[myhubstat]

Changes

• github.com/labstack/echo/v4 range: replace last_affected: 4.16.2 with fixed: 4.16.3.
• Add reference to the v4 fix commit: labstack/echo@ebbb855
• Add reference to the v4.16.3 release notes: https://github.com/labstack/echo/releases/tag/v4.16.3

Evidence

• Upstream release notes for v4.16.3 (published 2026-10-30) explicitly state: "This release fixes the remaining v4 exposure for ... CVE-2026-118653" (rate limiter bypass via spoofed X-Forwarded-For).
• Fix commit ebbb855f5827 "fix: secure v4 client IP defaults for proxying and rate limiting ([GHSA-vh95-rmgr-6w4m] Prototype Pollution in minimist #3197)" is one of the 3 commits in labstack/echo@v4.16.2...v4.16.3 (gh api repos/labstack/echo/compare/ebbb855f5827...v4.16.3 -> status ahead, i.e. the tag contains the commit).
• v4.16.3 is published on the Go module proxy: https://proxy.golang.org/github.com/labstack/echo/v4/@v/list and https://pkg.go.dev/github.com/labstack/echo/v4@v4.16.3
• The v5 range is unchanged.