feat: support echo v5

[jinuthankachan]

closes #37

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​labstack/​echo/​v5@​v5.1.0
	github.com/​getkin/​kin-openapi@​v0.135.0
	github.com/​stretchr/​testify@​v1.11.1

View full report

[mromaszewicz]

@jamietanna - what do you think, should we put echo V5 as a sub-module of echo-middleware or make a repo specifically for it?

The middleware itself, for V4 and V5 is basically identical.

I would love to see both just call through to shared code, but Go's module system makes it annoying since each sub-module requires its own git tag for each release to keep various tools happy, like Renovate.

[mromaszewicz]

Echo works fine with Go 1.25.0 (https://github.com/labstack/echo/blob/v5/go.mod), so I think we should try not to get ahead of it too much to allow as many users as possible to use this package. Lots of people can't update to the latest Go version immediately due to all kinds of internal company bureaucracy.

[jinuthankachan]

jinuthankachan#1 should resolve this

[jamietanna]

I think child Go module is ok but not like this right now - if we do, it'll cause Go module versioning confusion, and can make it seem like it's v5 of this module - I'd say maybe echov5

I agree that a separate repo may not be ideal given the shared code

Also, if we are doing a submodule, this will require we change our release process (which is fine, but calling it out)

[jinuthankachan]

@mromaszewicz @jamietanna

• bc62855
• 193e762

I have tried to apply some of your suggestion in the above commits.
After applying the above changes,

• Shared validation logic eliminates some duplication.
• Existing users unaffected.
• New echov5 users have clear import path (github.com/oapi-codegen/echo-middleware/echov5).
• Maintaining releases would be tricky though due to the base module dependency. I've got no clear solution for this.
• Test Results

=== ROOT MODULE (Echo v4) ===
=== RUN   TestOapiRequestValidator
2026/04/15 13:31:57 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidator (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiError
2026/04/15 13:31:57 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiError (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler
2026/04/15 13:31:57 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler (0.01s)
=== RUN   TestOapiRequestValidatorWithPrefix
--- PASS: TestOapiRequestValidatorWithPrefix (0.00s)
=== RUN   TestEncodedPathParams
--- PASS: TestEncodedPathParams (0.01s)
=== RUN   TestGetSkipperFromOptions
--- PASS: TestGetSkipperFromOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions
--- PASS: ExampleOapiRequestValidatorWithOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions_withErrorHandler
--- PASS: ExampleOapiRequestValidatorWithOptions_withErrorHandler (0.00s)
PASS
coverage: 75.3% of statements
ok  	github.com/oapi-codegen/echo-middleware	0.068s	coverage: 75.3% of statements
	github.com/oapi-codegen/echo-middleware/internal/validation		coverage: 0.0% of statements

=== ECHOV5 SUBMODULE (Echo v5) ===
=== RUN   TestOapiRequestValidator
2026/04/15 13:32:00 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidator (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiError
2026/04/15 13:32:00 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiError (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler
2026/04/15 13:32:01 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler (0.00s)
=== RUN   TestOapiRequestValidatorWithPrefix
--- PASS: TestOapiRequestValidatorWithPrefix (0.00s)
=== RUN   TestEncodedPathParams
--- PASS: TestEncodedPathParams (0.01s)
=== RUN   TestGetSkipperFromOptions
--- PASS: TestGetSkipperFromOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions
--- PASS: ExampleOapiRequestValidatorWithOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions_withErrorHandler
--- PASS: ExampleOapiRequestValidatorWithOptions_withErrorHandler (0.00s)
PASS
coverage: 75.3% of statements
ok  	github.com/oapi-codegen/echo-middleware/echov5	0.054s	coverage: 75.3% of statements

• The project structure

echo-middleware/
├── go.mod                           # Main module (Echo v4)
├── go.sum
├── oapi_validate.go                 # Echo v4 implementation
├── oapi_validate_test.go            # Echo v4 tests
├── oapi_validate_example_test.go    # Echo v4 examples
├── internal/
│   └── validation/
│       └── validate.go              # Shared validation logic
├── echov5/
│   ├── go.mod                       # Submodule (Echo v5)
│   ├── go.sum
│   ├── oapi_validate.go             # Echo v5 wrapper
│   ├── oapi_validate_test.go        # Echo v5 tests
│   ├── oapi_validate_example_test.go# Echo v5 examples
│   └── test_spec.yaml
└── test_spec.yaml