[dependabot]

Bumps github.com/labstack/echo/v4 from 4.16.0 to 4.16.3.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.3

Security and migration

Applications behind proxies must configure Echo#IPExtractor to trust their own proxies before upgrading. Without an extractor, clients behind one proxy share its address for rate limiting, IP-based access controls, logging, and proxy forwarding. The safe default now ignores client-supplied IP headers.

This release fixes the remaining v4 exposure for:

• CVE-2026-118651: Proxy always derives upstream X-Real-IP from Context.RealIP(), including after hop-by-hop header stripping and on WebSocket upgrades. One derived identity is preserved across retries.
• CVE-2026-118653: Context.RealIP() uses the connection peer when IPExtractor is unset, so rotating spoofed forwarded-IP headers cannot create fresh default rate-limit buckets.

Use echo.ExtractIPDirect() without a proxy. Behind a proxy, use ExtractIPFromXFFHeader or ExtractIPFromRealIPHeader with trust restricted to your proxies. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Migration example with explicit proxy trust ranges

Other changes

• Resolve bare IPv4 and IPv6 connection addresses without a port.
• Document v4 support dates (#3194).

No dependency or minimum Go-version changes; Go 1.26 or later remains required.

The security fix (#3197) passed independent agent and Claude reviews, full race tests on Go 1.26 and 1.27, and GitHub Linux/macOS/Windows checks.

Full Changelog: labstack/echo@v4.16.2...v4.16.3

v4.16.2

Fixes

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @​Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @​hoangtaiki.
• Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @​orinnz; backport of the existing v5 validation in #3067.

Upgrade

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: labstack/echo@v4.16.1...v4.16.2

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.16.3 - 2026-10-29

Security

• Client IP defaults: when Echo#IPExtractor is unset, Context.RealIP() now uses the connection peer and ignores X-Forwarded-For and X-Real-IP. This prevents clients from selecting their own default rate-limit bucket. Fixes CVE-2026-118653.
• Proxy identity: Proxy middleware always replaces upstream X-Real-IP with the derived client identity, including after Connection-nominated header removal and on WebSocket upgrades. The identity is derived once and preserved across retries. Fixes CVE-2026-118651.

Migration required for applications behind proxies

Configure Echo#IPExtractor to trust only your deployment's proxies before upgrading. Otherwise, clients behind one proxy share its address for rate limiting, access controls, logging, and proxy forwarding. See the README migration example for explicit XFF trust ranges; use the same trust options with ExtractIPFromRealIPHeader for proxies that set X-Real-IP. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Other changes

• The direct-peer fallback now accepts bare IPv4 and IPv6 addresses without a port.
• Document v4 bug-fix and security-fix support dates (#3194).

Implementation: #3197. No dependency or minimum Go-version changes; Go 1.26 or later remains required.

Commits

• c99c7cb chore: prepare v4.16.3 security release (#3198)
• ebbb855 fix: secure v4 client IP defaults for proxying and rate limiting (#3197)
• fa780cd docs: state v4 bug-fix and security-fix dates (#3194)
• 679c415 chore: prepare v4.16.2 release (#3191)
• 3b16891 fix(middleware): reject empty CSRF tokens in v4 (#3189)
• 6d1bb2e fix(middleware): check Basic auth scheme boundary in v4 (#3188)
• ea608ae fix(middleware): reject CSRF TokenLookup that produces no extractors in v4 (#...
• 600b985 chore: prepare v4.16.1 security release (#3186)
• 3fb0ba7 Merge commit from fork
• be08005 fix(router): grow param values for contexts created before a route with more ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)