LoginSign Up
← Back to all sparks
E

Echo

DEVOPS
Velocity0.0

High performance minimalist Go web framework

echo.labstack.com ↗

Echo is running two lines in lockstep, and security is what triggers releases

dual-line-supportsecurity-backportspath-traversalheader-validationmiddleware
◆Current state
Echo maintains v4 and v5 in parallel and treats security parity as non-negotiable — both of the vulnerabilities in this window were fixed on v5 and backported to v4 within hours. The issues themselves are the same class twice over: values taken from request headers and paths being trusted too readily. Context.Scheme accepted malformed forwarded scheme values, and encoded path separators in static file URLs could bypass route-level middleware and disclose files.
◆Where it's heading
The pattern that matters is where each vulnerability lived: both sat in code that decides what a request is, before any application logic runs, which is where a web framework's security surface actually is. Feature work is confined to v5 — an optional rate-limiter store context for response headers, core hot-path optimisation — while v4 receives security fixes only, a clean maintenance split with no ambiguity about which line is current.
◆Prediction
Expect v5 to keep taking the middleware and performance work while v4 continues receiving same-day security backports, and further hardening around path and header parsing given that two reported issues in a row landed there.

◆Recent moves

  1. 1mo ago

    v4.15.3 - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

    The v4 backport of the encoded-separator fix, released two hours after its v5 counterpart. The same-day parity across both maintained lines is the consistent practice visible throughout this window.

    View source ↗
  2. 1mo ago

    v5.2.0 - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

    Fixes an encoded path separator that let static file URLs bypass route-level middleware such as authentication on a sibling route, affecting both the static handler and the static middleware. It also carries the window's only feature work: an optional rate-limiter store context and core hot-path optimisation.

    View source ↗
  3. 3mo ago

    v5.1.1 - Context.Scheme() should validate header values

    Context.Scheme now validates values taken from headers, closing a path where malformed forwarded scheme values could influence host redirects. Context-aware listener creation and a JSON response unwrapping fix ship alongside on the v5 line.

    View source ↗
  4. 3mo ago

    v4.15.2 - Context.Scheme() header validation

    The v4 backport of the Context.Scheme validation fix, published an hour after the v5 release. A single-commit release, which is the shape v4 now takes on every occasion.

    View source ↗