* fix(middleware): match gzip Content-Encoding case-insensitively

Proxies and clients may send Content-Encoding: Gzip or GZIP. Exact string
compare skipped decompression. Trim and EqualFold against "gzip".

* fix(middleware): keep gzip match to EqualFold only

Drop TrimSpace so the change is strictly RFC 9110 case-insensitivity
for content codings, per review discussion.

RealIP and LegacyIPExtractor discarded the address when net.SplitHostPort
failed (e.g. bare IPv4/IPv6 without :port). Reuse extractIP so behavior
matches ExtractIPDirect.

…ID (#3057)

Godoc mixed X-Request-ID and X-Request-Id. Use X-Request-Id consistently
to match echo.HeaderXRequestID.

* fix(middleware): normalize MethodOverride method to uppercase

Overridden methods such as "delete" did not match router http.Method*
constants. Trim and uppercase the override value before assigning.

* docs(middleware): clarify MethodOverrideGetter return value

Per review: do not normalize override methods in middleware. Document that
Getter should return a standard method name (e.g. http.MethodDelete).

Adds ProblemError (RFC 9457 fields), a ProblemErrorer interface so
custom error types can convert themselves to a ProblemError, and a
standalone ProblemDetailsHTTPErrorHandler that renders errors as
application/problem+json, as discussed in #3053.

Co-authored-by: Claude Sonnet 5 <[email protected]>

A v4-style custom HTTPErrorHandler that type-asserts err.(*echo.HTTPError)
silently stops matching the router's predefined errors (echo.ErrNotFound,
echo.ErrMethodNotAllowed, ...) in v5, because they are now immutable
sentinels implementing only HTTPStatusCoder. The result is every unmatched
route being rendered as a 500 instead of a 404, with no compile-time or
runtime signal.

Document the trap in the HTTPError section and the migration guide's error
handler step, pointing at echo.StatusCode(err) as the correct replacement.

Only OPTIONS requests that include both Origin and
Access-Control-Request-Method are treated as CORS preflights.

Previously every OPTIONS request was short-circuited, so non-CORS
OPTIONS handlers (and OPTIONS without ACR-Method) never ran (#2534).

CLAUDE.md still described Echo v4 after master moved to v5:

- the intro pointed to module github.com/labstack/echo/v4, but go.mod declares github.com/labstack/echo/v5.
- the Context section called Context an interface, but in v5 it is a concrete struct (type Context struct in context.go).

Updated both to match the current code.

* fix(rfc9457): do not mutate a shared ProblemError

* test(rfc9457): check the sentinel after a single request

The supported-versions bullet read 'with **security*** updates and **bug**
fixes until 2026-12-31'. The third asterisk made '**security***' render as
'**security*** ' — three italic emphasis markers in a row — instead of the
intended bold 'security' (matching the surrounding '**bug**' word).

Removes the spurious trailing '*' so the bold marker closes cleanly and the
sentence now reads as 'with **security** updates and **bug** fixes until
2026-12-31', matching the intended styling.

* docs: add source-aligned examples and compatibility workflow

* docs: make static example serve a sample page

…ed stale config (#3118)

* docs: update maintainer credits and security reporting instructions

Move Roland Lammel and Pablo Andres Fuente to Maintainer Emeritus and
list Martti T. as Lead Maintainer. Point security reporters only to
GitHub private vulnerability reporting instead of maintainer emails.

* chore: remove unused Probot stale config

The Probot Stale app is not installed on the repository, so
.github/stale.yml has no effect.

Reverts the documentation files added by #3117. The examples and source reference now live in labstack/echox#447.

* fix: trust forwarded scheme headers only from trusted proxies

Context.Scheme() used X-Forwarded-Proto, X-Forwarded-Protocol,
X-Forwarded-Ssl and X-Url-Scheme from any client, so a direct client
could send X-Forwarded-Proto: https over plain HTTP and bypass
middleware.HTTPSRedirect() (GHSA-2ffq-g2xg-c22p).

The headers are now used only when the request comes directly from a
loopback, link-local or private network address or a unix socket.
Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy:
ExtractSchemeFromHeaders (default, accepts TrustOption),
ExtractSchemeDirect, or LegacySchemeExtractor for the old behavior.

The Secure middleware now uses Context.Scheme() for HSTS, and the Proxy
middleware always sets X-Forwarded-Proto from Context.Scheme() instead
of forwarding a client-supplied value.

* fix(proxy): always set X-Real-IP from Context.RealIP()

The Proxy middleware forwarded a client-supplied X-Real-IP header to the
upstream when Echo#IPExtractor was not set, so any client could spoof
the IP address seen by upstream services (GHSA-99jh-6h7p-pp36).

Since v5.1.0, Context.RealIP() returns the address of the direct peer
unless Echo#IPExtractor is configured, so the header is now always set
from Context.RealIP().

* fix: validate JSONP callback and send nosniff header

Context.JSONP and Context.JSONPBlob wrote the callback into the response
unchanged, so a callback taken from a query parameter could inject
arbitrary JavaScript (GHSA-h9g5-28mm-hx3g).

The callback must now be empty, a JavaScript identifier or a
dot-separated path of identifiers (ASCII letters, digits, _ and $).
Otherwise nothing is written and a 400 Bad Request error wrapping
ErrInvalidJSONPCallback is returned. JSONP responses also get the
X-Content-Type-Options: nosniff header.

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq

* fix(method-override): do not override POST to safe methods

MethodOverride rewrote a POST to any method, including GET and HEAD.
When the middleware ran before CSRF, a cross-site form POST with
_method=GET skipped the CSRF check (GHSA-r7w9-592q-9vg4).

POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or
CONNECT. The documentation now also says to register the middleware
with Echo#Pre.

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq

* fix: percent-encode control characters in redirect paths

The trailing slash middlewares and the static directory redirect only
collapsed a leading double slash. Browsers remove tab and newline
characters from URLs, so a path such as /%09/evil.example/ produced
Location: /\t/evil.example/, which a browser follows to evil.example
(GHSA-v753-g4cw-jm48).

sanitizeURI now percent-encodes C0 control characters and DEL before
the double slash check, so the browser requests the same path.

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq

* fix(static): resolve files from the routed path and reject dot segments

The Static middleware resolved files from the decoded URL.Path while the
router matched the escaped URL.RawPath, so /admin%2Fsecret.txt or
/%61dmin/secret.txt reached a file under a guarded /admin/* route
(GHSA-375p-5qhx-8wq4). It now uses the same form of the path as the
router and unescapes it only when EnablePathUnescaping is set.

Both the Static middleware and StaticDirectoryHandler (Echo.Static,
Echo.StaticFS) resolved file names with path.Clean(), while the router
matched the path as sent. A path with a ".", ".." or empty segment,
such as /assets/../admin/secret.txt, could therefore reach a file under
a route the router never matched (GHSA-3pmx-cf9f-34xr). Such paths are
no longer served. The documented opt-in behavior of encoded dots with
path unescaping enabled is unchanged.

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq

* docs: changelog for security release and Static middleware guard note

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq

* fix: harden security fixes after review

- Scheme: when X-Forwarded-Proto is present, use only it (its last
  value, added by the nearest proxy) instead of falling back to other
  headers, and return the scheme in lowercase so HTTPSRedirect and HSTS
  work with "HTTPS".
- Proxy: remove X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme
  before forwarding; X-Forwarded-Proto carries the scheme.
- Static: check for dot segments again after path unescaping, keep the
  HTML5 index fallback for unclean paths, check the path only once, and
  document how EnablePathUnescaping affects non-default escaping.
- Tests: guardable route-level static test, group static test, and a
  control-character redirect test that does not rely on traversal.
- Docs: IPExtractor default, SchemeExtractor trust notes, changelog
  behavior changes; bump Version to 5.4.0.

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq

* docs: set v5.4.0 release date

Claude-Session: https://claude.ai/code/session_01QKDYQr53zNKkR7nif2CAAq