echo-otel/v5: rename module, error.type per semconv, Echo.Pre route, v5.0.0

[vishr]

Summary

This PR becomes main for Echo v5 under the new name and versioning, aligned with echo-jwt. The MAJOR version tracks the Echo version:

Echo	Module	Branch	First tag	Minimal Echo
v5	github.com/labstack/echo-otel/v5	main (this PR)	v5.0.0	v5.2.1
v4	github.com/labstack/echo-otel/v4	v4 (pushed, CI green)	v4.0.0	v4.15.4
(old name)	github.com/labstack/echo-opentelemetry	v0 (frozen)	v0.0.4, deprecated	—

The repository will be renamed labstack/echo-opentelemetry → labstack/echo-otel. GitHub redirects the old name, and v0.0.1–v0.0.3 stay available in the Go module proxy, so existing builds keep working. v0.0.4 is v0.0.3 plus a // Deprecated: go.mod comment pointing to the new paths.

Closes #10.

Changes on main (Echo v5)

• Module github.com/labstack/echo-otel/v5. ScopeName is the module path and Version is 5.0.0.
• Minimal Echo v5.2.1, unchanged from v0.0.3, so adopting this never forces an Echo upgrade. CI also tests against the latest Echo v5.
• error.type per semconv (http span and error.type #10) on spans and metrics, following the same rules as SpanStatus:
  • 5xx with no error, or with an error that carries a status code: the status code.
  • Any other error: the error type.
  • 4xx: not set.
  • Invalid status: _OTHER, or the code itself for 600–999.
• http.route and the span name are set when the middleware is added with Echo.Pre.
• http.route comes only from the Echo route, never from an outer http.ServeMux pattern.
• Metrics carry only low-cardinality attributes. server.address, server.port and http.request.method_original stay on spans only, since they are Opt-In for metrics and their values come from the client. With ServerName set, server.port no longer comes from the Host header.
• Unknown request body size (-1) is not recorded.
• A panicking handler is recorded (error.type panic, also after a 4xx response was sent) and then re-panicked with the original value, so a Recover middleware added first still handles it. A panic in OnNextError, runtime.Goexit and http.ErrAbortHandler are handled too, and a Recover middleware added after this one (*middleware.PanicStackError) is also reported as panic.
• A panic value that carries a status (for example panic(echo.ErrUnauthorized)) records the status the error handler sends, not 500.
• http.response.status_code is not set when no response status was sent, for example after an http.ErrAbortHandler panic.
• network.protocol.version is 2 and 3 for HTTP/2 and HTTP/3, instead of 2.0 and 3.0.
• Body sizes on spans: http.request.body.size and http.response.body.size are Opt-In for spans and are no longer set there. The body size metrics stay.
• ServerName without a host (for example :8080) is rejected.
• The example builds (its module path was wrong before). CI builds and vets it.
• README:
  • Versioning, echo-jwt style.
  • Migration from echo-opentelemetry and from otelecho, with an option-to-field table.
  • error.type and panic rules.
  • Span attributes, including how to add url.query (with redaction) and the body sizes.
  • Known limitations.
  • A Renovate snippet for major updates.
• OpenTelemetry v1.46.0.
• A middleware benchmark. Tests also pass on Windows.

Echo v4 (separate v4 branch, not in this PR)

The same middleware for Echo v4, for otelecho users who stay on Echo v4:

• echo.Context instead of *echo.Context.
• ResolveResponseStatus mirrors DefaultHTTPErrorHandler.
• http.route comes from c.Path().
• A 5xx HTTPError reports its status code as error.type.
• OnNextError: c.Error(err) supports custom error handlers.
• A Recover middleware added after this one sends 500 through the error handler, so it is reported as a 5xx response (error.type 500).

The framework-independent extractor is identical on both branches, and fixes are cherry-picked from main to v4.

Testing

Coverage is 96.5% for v5 and 96.6% for v4. On both modules:

• make check (lint, vet, gosec, race), shuffled test runs, and GOOS=windows go vet
• Go 1.25.14
• The minimal Echo version and the latest Echo version (v5.4.0, v4.16.0)
• govulncheck and actionlint

A local end-to-end simulation of the renamed repository and tags checked that:

• Old-path consumers keep building.
• go get -u moves them to v0.0.4 and prints the deprecation notice.
• The old path's @latest is v0.0.4 and never jumps to v4 or v5.
• /v5 and /v4 both resolve.

Release order

1. Rename the repository.
2. Merge this PR.
3. Tag v5.0.0.
4. Create the v4 branch and tag v4.0.0.
5. Create the v0 branch and tag v0.0.4.
6. Warm proxy.golang.org.

Open PRs #19 and #20 will need a rebase onto the new module path.

[aldas]

@vishr , why are you letting LLM do this? Moving repo is a big change of downstream users.

[vishr]

@vishr , why are you letting LLM do this? Moving repo is a big change of downstream users.

@aldas Existing users aren't affected. v0.0.1–v0.0.3 stay in the module proxy, GitHub redirects the old URL, and builds on the old path keep working. v0.0.4 only adds a deprecation notice pointing to the new paths. Updates move to echo-otel/v5 and /v4, the same versioning as echo-jwt, plus a v4 line for otelecho users. If you see a specific problem, let me know before the release.