From 7f241d0638a2dd30dcaecebbe5d8ddb49da420d6 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Fri, 30 Oct 2026 07:41:10 -0700 Subject: [PATCH 1/2] docs: polish the v4 README with GitHub Markdown features Add a centered header with the Echo logo for light and dark themes, the tagline, badges and a link row. Flag the v4.16.3 client IP migration with an IMPORTANT alert, show the example's output, and fold the third-party middleware list into a collapsed section. --- .github/assets/echo-logo-dark.svg | 1 + .github/assets/echo-logo-light.svg | 1 + README.md | 61 ++++++++++++++++++++++-------- 3 files changed, 47 insertions(+), 16 deletions(-) create mode 100644 .github/assets/echo-logo-dark.svg create mode 100644 .github/assets/echo-logo-light.svg diff --git a/.github/assets/echo-logo-dark.svg b/.github/assets/echo-logo-dark.svg new file mode 100644 index 000000000..f1c09baaf --- /dev/null +++ b/.github/assets/echo-logo-dark.svg @@ -0,0 +1 @@ + diff --git a/.github/assets/echo-logo-light.svg b/.github/assets/echo-logo-light.svg new file mode 100644 index 000000000..429e0363d --- /dev/null +++ b/.github/assets/echo-logo-light.svg @@ -0,0 +1 @@ + diff --git a/README.md b/README.md index 1f23f98ca..193ae36c2 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,35 @@ -[![Go Reference](https://pkg.go.dev/badge/github.com/labstack/echo/v4.svg)](https://pkg.go.dev/github.com/labstack/echo/v4) -[![CI](https://img.shields.io/github/actions/workflow/status/labstack/echo/echo.yml?branch=v4&style=flat-square&label=ci)](https://github.com/labstack/echo/actions/workflows/echo.yml?query=branch%3Av4) -[![Codecov](https://img.shields.io/codecov/c/github/labstack/echo/v4.svg?style=flat-square)](https://codecov.io/gh/labstack/echo/tree/v4) -[![Discussions](https://img.shields.io/badge/community-discussions-00afd1.svg?style=flat-square)](https://github.com/labstack/echo/discussions) -[![X](https://img.shields.io/badge/x-@labstack-000000.svg?style=flat-square)](https://x.com/labstack) -[![License](https://img.shields.io/badge/license-mit-blue.svg?style=flat-square)](https://github.com/labstack/echo/blob/v4/LICENSE) - -## Echo v4 - -High performance, extensible, minimalist Go web framework. +

+ + + + Echo + + +

+ +

High performance, extensible, minimalist Go web framework.
Echo v4 maintenance line

+ +

+ Go Reference + CI + Codecov + Discussions + X + License +

+ +

+ v4 API reference · + Upgrade to v5 · + Website (v5) · + Discussions · + Commercial support +

+ +## About This branch holds Echo v4, the maintenance line. Echo v5 is the current release; start new projects on [v5](https://github.com/labstack/echo). -- [v4 API reference](https://pkg.go.dev/github.com/labstack/echo/v4) -- [Upgrade from v4 to v5](https://github.com/labstack/echo/blob/master/API_CHANGES_V5.md) -- [Website](https://echo.labstack.com) (documents v5) -- Community help: [GitHub Discussions](https://github.com/labstack/echo/discussions) -- Commercial support: [Echo Support](https://echo.labstack.com/pro#support) - ### Support Echo v4 receives bug fixes until 2026-12-31 and free security fixes until 2027-12-31, on its latest release only. It gets no new features. See [SECURITY.md](https://github.com/labstack/echo/blob/master/SECURITY.md) for the full policy. @@ -29,6 +42,9 @@ Echo v4 requires Go 1.26 or later (since v4.16.1), to use patched `golang.org/x/ ### Client IP security migration since v4.16.3 +> [!IMPORTANT] +> Behind a proxy, set `Echo#IPExtractor` before you upgrade to v4.16.3. Otherwise all clients behind the proxy share one IP address for rate limiting, access controls and logging. + Echo v4.16.3 changes client IP defaults. Without `Echo#IPExtractor`, `Context.RealIP()` uses the connection peer and ignores `X-Forwarded-For` and `X-Real-IP`. Proxy middleware always replaces upstream `X-Real-IP` with this result. This fixes [CVE-2026-118651](https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36) and [CVE-2026-118653](https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq). Applications that already set `Echo#IPExtractor` keep their behavior. A custom rate-limit identifier that does not call `RealIP()` is also unaffected. Behind a proxy, configure `Echo#IPExtractor` before starting the server. Otherwise, clients behind the same proxy share its IP address for rate limiting, access controls and logging. Use `echo.ExtractIPDirect()` when there is no proxy. For proxies that set `X-Forwarded-For`, turn off the broad default trust ranges and trust only your proxy addresses: @@ -125,6 +141,14 @@ func hello(c echo.Context) error { } ``` +Run it and send a request: + +```console +$ go run . +$ curl http://localhost:8080/ +Hello, World! +``` + ## Official middleware The Echo team maintains these repositories. @@ -137,6 +161,9 @@ The Echo team maintains these repositories. ## Third-party middleware +
+Third-party middleware list + The Echo team does not review or maintain these projects. Check their quality and security, and that each one supports v4, before you use them. | Repository | Description | @@ -150,6 +177,8 @@ The Echo team does not review or maintain these projects. Check their quality an | [github.com/mikestefanello/pagoda](https://github.com/mikestefanello/pagoda) | Full-stack web starter kit built with Echo | | [github.com/go-woo/protoc-gen-echo](https://github.com/go-woo/protoc-gen-echo) | Generates Echo server code from Protocol Buffers | +
+ To add your library, send a pull request. ## Contribute From 7a5cca3b5e9911e7d13f45e12efd374f717a34e7 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Fri, 30 Oct 2026 07:59:16 -0700 Subject: [PATCH 2/2] docs: keep the v4 README readable on pkg.go.dev Use a bold note instead of a GitHub alert, and load the logos from master by absolute URL instead of adding a copy to the v4 branch. --- .github/assets/echo-logo-dark.svg | 1 - .github/assets/echo-logo-light.svg | 1 - README.md | 7 +++---- 3 files changed, 3 insertions(+), 6 deletions(-) delete mode 100644 .github/assets/echo-logo-dark.svg delete mode 100644 .github/assets/echo-logo-light.svg diff --git a/.github/assets/echo-logo-dark.svg b/.github/assets/echo-logo-dark.svg deleted file mode 100644 index f1c09baaf..000000000 --- a/.github/assets/echo-logo-dark.svg +++ /dev/null @@ -1 +0,0 @@ - diff --git a/.github/assets/echo-logo-light.svg b/.github/assets/echo-logo-light.svg deleted file mode 100644 index 429e0363d..000000000 --- a/.github/assets/echo-logo-light.svg +++ /dev/null @@ -1 +0,0 @@ - diff --git a/README.md b/README.md index 193ae36c2..2a1602509 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@

- - Echo + + Echo

@@ -42,8 +42,7 @@ Echo v4 requires Go 1.26 or later (since v4.16.1), to use patched `golang.org/x/ ### Client IP security migration since v4.16.3 -> [!IMPORTANT] -> Behind a proxy, set `Echo#IPExtractor` before you upgrade to v4.16.3. Otherwise all clients behind the proxy share one IP address for rate limiting, access controls and logging. +> **Important:** Behind a proxy, set `Echo#IPExtractor` before you upgrade to v4.16.3. Otherwise all clients behind the proxy share one IP address for rate limiting, access controls and logging. Echo v4.16.3 changes client IP defaults. Without `Echo#IPExtractor`, `Context.RealIP()` uses the connection peer and ignores `X-Forwarded-For` and `X-Real-IP`. Proxy middleware always replaces upstream `X-Real-IP` with this result. This fixes [CVE-2026-118651](https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36) and [CVE-2026-118653](https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq). Applications that already set `Echo#IPExtractor` keep their behavior. A custom rate-limit identifier that does not call `RealIP()` is also unaffected.