")` to `/admin/private.txt` and are servable if static file serving is configured to unescape paths. If you want to guard routes - use middlewares on `Static*` methods and before `Static` middleware. *** - revert PR [#3009](https://github.com/labstack/echo/issues/3009) changes to just disabling path escaping by default in static methods/middleware by [@aldas](https://github.com/aldas) in [#3016](https://github.com/labstack/echo/pull/3016) Closes [GHSA-vfp3-v2gw-7wfq](https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq) more completely: the previous fix ([#3009](https://github.com/labstack/echo/issues/3009)) rejected explicitly encoded separators at the handler level; this patch makes the no-unescape behavior the **default** so new configurations are safe without extra opt-out steps. **What changed:** `DisablePathUnescaping` (on `StaticConfig` and `StaticDirectoryHandlerConfig`) is deprecated and replaced by `EnablePathUnescaping` (default `false`). Path unescaping is now opt-in. **What this protects:** With `EnablePathUnescaping: false` (new default), encoded separators (`%2F`, `%5C`) are never decoded before routing or file lookup, so they cannot bypass route-level authentication or other middleware guards. **What this does NOT protect:** Serving a directory with `Static`, `StaticFS`, or `StaticDirectoryHandler` exposes its **entire subtree**. Sibling routes are not a reliable ACL boundary — attach authorization middleware directly to the static mount, or serve sensitive sub-trees under separate guarded routes. **Breaking change / migration:** If you serve files whose names contain URL-encoded characters (e.g., `/hello%20world.txt` → `hello world.txt`), you must now opt in: ```go // Static middleware e.Use(middleware.StaticWithConfig(middleware.StaticConfig{ EnablePathUnescaping: true, // only safe when NOT relying on route-based ACL guards ... })) // StaticDirectoryHandler middleware.StaticDirectoryHandler(fs, &middleware.StaticDirectoryHandlerConfig{ EnablePathUnescaping: true, }) ``` **Full Changelog**: <https://github.com/labstack/echo/compare/v5.2.0...v5.2.1> ### [`v5.2.0`](https://github.com/labstack/echo/blob/HEAD/CHANGELOG.md#v520---2026-06-14) [Compare Source](https://github.com/labstack/echo/compare/v5.1.1...v5.2.0) **Security** - fix(static): reject encoded path separators that bypass route-level middleware by [@vishr](https://github.com/vishr) in [#3009](https://github.com/labstack/echo/pull/3009) - fix(middleware/static): don't double-unescape request path ([#2599](https://github.com/labstack/echo/issues/2599)) by [@vishr](https://github.com/vishr) in [#3006](https://github.com/labstack/echo/pull/3006) Fixes [GHSA-vfp3-v2gw-7wfq](https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq): an encoded path separator (`%2F` or `%5C`) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both `StaticDirectoryHandler`/`StaticFS` and the `Static` middleware are affected. Thanks to [@a-tt-om](https://github.com/a-tt-om) and [@oran-gugu](https://github.com/oran-gugu) for reporting. **Enhancements** - feat(middleware): optional RateLimiterStoreContext for response headers ([#2961](https://github.com/labstack/echo/issues/2961)) by [@vishr](https://github.com/vishr) in [#3007](https://github.com/labstack/echo/pull/3007) - perf: optimize core hot paths (chain, context, binding, responses) by [@vishr](https://github.com/vishr) in [#3008](https://github.com/labstack/echo/pull/3008) - fix(binder): include field name in bind conversion errors ([#2629](https://github.com/labstack/echo/issues/2629)) by [@vishr](https://github.com/vishr) in [#3005](https://github.com/labstack/echo/pull/3005) - fix(binder): serialize BindingError to structured JSON ([#2771](https://github.com/labstack/echo/issues/2771)) by [@vishr](https://github.com/vishr) in [#3004](https://github.com/labstack/echo/pull/3004) - fix(binder): MustUnixTime docs say time.Time, not time.Duration by [@c-tonneslan](https://github.com/c-tonneslan) in [#2988](https://github.com/labstack/echo/pull/2988) - fix(middleware): reset ContentLength after gzip decompression by [@shblue21](https://github.com/shblue21) in [#3000](https://github.com/labstack/echo/pull/3000) - fix(middleware/proxy): append RealIP to X-Forwarded-For for WebSocket requests by [@kawaway](https://github.com/kawaway) in [#2994](https://github.com/labstack/echo/pull/2994) - Fix proxy panic when balancer has no targets by [@shblue21](https://github.com/shblue21) in [#2977](https://github.com/labstack/echo/pull/2977) - fix(middleware): correct documented KeyAuth KeyLookup default by [@leestana01](https://github.com/leestana01) in [#2992](https://github.com/labstack/echo/pull/2992) - test: lock in v5 group route method-handling (405 + OPTIONS) by [@vishr](https://github.com/vishr) in [#3003](https://github.com/labstack/echo/pull/3003) - docs: liveness signals in README + public ROADMAP by [@vishr](https://github.com/vishr) in [#3002](https://github.com/labstack/echo/pull/3002) - Fix typos in CSRFConfig comments by [@shblue21](https://github.com/shblue21) in [#2979](https://github.com/labstack/echo/pull/2979) - refactor: modernize code usage using gofix by [@kumapower17](https://github.com/kumapower17) in [#2970](https://github.com/labstack/echo/pull/2970) - refactor: replace Split in loops with more efficient SplitSeq by [@box4wangjing](https://github.com/box4wangjing) in [#2969](https://github.com/labstack/echo/pull/2969) - refactor: use the built-in max/min to simplify the code by [@criciss](https://github.com/criciss) in [#2966](https://github.com/labstack/echo/pull/2966) - Update GitHub actions deps versions by [@aldas](https://github.com/aldas) in [#2971](https://github.com/labstack/echo/pull/2971) **New Contributors** - [@criciss](https://github.com/criciss) made their first contribution in [#2966](https://github.com/labstack/echo/pull/2966) - [@box4wangjing](https://github.com/box4wangjing) made their first contribution in [#2969](https://github.com/labstack/echo/pull/2969) - [@shblue21](https://github.com/shblue21) made their first contribution in [#2977](https://github.com/labstack/echo/pull/2977) - [@c-tonneslan](https://github.com/c-tonneslan) made their first contribution in [#2988](https://github.com/labstack/echo/pull/2988) - [@leestana01](https://github.com/leestana01) made their first contribution in [#2992](https://github.com/labstack/echo/pull/2992) - [@kawaway](https://github.com/kawaway) made their first contribution in [#2994](https://github.com/labstack/echo/pull/2994) **Full Changelog**: <https://github.com/labstack/echo/compare/v5.1.1...v5.2.0> ### [`v5.1.1`](https://github.com/labstack/echo/blob/HEAD/CHANGELOG.md#v511---2026-05-01) [Compare Source](https://github.com/labstack/echo/compare/v5.1.0...v5.1.1) **Security** - `Context.Scheme()` should validate values taken from header by [@aldas](https://github.com/aldas) in [#2953](https://github.com/labstack/echo/pull/2953) Thanks to [@shblue21](https://github.com/shblue21) for reporting this [issue](https://github.com/labstack/echo/issues/2952). **Enhancements** - Add golangci linter configuration by [@aldas](https://github.com/aldas) in [#2930](https://github.com/labstack/echo/pull/2930) - Make StartConfig listener creation context-aware by [@EricGusmao](https://github.com/EricGusmao) in [#2936](https://github.com/labstack/echo/pull/2936) - fix(lint): resolve staticcheck issues and improve code quality by [@itsllyaz](https://github.com/itsllyaz) in [#2941](https://github.com/labstack/echo/pull/2941) - Context.Scheme should validate values taken from header by [@aldas](https://github.com/aldas) in [#2953](https://github.com/labstack/echo/pull/2953) - chore: fix typos in httperror.go by [@tisonkun](https://github.com/tisonkun) in [#2958](https://github.com/labstack/echo/pull/2958) - Context.Json should not unwrap response by [@aldas](https://github.com/aldas) in [#2964](https://github.com/labstack/echo/pull/2964) ### [`v5.1.0`](https://github.com/labstack/echo/blob/HEAD/CHANGELOG.md#v510---2026-03-31) [Compare Source](https://github.com/labstack/echo/compare/v5.0.4...v5.1.0) **Security** This change does not break the API contract, but it does introduce breaking changes in logic/behavior. If your application is using `c.RealIP()` beware and read <https://echo.labstack.com/docs/ip-address> `v4` behavior can be restored with: ```go e := echo.New() e.IPExtractor = echo.LegacyIPExtractor() ``` - Remove legacy IP extraction logic from context.RealIP method by [@aldas](https://github.com/aldas) in [#2933](https://github.com/labstack/echo/pull/2933) **Enhancements** - Add echo-opentelemetry to the README.md by [@aldas](https://github.com/aldas) in [#2908](https://github.com/labstack/echo/pull/2908) - fix: correct spelling mistakes in comments and field name by [@crawfordxx](https://github.com/crawfordxx) in [#2916](https://github.com/labstack/echo/pull/2916) - Add <https://github.com/labstack/echo-prometheus> to the middleware list in README.md by [@aldas](https://github.com/aldas) in [#2919](https://github.com/labstack/echo/pull/2919) - Add StartConfig.Listener so server with custom Listener is easier to create by [@aldas](https://github.com/aldas) in [#2920](https://github.com/labstack/echo/pull/2920) - Fix rate limiter documentation for default burst value by [@karesansui-u](https://github.com/karesansui-u) in [#2925](https://github.com/labstack/echo/pull/2925) - Add doc comments to clarify usage of File related methods and leading slash handling by [@aldas](https://github.com/aldas) in [#2928](https://github.com/labstack/echo/pull/2928) - Add NewDefaultFS function to help create filesystem that allows absolute paths by [@aldas](https://github.com/aldas) in [#2931](https://github.com/labstack/echo/pull/2931) - Do not set http.Server.WriteTimeout in StartConfig by [@aldas](https://github.com/aldas) in [#2932](https://github.com/labstack/echo/pull/2932) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-03-31 18:09:24 -04:00

chore(deps): update module github.com/labstack/echo/v5 to v5.1.0 41677431e9

renovate-bot changed title from ~~chore(deps): update module github.com/labstack/echo/v5 to v5.1.0~~ to chore(deps): update module github.com/labstack/echo/v5 to v5.1.1

2026-05-01 15:48:46 -04:00

renovate-bot force-pushed renovate/github.com-labstack-echo-v5-5.x from 41677431e9 to 16beeb8162

2026-05-01 15:48:49 -04:00

Compare

renovate-bot changed title from ~~chore(deps): update module github.com/labstack/echo/v5 to v5.1.1~~ to chore(deps): update module github.com/labstack/echo/v5 to v5.2.0

2026-06-14 10:56:15 -04:00

renovate-bot force-pushed renovate/github.com-labstack-echo-v5-5.x from 16beeb8162 to 051c98626b

2026-06-14 10:56:18 -04:00

Compare

renovate-bot changed title from ~~chore(deps): update module github.com/labstack/echo/v5 to v5.2.0~~ to chore(deps): update module github.com/labstack/echo/v5 to v5.2.1

2026-06-15 14:26:26 -04:00

renovate-bot force-pushed renovate/github.com-labstack-echo-v5-5.x from 051c98626b to f24d472d5a

2026-06-15 14:26:27 -04:00

Compare

renovate-bot force-pushed renovate/github.com-labstack-echo-v5-5.x from f24d472d5a to a8a16800d0

2026-07-02 22:58:41 -04:00

Compare

renovate-bot changed title from ~~chore(deps): update module github.com/labstack/echo/v5 to v5.2.1~~ to chore(deps): update module github.com/labstack/echo/v5 to v5.3.0

2026-07-12 16:33:26 -04:00

renovate-bot commented

2026-07-12 16:33:26 -04:00

Author

Collaborator

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

5 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.47.0` -> `v0.54.0`
`golang.org/x/net`	`v0.49.0` -> `v0.57.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.47.0`
`golang.org/x/text`	`v0.33.0` -> `v0.40.0`
`golang.org/x/time`	`v0.14.0` -> `v0.15.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 5 additional dependencies were updated Details: | **Package** | **Change** | | :-------------------- | :--------------------- | | `golang.org/x/crypto` | `v0.47.0` -> `v0.54.0` | | `golang.org/x/net` | `v0.49.0` -> `v0.57.0` | | `golang.org/x/sys` | `v0.40.0` -> `v0.47.0` | | `golang.org/x/text` | `v0.33.0` -> `v0.40.0` | | `golang.org/x/time` | `v0.14.0` -> `v0.15.0` |

renovate-bot force-pushed renovate/github.com-labstack-echo-v5-5.x from a8a16800d0 to 074ac99091

2026-07-12 16:33:26 -04:00

Compare

renovate-bot changed title from ~~chore(deps): update module github.com/labstack/echo/v5 to v5.3.0~~ to chore(deps): update module github.com/labstack/echo/v5 to v5.3.1

2026-07-21 12:27:40 -04:00

renovate-bot force-pushed renovate/github.com-labstack-echo-v5-5.x from 074ac99091 to e6a455f315

2026-07-21 12:27:41 -04:00

Compare

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/github.com-labstack-echo-v5-5.x:renovate/github.com-labstack-echo-v5-5.x

git switch renovate/github.com-labstack-echo-v5-5.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/github.com-labstack-echo-v5-5.x

git switch renovate/github.com-labstack-echo-v5-5.x

git rebase main

git switch main

git merge --ff-only renovate/github.com-labstack-echo-v5-5.x

git switch renovate/github.com-labstack-echo-v5-5.x

git rebase main

git switch main

git merge --no-ff renovate/github.com-labstack-echo-v5-5.x

git switch main

git merge --squash renovate/github.com-labstack-echo-v5-5.x