Remove legacy IP extraction logic from context.RealIP method

[aldas]

This change does not break the API contract, but it does introduce breaking changes in logic/behavior. But as promised - 31.03.2026 will be last day for potentially breaking stuff. I want to get this security related thing done.

---

Remove legacy IP extraction logic from context.RealIP method and move it to LegacyIPExtractor IP extraction function.

v4 behavior can be restored with:

e := echo.New()
e.IPExtractor = echo.LegacyIPExtractor()

but you should instead with proper trust options

• https://pkg.go.dev/github.com/labstack/echo/v5#ExtractIPFromRealIPHeader
• https://pkg.go.dev/github.com/labstack/echo/v5#ExtractIPFromXFFHeader

For example:

_, lbIPRange, _ := net.ParseCIDR("203.0.113.199/24")
e.IPExtractor = echo.ExtractIPFromXFFHeader(
   echo.TrustLinkLocal(false),
   echo.TrustIPRange(lbIPRange),
)

Read https://echo.labstack.com/docs/ip-address

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.07%. Comparing base (19364e2) to head (22e4b71).
⚠️ Report is 13 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2933      +/-   ##
==========================================
+ Coverage   93.01%   93.07%   +0.05%     
==========================================
  Files          43       43              
  Lines        4496     4506      +10     
==========================================
+ Hits         4182     4194      +12     
+ Misses        196      195       -1     
+ Partials      118      117       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.