chore: prepare v4.16.1 security release (#3186)

* chore: prepare v4.16.1 security release

* docs: explain v4 security release requirements and defaults

Author: vishr

.github/workflows/echo.yml

@@ -50,6 +50,7 @@ jobs:
           fail_ci_if_error: false
 
   benchmark:
+    if: github.event_name == 'pull_request'
     needs: test
     name: Benchmark comparison
     runs-on: ubuntu-latest
@@ -76,12 +77,12 @@ jobs:
       - name: Run Benchmark (Previous)
         run: |
           cd previous
-          go test -run="-" -bench=".*" -count=8 ./... > benchmark.txt
+          go test -run="-" -bench=".*" -benchtime=100ms -count=8 ./... > benchmark.txt
 
       - name: Run Benchmark (New)
         run: |
           cd new
-          go test -run="-" -bench=".*" -count=8 ./... > benchmark.txt
+          go test -run="-" -bench=".*" -benchtime=100ms -count=8 ./... > benchmark.txt
 
       - name: Run Benchstat
         run: |

README.md

@@ -61,7 +61,15 @@ Click [here](https://github.com/sponsors/labstack) for more information on spons
 // go get github.com/labstack/echo/{version}
 go get github.com/labstack/echo/v4
 ```
-Latest version of Echo supports last four Go major [releases](https://go.dev/doc/devel/release) and might work with older versions.
+Echo v4.16.1 requires Go 1.26 or later so it can use patched `golang.org/x/` dependencies. Use a supported, patched Go toolchain when building applications.
+
+### Security defaults in v4.16.1
+
+`BodyDump` captures at most 5 MiB of the request and 5 MiB of the response by default. The application and client still receive the complete bodies. Configure `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes` to change the capture limits; `-1` disables a limit.
+
+`Decompress` limits decompressed request bodies to 100 MiB by default. Reading beyond the limit returns HTTP 413, including through JSON and XML binding. Configure `DecompressConfig.MaxDecompressedSize` to change the limit; `-1` disables it. Apply any smaller application body limit after decompression.
+
+The proxy now validates WebSocket upgrade responses, closes both WebSocket connections when either side disconnects, and removes incoming `Forwarded` headers. Backends should use the proxy's validated forwarding headers and enforce their own authorization.
 
 ### Example
 

echo.go

@@ -285,7 +285,7 @@ const (
 
 const (
 	// Version of Echo
-	Version = "4.16.0"
+	Version = "4.16.1"
 	website = "https://echo.labstack.com"
 	// http://patorjk.com/software/taag/#p=display&f=Small%20Slant&t=Echo
 	banner = `