vishr · Oct 29, 2026 · Oct 29, 2026
diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md
@@ -9,24 +9,42 @@
 
 ## Paid support
 
-Companies running Echo in production can get support through the Support tier on [GitHub Sponsors](https://github.com/sponsors/labstack), provided by LabStack LLC.
+**Echo Support** is a yearly contract with the maintainer, for companies running
+Echo v4 or v5 in production, with or without Echo Pro. It costs $4,900 a year,
+invoiced annually by LabStack LLC. It includes:
 
-### What you get
+- A named contact.
+- Four incidents a year: a question or problem with Echo, its official
+  middleware or Echo Pro in your setup. A v4 to v5 migration review counts as one.
+- A two-business-day response target.
+- A yearly maintenance-status letter: the Echo versions you use, the advisories
+  that apply, and their support dates.
 
-- Everything in the Business tier.
-- We aim to reply to your issues and questions within 2 business days.
-- A named contact for security questions, and a heads-up on scheduled security release dates.
-- A written summary of Echo's published support periods for the versions you use.
-- Help answering SBOM and vulnerability questions for your compliance reviews.
+Security fixes are made publicly available to everyone at the same time. Echo
+Support does not buy earlier or private fixes. Details: [echo.labstack.com/pro#support](https://echo.labstack.com/pro#support).
+Email [support@labstack.com](mailto:support@labstack.com?subject=Echo%20Support) to start.
 
 ### Terms
 
-1. **Best effort.** Support is provided on a best-effort basis. Response times are goals, not guarantees.
-2. **Security notice.** Advance notice covers only the planned release date and the affected version lines. Vulnerability details and fixes are published publicly, for everyone, at release time, following coordinated disclosure. See [SECURITY.md](../SECURITY.md).
-3. **Support statements.** Support-period summaries restate Echo's public policy in [ROADMAP.md](../ROADMAP.md) and [SECURITY.md](../SECURITY.md), which may change. They are not a warranty.
-4. **No warranty.** Echo is provided under the [MIT License](../LICENSE), "as is". Sponsorship does not change that.
-5. **Liability.** LabStack LLC's total liability is limited to the sponsorship fees paid in the previous 3 months.
-6. **Billing.** Billed through GitHub Sponsors under GitHub's terms, or invoiced by LabStack LLC. You can cancel anytime; past months are not refunded.
-7. **Changes.** These terms may be updated. The current version is always in this file.
-
-Questions about paid support: [v@labstack.com](mailto:v@labstack.com)
+1. **Best effort.** Response times are targets, not guarantees, counted in US
+   business days (Monday to Friday, US Pacific time, excluding US federal
+   holidays). There is no service level agreement, no fixed repair time and no
+   24/7 cover.
+2. **Security fixes.** Vulnerability details and fixes are published publicly,
+   for everyone, at release time, following [SECURITY.md](../SECURITY.md).
+3. **Status letters.** Letters restate Echo's public support policy in
+   [SECURITY.md](../SECURITY.md), which may change. They are not a warranty or a
+   compliance certificate.
+4. **No warranty.** Echo is provided under the [MIT License](../LICENSE), "as is".
+   A support contract does not change that.
+5. **Liability.** LabStack LLC's total liability is limited to the support fees
+   paid in the previous 12 months.
+6. **Billing.** Invoiced annually by LabStack LLC.
+7. **Refunds.** Full refund if you cancel within 30 days of the invoice date and
+   have not used an incident. Otherwise, the contract runs for the full year and
+   is not refunded.
+8. **Changes.** These terms may be updated. The current version is always in
+   this file. Existing contracts keep the terms they were signed under.
+
+[GitHub Sponsors](https://github.com/sponsors/labstack) tiers fund Echo and add
+your logo; they are not a support contract.
diff --git a/README.md b/README.md
@@ -70,7 +70,7 @@ Building multi-tenant APIs? [Echo Pro](https://echo.labstack.com/pro) is a separ
 ### Supported versions
 
 - `v5` is the current major version, released on 2026-01-18. See [API_CHANGES_V5.md](./API_CHANGES_V5.md) for the API changes from `v4` and upgrade notes.
-- `v4` receives security updates and bug fixes until 2026-12-31.
+- `v4` receives bug fixes until 2026-12-31 and security fixes until 2027-12-31, on its latest release. See [SECURITY.md](./SECURITY.md).
 
 See [ROADMAP.md](./ROADMAP.md) for where Echo is heading and the version support policy.
 
@@ -80,7 +80,7 @@ See [ROADMAP.md](./ROADMAP.md) for where Echo is heading and the version support
 go get github.com/labstack/echo/v5
 ```
 
-Echo supports the three most recent Go [releases](https://go.dev/doc/devel/release) and may work with older ones.
+Echo v5 supports the three most recent Go [releases](https://go.dev/doc/devel/release) and may work with older ones. Echo v4 requires Go 1.26 or later.
 
 ### Example
 

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -1,6 +1,6 @@
 # Echo Roadmap
 
-> **DRAFT** — this is a starting point for maintainers to edit, not a commitment.
+> **DRAFT** — roadmap priorities are provisional; the published version and security support dates are commitments.
 > Dates and priorities are owned by the Echo team. Open a discussion to propose changes.
 
 This document exists so the community can see where Echo is heading. Echo is
@@ -12,11 +12,11 @@ lines — see [README](./README.md) badges for the latest version and most recen
 | Line | Status | Support |
 |------|--------|---------|
 | `v5` | **Current** (since 2026-01-18) | New features, fixes, and improvements. |
-| `v4` | Maintenance / LTS | **Security and bug fixes until 2026-12-31.** No new features. |
+| `v4` | Maintenance | **Bug fixes until 2026-12-31; security fixes until 2027-12-31** on the latest v4 release. No new features. See [SECURITY.md](./SECURITY.md). |
 
 Upgrading from v4? See [API_CHANGES_V5.md](./API_CHANGES_V5.md).
 
-Echo supports the **latest four Go major releases** and may work with older versions.
+Echo v5 supports the **three most recent Go releases** and may work with older versions. Echo v4 requires Go 1.26 or later. The version and security support dates in [SECURITY.md](./SECURITY.md) are a commitment; the rest of this roadmap is a draft.
 
 ## Now (in progress)
 
@@ -47,4 +47,4 @@ commitment — each still needs design agreement before implementation:
 - **Discuss before large PRs** — open a [Discussion](https://github.com/labstack/echo/discussions)
   or issue so we can agree on the design first.
 - 👍 reactions on issues help us gauge demand.
-- See [README → Contribute](./README.md#contribute) for contribution guidelines.
+- See [README → Contributing](./README.md#contributing) for contribution guidelines.
diff --git a/SECURITY.md b/SECURITY.md
@@ -2,11 +2,31 @@
 
 ## Supported Versions
 
-| Version   | Supported                           |
-|-----------|-------------------------------------|
-| 5.x.x     | :white_check_mark:                  |
-| >= 4.15.x | :white_check_mark: until 2026.12.31 |
-| < 4.15    | :x:                                 |
+| Version              | Bug fixes        | Security fixes                   |
+|----------------------|------------------|----------------------------------|
+| 5.x                  | Yes              | Yes                              |
+| 4.x, latest release  | Until 2026-12-31 | Until 2027-12-31                 |
+| 4.x, older releases  | No               | No: upgrade to the latest 4.x    |
+
+Routine v4 bug fixes end on 2026-12-31. Free, public, security-only fixes for v4
+continue until 2027-12-31. The plan for v4 after 2027-12-31 will be published by
+2027-06-30; nothing beyond 2027 is promised today.
+
+Security fixes cover confirmed vulnerabilities in Echo, including dependency and
+compatibility changes needed to fix them. They ship as tagged releases with a
+GitHub security advisory, to everyone at the same time. For v4 they ship as new
+patch releases of the latest v4 version; older 4.x releases
+do not get backports. Echo v4 requires Go 1.26 or later; build with a Go release
+that the Go team still supports.
+
+Some fixes need configuration as well as an upgrade. The
+[proxy](https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36)
+and [rate limiter](https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq)
+advisories require setting `Echo#IPExtractor` in v4: `echo.ExtractIPDirect()` when
+there is no proxy, or a header extractor that trusts only your own proxies.
+
+Paid [Echo Support](https://echo.labstack.com/pro#support) buys maintainer time.
+It does not buy earlier or private fixes.
 
 ## Reporting a Vulnerability
 

diff --git a/funding.json b/funding.json
@@ -15,7 +15,7 @@
     {
       "guid": "echo",
       "name": "Echo",
-      "description": "High performance, minimalist Go web framework. About 82,000 GitHub repositories and 47,000 Go packages depend on it, and companies including Microsoft (Azure), NVIDIA and Docker use it in production. Maintained since 2015, with v5 as the current version and v4 as a long-term support line.",
+      "description": "High performance, minimalist Go web framework. About 82,000 GitHub repositories and 47,000 Go packages depend on it, and companies including Microsoft (Azure), NVIDIA and Docker use it in production. Maintained since 2015, with v5 as the current version and v4 in maintenance.",
       "webpageUrl": {
         "url": "https://github.com/labstack/echo"
       },
@@ -45,7 +45,7 @@
         "guid": "maintenance",
         "status": "active",
         "name": "Maintenance",
-        "description": "Issue and pull request triage, releases for v5 and the v4 long-term support line, dependency updates and CI upkeep.",
+        "description": "Issue and pull request triage, releases for v5 and the v4 maintenance line, dependency updates and CI upkeep.",
         "amount": 10000,
         "currency": "USD",
         "frequency": "yearly",
@@ -65,7 +65,7 @@
         "guid": "maintainer",
         "status": "active",
         "name": "Dedicated maintainer",
-        "description": "Funds a maintainer to keep security response times short, review contributions and maintain the v4 long-term support line.",
+        "description": "Funds a maintainer to keep security response times short, review contributions and maintain the v4 line.",
         "amount": 100000,
         "currency": "USD",
         "frequency": "yearly",