[dependabot]

Bumps github.com/labstack/echo/v4 from 4.16.0 to 4.16.1.

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.16.1

Security fixes

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
• Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
• Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

Behavior to review when upgrading

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

Other changes

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @​Duodum, @​irisitymichaelgrundberg, @​q490107865, @​Hama1cco, @​jakezwang and @​Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

Full changelog: labstack/echo@v4.16.0...v4.16.1

Commits

• 600b985 chore: prepare v4.16.1 security release (#3186)
• 3fb0ba7 Merge commit from fork
• be08005 fix(router): grow param values for contexts created before a route with more ...
• 320fe67 fix(bind): honor OpenAPI date, date-time and date-time-local format tags (v4)...
• f085ffb fix(router): handle escaped colons and inline verbs in v4 (#3132)
• 5440f99 fix(middleware): prevent BodyLimit bypass in v4 (#3131)
• 577ba39 static: harden dot-segment check for backslashes, test non-validating custom ...
• 5730445 docs: add Blacksmith to sponsors (#3127)
• a7109fa docs: link the OpenTelemetry middleware at labstack/echo-otel (#3125)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 25, 2026 6:59pm UTC
website-showcase	Error		Oct 25, 2026 6:59pm UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
ainsleyclark.com	Ignored	Preview	Oct 25, 2026 6:59pm UTC
ainsleydev	Ignored	Preview	Oct 25, 2026 6:59pm UTC

[dependabot]

Looks like github.com/labstack/echo/v4 is up-to-date now, so this is no longer needed.