Echo v4 support dates

[vishr]

Echo v4 now has fixed support dates. This post will not be updated; if it and SECURITY.md disagree, SECURITY.md is correct.

Version	Bug fixes	Security fixes
5.x	Yes	Yes
4.x, latest release	Until 2026-12-31	Until 2027-12-31
4.x, older releases	No	No: upgrade to the latest 4.x

"Latest release" means the newest v4 tag, currently v4.16.3. Each new v4 patch release becomes the supported one, so stay on the newest v4 tag to keep getting fixes.

From 2027-01-01, v4 bugs that are not security issues will not be fixed. Security fixes continue until 2027-12-31. They cover confirmed vulnerabilities in Echo, including the dependency and compatibility changes needed to fix them. They are free and public, ship as patch releases of the latest v4 version with a GitHub security advisory, and are not backported to older 4.x releases.

By 2027-06-30 we will publish what happens to v4 after 2027-12-31. Nothing beyond 2027 is promised today. Existing v4 releases stay available and keep working; only the fixes stop.

Echo v4 requires Go 1.26 or later. Build with a Go release that the Go team still supports; a security fix may raise the minimum Go version or update dependencies when the fix needs it. Echo v5 supports the three most recent Go releases. New projects should start on v5; the v5 release discussion covers what changed.

If your company runs v4 or v5 in production and wants a named contact, Echo Support costs $4,900 a year. It covers four incidents a year with a two-business-day response target (best effort, no SLA) and a yearly maintenance-status letter for the Echo versions you use. Security fixes ship to everyone at the same time. Support customers do not get them earlier or privately.

Please report vulnerabilities privately at https://github.com/labstack/echo/security/advisories/new, not in this discussion.