samuel/dash

Watch

Fork 0

fix(deps): update module github.com/gofiber/fiber/v3 to v3.6.1 #31

Open

samuel wants to merge 1 commit from renovate/go-dependencies into main

samuel commented

2026-10-26 04:04:49 +00:00

Owner

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gofiber/fiber/v3	`v3.5.0` → `v3.6.1`

Release Notes

gofiber/fiber (github.com/gofiber/fiber/v3)

`v3.6.1`

Compare Source

🧹 Updates

Consolidate media-type parameter parsing into internal/mediatype (#4750)
Fix modernize and revive lint issues (#4759)

🐛 Fixes

Fix client, session, basicauth and other bugs found in the audit (#4752)

🛠️ Maintenance

bump github.com/gofiber/utils/v2 from 2.6.1 to 2.6.2 (#4760)
bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#4757)
bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 (#4758)
bump the golang-modules group with 3 updates (#4755)
bump release-drafter/release-drafter from 7.9.0 to 7.10.0 (#4756)
bump actions/setup-node from 7.0.0 to 7.1.0 (#4754)

📚 Documentation

Sync the documentation with the v3.6.0 code (#4751)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.0...v3.6.1

Thank you @alexandear, @gaby, @ninadsutrave and @ReneWerner87 for making this release possible.

`v3.6.0`

Compare Source

⚡ Performance

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

Time per request vs. v2	v3.5.0 (fasthttp v1.73.0)	v3.6.0 (fasthttp v1.75.0)
fasthttp only	+18%	-5%
Static route	+16%	-14%
Route parameter	+15%	-13%
Middleware chain	+13%	-12%
Header lookup	+29%	+3%
Locals	+33%	+5%
JSON response	+6%	-3%
JSON bind	+14%	-2%
Median of all 22 scenarios	+10%	-5%

Negative is faster than v2. v3.6.0 was measured on main three days before the release.
All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again.
https://gofiber.github.io/benchmarks/

🚀 New

Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596)
New tokenless middleware that rejects unsafe cross-origin browser requests by their Sec-Fetch-Site and Origin headers; no cookie, token or storage needed.
```
app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
    TrustedOrigins: []string{"https://admin.example.com"},
}))
```
https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
Update fasthttp to v1.75.0 (#4667, #4740)
fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing.
https://github.com/valyala/fasthttp/releases/tag/v1.75.0
Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715)
ReadBufferSize and WriteBufferSize now default to 8192 bytes (was 4096), which also raises the default request header limit; explicitly configured values are kept.
```
app := fiber.New(fiber.Config{
    ReadBufferSize:  4096, // previous default, now 8192
    WriteBufferSize: 4096, // previous default, now 8192
})
```
https://docs.gofiber.io/api/fiber#readbuffersize
Expand context, response and request helpers (#4638)
New helpers on Req, Res and Ctx such as Bearer, Origin, IsSafe, Del, StatusCode, GetCookies, Elapsed and RouteName; request helpers are now also reachable through c.Req().
```
token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
c.Del("X-Powered-By") // remove a response header
took := c.Elapsed()   // time spent on this request so far
```
https://docs.gofiber.io/api/ctx

Add Endpoint() for middleware look-ahead (#4601)
New c.Endpoint() returns the route that will handle the request without advancing the handler chain (nil on 404/405).

app.Use(func(c fiber.Ctx) error {
    if route := c.Endpoint(); route != nil {
        // enforce access control using route.Path or route.Name
    }
    return c.Next()
})

https://docs.gofiber.io/api/ctx#endpoint

Add ordered RuleList to the redirect and rewrite middleware (#4621, #4633)
New RuleList []Rule in redirect and rewrite is tried in the order written, first match wins; the Rules map is deprecated and setting both panics.
```
app.Use(redirect.New(redirect.Config{
    RuleList: []redirect.Rule{
        {From: "/old", To: "/new"},      // checked first
        {From: "/old/*", To: "/new/$1"}, // takes everything else
    },
}))
```
https://docs.gofiber.io/middleware/redirect#rule-order
Render configured templates to a writer (#4594)
New app.Render writes a template through the configured view engine to any io.Writer without creating an HTTP response, e.g. for SSE or HTMX partials.
```
var buf bytes.Buffer
if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil {
    return err
}
```
https://docs.gofiber.io/api/app#render
Add final request hooks to the HTTP client (#4595)
New AddFinalRequestHook runs after the built-in hooks, immediately before the request is sent, when RawRequest holds the resolved URL, merged headers and serialized body.
```
cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error {
    raw := req.RawRequest
    raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body()))
    return nil
})
```
https://docs.gofiber.io/client/hooks#final-request-hooks
Add SetLocal, a request-local store without the variadic's heap slice (#4687)
New c.SetLocal(key, value) stores a request-local value exactly like c.Locals(key, value), without the one-element slice that call allocates.
https://docs.gofiber.io/api/ctx#setlocal
Add DisableFlashMessages and filter route candidates with a probe constant (#4655)
New fiber.Config option DisableFlashMessages turns off redirect flash messages and the per-request fiber_flash cookie scan (off by default); the router gains a precomputed probe-constant filter.
```
app := fiber.New(fiber.Config{
    DisableFlashMessages: true, // default: false
})
```
https://docs.gofiber.io/api/fiber#disableflashmessages
Add source-aware extraction to extractors without a new struct field (#4603)
New extractors.Resolve returns the value together with the Source and Key of the chain child that produced it; the Extractor struct is unchanged.
```
ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key"))
res, err := extractors.Resolve(ex, c)
// res.Value, plus res.Source and res.Key of the child that won
```
https://docs.gofiber.io/guide/extractors#source-aware-extraction

🧹 Updates

Require Go 1.26 (#4654)
Filter large route buckets before loading routes and bind without building a map (#4705)
Filter a route bucket by static path before loading the route (#4688)
Consolidate route pattern preprocessing (#4710)
Share route and client :name path delimiters (#4636)
Normalize header keys in one pass and match canonical media types directly (#4690)
Share streaming header join logic (#4734)
Consolidate comma-list header scanning into internal/headerlist (#4637)
Consolidate entity-tag parsing into internal/etag (#4632)
Adopt utils/v2 helpers and cut per-request allocations in the hot path (#4666)
cors/csrf: Consolidate origin matching into internal/origin (#4653)
limiter: Lock keys per shard instead of globally (#4702)
redirect/rewrite: Share capture substitution (#4749)
session: Skip the gob re-encode when a session was only read (#4703)
Cut the per-request cost of the extractors (#4678)
Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps (#4729)
Close three test coverage gaps in logger, shutdown and docs (#4615)
Add a regression test and docs example for CustomCtx overrides behind middleware (#4598)
Add a regression test and docs note that Context() is not canceled on graceful shutdown (#4599)
Trigger Dependabot in gofiber/benchmarks after releases (#4682)

🐛 Fixes

Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware (#4695)
Keep stray percents from forging escapes, root every request target and take the SendFile name literally (#4719)
Let empty optional params yield to later required segments (#4722)
Fix panic on route pattern with trailing escape character (#4717)
Preserve names for merged multi-method routes (#4663)
Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount (#4620)
Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()[4:]) (#4674)
Escape parameter values in generated route URLs (#4629)
Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent (#4721)
Accept tab OWS in X-Forwarded-For and share one OWS trim helper (#4735)
Treat Vary field names as case-insensitive (#4642)
Unify cookie SameSite handling (#4630)
Prevent unbounded handler growth when SendFile serves a function-backed fs.FS (#4656)
Prevent typed-nil view engine panics (#4662)
Report the real status for fasthttp-level request errors (#4614)
Drain in-flight requests before Listen returns (#4701)
basicauth: Equalize verification time across mixed hash algorithms (#4726)
basicauth: Refuse a repeated Authorization field (#4738)
basicauth/keyauth: Use HTTP quoted strings in auth challenges (#4631)
cache: Delete stale entries after uncacheable revalidation (#4590)
cache: Key entries by request scheme and host (#4736)
cache: Replay Vary on cache hits and mark credential-keyed entries private (#4744)
compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper (#4708)
idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers (#4693)
limiter: Bound the rate-limit key before it reaches storage (#4677)
proxy: Apply the client's Connection listing to the request as received (#4745)
proxy: Fold DomainForward's configured hostname to Punycode (#4673)
proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers (#4725)
proxy: Preserve IPv6 brackets in domain forwarding (#4689)
redirect/rewrite: Read "$10" as the tenth capture in targets (#4692)
session: Honor chain-level extractors and close three write-back holes (#4679)
static: Align file resolution with routed paths (#4712)
static: Reject partial wildcard matches that cross a path segment boundary (#4728)
Decode a path parameter exactly once in FromParam (#4626)
Anchor and escape client path parameter substitution (#4625)
Keep a stale client Response from releasing a reused Request on Close (#4659)
Parse malformed Set-Cookie attributes in the client in linear time (#4658)
Make static, proxy, adaptor and rewrite act on the path the router matched (#4720)
Fix RFC 9110/9112 compliance gaps in core, static and timeout (#4747)
Fix correctness issues across core, router, binder, client and middleware (#4652)

🛠️ Maintenance

41 changes

bump the golang-modules group with 2 updates (#4748)
bump github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6 (#4746)
bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 (#4743)
bump github.com/valyala/fasthttp from 1.74.0 to 1.75.0 in the fasthttp-modules group (#4740)
bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 (#4741)
bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#4739)
bump github.com/tinylib/msgp from 1.6.4 to 1.6.5 (#4723)
bump github.com/klauspost/compress from 1.20.0 to 1.20.1 (#4709)
bump github.com/gofiber/schema from 1.8.7 to 1.8.8 (#4706)
bump github.com/gofiber/utils/v2 from 2.6.0 to 2.6.1 (#4707)
bump github.com/gofiber/utils/v2 from 2.5.3 to 2.6.0 (#4704)
bump github.com/gofiber/utils/v2 from 2.5.2 to 2.5.3 (#4700)
bump codecov/codecov-action from 7.1.0 to 7.1.1 (#4699)
bump github.com/molecule-man/go-brrr from 1.1.0 to 1.1.1 (#4698)
bump codecov/codecov-action from 7.0.0 to 7.1.0 (#4691)
bump github.com/gofiber/schema from 1.8.6 to 1.8.7 (#4686)
bump github.com/fxamacker/cbor/v2 from 2.9.3 to 2.9.4 (#4685)
bump github.com/gofiber/utils/v2 from 2.5.1 to 2.5.2 (#4681)
bump github.com/shamaton/msgpack/v3 from 3.2.2 to 3.2.3 (#4680)
bump github.com/molecule-man/go-brrr from 1.0.1 to 1.1.0 (#4676)
bump the golang-modules group with 3 updates (#4672)
bump golang.org/x/sys from 0.47.0 to 0.48.0 in the golang-modules group (#4670)
bump github.com/gofiber/schema from 1.8.5 to 1.8.6 (#4671)
bump github.com/gofiber/utils/v2 from 2.5.0 to 2.5.1 (#4668)
bump github.com/valyala/fasthttp from 1.73.0 to 1.74.0 in the fasthttp-modules group (#4667)
bump streetsidesoftware/cspell-action from 9.0.1 to 9.1.0 (#4665)
bump github.com/shamaton/msgpack/v3 from 3.2.1 to 3.2.2 (#4660)
bump github.com/gofiber/utils/v2 from 2.4.3 to 2.5.0 (#4661)
bump golang.org/x/crypto from 0.55.0 to 0.56.0 in the golang-modules group (#4651)
bump github.com/gofiber/utils/v2 from 2.4.2 to 2.4.3 (#4650)
bump github.com/klauspost/compress from 1.19.2 to 1.20.0 (#4649)
bump github.com/gofiber/schema from 1.8.4 to 1.8.5 (#4647)
bump github.com/shamaton/msgpack/v3 from 3.2.0 to 3.2.1 (#4645)
bump github.com/andybalholm/brotli from 1.2.2 to 1.2.3 (#4639)
bump github.com/gofiber/utils/v2 from 2.4.1 to 2.4.2 (#4634)
bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#4627)
bump streetsidesoftware/cspell-action from 8.4.0 to 9.0.1 (#4624)
bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3 (#4623)
bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#4622)
bump the golang-modules group with 3 updates (#4611)
bump github.com/gofiber/schema from 1.8.3 to 1.8.4 (#4609)

📚 Documentation

Clarify that c.IP() walks the proxy chain only with EnableIPValidation (#4737)
Explain what MIMETypes does to an existing format (#4664)
Document the nested and array field notations in Bind (#4616)
Add a minimal CRUD and healthcheck guide (#4696)
Fix British to American English spellings across docs (#4697)
Update README documentation links (#4711)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0

Thank you @00200200, @Arvin-Lee, @AshSgDe29071999, @BitWeaverDev, @Dev-next-gen, @Rachit-Gandhi, @ReneWerner87, @Rohilalala, @RubenPari, @VedantMadane, @ZihxS, @aditya-rohilla, @drakeo338, @evgenyponomarev, @fadiromdhan3, @fadiroot, @gaby, @h2zi, @haimingZZ, @ibraah007, @jabrailkhalil, @lazerg, @official-burak and @truongbo17 for making this release possible.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/gofiber/fiber/v3](https://github.com/gofiber/fiber) | `v3.5.0` → `v3.6.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgofiber%2ffiber%2fv3/v3.6.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgofiber%2ffiber%2fv3/v3.5.0/v3.6.1?slim=true) | --- ### Release Notes <details> <summary>gofiber/fiber (github.com/gofiber/fiber/v3)</summary> ### [`v3.6.1`](https://github.com/gofiber/fiber/releases/tag/v3.6.1) [Compare Source](https://github.com/gofiber/fiber/compare/v3.6.0...v3.6.1) #### 🧹 Updates - Consolidate media-type parameter parsing into internal/mediatype ([#4750](https://github.com/gofiber/fiber/issues/4750)) - Fix modernize and revive lint issues ([#4759](https://github.com/gofiber/fiber/issues/4759)) #### 🐛 Fixes - Fix client, session, basicauth and other bugs found in the audit ([#4752](https://github.com/gofiber/fiber/issues/4752)) #### 🛠️ Maintenance - bump github.com/gofiber/utils/v2 from 2.6.1 to 2.6.2 ([#4760](https://github.com/gofiber/fiber/issues/4760)) - bump github.com/klauspost/compress from 1.20.1 to 1.20.3 ([#4757](https://github.com/gofiber/fiber/issues/4757)) - bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 ([#4758](https://github.com/gofiber/fiber/issues/4758)) - bump the golang-modules group with 3 updates ([#4755](https://github.com/gofiber/fiber/issues/4755)) - bump release-drafter/release-drafter from 7.9.0 to 7.10.0 ([#4756](https://github.com/gofiber/fiber/issues/4756)) - bump actions/setup-node from 7.0.0 to 7.1.0 ([#4754](https://github.com/gofiber/fiber/issues/4754)) #### 📚 Documentation - Sync the documentation with the v3.6.0 code ([#4751](https://github.com/gofiber/fiber/issues/4751)) **📒 Documentation**: <https://docs.gofiber.io/> **💬 Discord**: <https://gofiber.io/discord> **Full Changelog**: <https://github.com/gofiber/fiber/compare/v3.6.0...v3.6.1> Thank you [@alexandear](https://github.com/alexandear), [@gaby](https://github.com/gaby), [@ninadsutrave](https://github.com/ninadsutrave) and [@ReneWerner87](https://github.com/ReneWerner87) for making this release possible. ### [`v3.6.0`](https://github.com/gofiber/fiber/releases/tag/v3.6.0) [Compare Source](https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0) #### ⚡ Performance Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then. | Time per request vs. v2 | v3.5.0 (fasthttp v1.73.0) | v3.6.0 (fasthttp v1.75.0) | | :----------------------------- | ------------------------: | ------------------------: | | fasthttp only | +18% | -5% | | Static route | +16% | -14% | | Route parameter | +15% | -13% | | Middleware chain | +13% | -12% | | Header lookup | +29% | +3% | | Locals | +33% | +5% | | JSON response | +6% | -3% | | JSON bind | +14% | -2% | | **Median of all 22 scenarios** | **+10%** | **-5%** | Negative is faster than v2. v3.6.0 was measured on `main` three days before the release. All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again. <https://gofiber.github.io/benchmarks/> #### 🚀 New - Add csrf.NewCrossOriginProtection for tokenless CSRF protection ([#4596](https://github.com/gofiber/fiber/issues/4596)) New tokenless middleware that rejects unsafe cross-origin browser requests by their `Sec-Fetch-Site` and `Origin` headers; no cookie, token or storage needed. ```go app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{ TrustedOrigins: []string{"https://admin.example.com"}, })) ``` <https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens> - Update fasthttp to v1.75.0 ([#4667](https://github.com/gofiber/fiber/issues/4667), [#4740](https://github.com/gofiber/fiber/issues/4740)) fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing. <https://github.com/valyala/fasthttp/releases/tag/v1.75.0> - Raise default ReadBufferSize and WriteBufferSize to 8 KB ([#4715](https://github.com/gofiber/fiber/issues/4715)) `ReadBufferSize` and `WriteBufferSize` now default to `8192` bytes (was `4096`), which also raises the default request header limit; explicitly configured values are kept. ```go app := fiber.New(fiber.Config{ ReadBufferSize: 4096, // previous default, now 8192 WriteBufferSize: 4096, // previous default, now 8192 }) ``` <https://docs.gofiber.io/api/fiber#readbuffersize> - Expand context, response and request helpers ([#4638](https://github.com/gofiber/fiber/issues/4638)) New helpers on `Req`, `Res` and `Ctx` such as `Bearer`, `Origin`, `IsSafe`, `Del`, `StatusCode`, `GetCookies`, `Elapsed` and `RouteName`; request helpers are now also reachable through `c.Req()`. ```go token := c.Bearer() // "abc123" for "Authorization: Bearer abc123" c.Del("X-Powered-By") // remove a response header took := c.Elapsed() // time spent on this request so far ``` <https://docs.gofiber.io/api/ctx> - Add Endpoint() for middleware look-ahead ([#4601](https://github.com/gofiber/fiber/issues/4601)) New `c.Endpoint()` returns the route that will handle the request without advancing the handler chain (`nil` on `404`/`405`). ```go app.Use(func(c fiber.Ctx) error { if route := c.Endpoint(); route != nil { // enforce access control using route.Path or route.Name } return c.Next() }) ``` <https://docs.gofiber.io/api/ctx#endpoint> - Add ordered RuleList to the redirect and rewrite middleware ([#4621](https://github.com/gofiber/fiber/issues/4621), [#4633](https://github.com/gofiber/fiber/issues/4633)) New `RuleList []Rule` in `redirect` and `rewrite` is tried in the order written, first match wins; the `Rules` map is deprecated and setting both panics. ```go app.Use(redirect.New(redirect.Config{ RuleList: []redirect.Rule{ {From: "/old", To: "/new"}, // checked first {From: "/old/*", To: "/new/$1"}, // takes everything else }, })) ``` <https://docs.gofiber.io/middleware/redirect#rule-order> - Render configured templates to a writer ([#4594](https://github.com/gofiber/fiber/issues/4594)) New `app.Render` writes a template through the configured view engine to any `io.Writer` without creating an HTTP response, e.g. for SSE or HTMX partials. ```go var buf bytes.Buffer if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil { return err } ``` <https://docs.gofiber.io/api/app#render> - Add final request hooks to the HTTP client ([#4595](https://github.com/gofiber/fiber/issues/4595)) New `AddFinalRequestHook` runs after the built-in hooks, immediately before the request is sent, when `RawRequest` holds the resolved URL, merged headers and serialized body. ```go cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error { raw := req.RawRequest raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body())) return nil }) ``` <https://docs.gofiber.io/client/hooks#final-request-hooks> - Add SetLocal, a request-local store without the variadic's heap slice ([#4687](https://github.com/gofiber/fiber/issues/4687)) New `c.SetLocal(key, value)` stores a request-local value exactly like `c.Locals(key, value)`, without the one-element slice that call allocates. <https://docs.gofiber.io/api/ctx#setlocal> - Add DisableFlashMessages and filter route candidates with a probe constant ([#4655](https://github.com/gofiber/fiber/issues/4655)) New `fiber.Config` option `DisableFlashMessages` turns off redirect flash messages and the per-request `fiber_flash` cookie scan (off by default); the router gains a precomputed probe-constant filter. ```go app := fiber.New(fiber.Config{ DisableFlashMessages: true, // default: false }) ``` <https://docs.gofiber.io/api/fiber#disableflashmessages> - Add source-aware extraction to extractors without a new struct field ([#4603](https://github.com/gofiber/fiber/issues/4603)) New `extractors.Resolve` returns the value together with the `Source` and `Key` of the chain child that produced it; the `Extractor` struct is unchanged. ```go ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key")) res, err := extractors.Resolve(ex, c) // res.Value, plus res.Source and res.Key of the child that won ``` <https://docs.gofiber.io/guide/extractors#source-aware-extraction> #### 🧹 Updates - Require Go 1.26 ([#4654](https://github.com/gofiber/fiber/issues/4654)) - Filter large route buckets before loading routes and bind without building a map ([#4705](https://github.com/gofiber/fiber/issues/4705)) - Filter a route bucket by static path before loading the route ([#4688](https://github.com/gofiber/fiber/issues/4688)) - Consolidate route pattern preprocessing ([#4710](https://github.com/gofiber/fiber/issues/4710)) - Share route and client :name path delimiters ([#4636](https://github.com/gofiber/fiber/issues/4636)) - Normalize header keys in one pass and match canonical media types directly ([#4690](https://github.com/gofiber/fiber/issues/4690)) - Share streaming header join logic ([#4734](https://github.com/gofiber/fiber/issues/4734)) - Consolidate comma-list header scanning into internal/headerlist ([#4637](https://github.com/gofiber/fiber/issues/4637)) - Consolidate entity-tag parsing into internal/etag ([#4632](https://github.com/gofiber/fiber/issues/4632)) - Adopt utils/v2 helpers and cut per-request allocations in the hot path ([#4666](https://github.com/gofiber/fiber/issues/4666)) - cors/csrf: Consolidate origin matching into internal/origin ([#4653](https://github.com/gofiber/fiber/issues/4653)) - limiter: Lock keys per shard instead of globally ([#4702](https://github.com/gofiber/fiber/issues/4702)) - redirect/rewrite: Share capture substitution ([#4749](https://github.com/gofiber/fiber/issues/4749)) - session: Skip the gob re-encode when a session was only read ([#4703](https://github.com/gofiber/fiber/issues/4703)) - Cut the per-request cost of the extractors ([#4678](https://github.com/gofiber/fiber/issues/4678)) - Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps ([#4729](https://github.com/gofiber/fiber/issues/4729)) - Close three test coverage gaps in logger, shutdown and docs ([#4615](https://github.com/gofiber/fiber/issues/4615)) - Add a regression test and docs example for CustomCtx overrides behind middleware ([#4598](https://github.com/gofiber/fiber/issues/4598)) - Add a regression test and docs note that Context() is not canceled on graceful shutdown ([#4599](https://github.com/gofiber/fiber/issues/4599)) - Trigger Dependabot in gofiber/benchmarks after releases ([#4682](https://github.com/gofiber/fiber/issues/4682)) #### 🐛 Fixes - Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware ([#4695](https://github.com/gofiber/fiber/issues/4695)) - Keep stray percents from forging escapes, root every request target and take the SendFile name literally ([#4719](https://github.com/gofiber/fiber/issues/4719)) - Let empty optional params yield to later required segments ([#4722](https://github.com/gofiber/fiber/issues/4722)) - Fix panic on route pattern with trailing escape character ([#4717](https://github.com/gofiber/fiber/issues/4717)) - Preserve names for merged multi-method routes ([#4663](https://github.com/gofiber/fiber/issues/4663)) - Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount ([#4620](https://github.com/gofiber/fiber/issues/4620)) - Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()\[4:]) ([#4674](https://github.com/gofiber/fiber/issues/4674)) - Escape parameter values in generated route URLs ([#4629](https://github.com/gofiber/fiber/issues/4629)) - Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent ([#4721](https://github.com/gofiber/fiber/issues/4721)) - Accept tab OWS in X-Forwarded-For and share one OWS trim helper ([#4735](https://github.com/gofiber/fiber/issues/4735)) - Treat Vary field names as case-insensitive ([#4642](https://github.com/gofiber/fiber/issues/4642)) - Unify cookie SameSite handling ([#4630](https://github.com/gofiber/fiber/issues/4630)) - Prevent unbounded handler growth when SendFile serves a function-backed fs.FS ([#4656](https://github.com/gofiber/fiber/issues/4656)) - Prevent typed-nil view engine panics ([#4662](https://github.com/gofiber/fiber/issues/4662)) - Report the real status for fasthttp-level request errors ([#4614](https://github.com/gofiber/fiber/issues/4614)) - Drain in-flight requests before Listen returns ([#4701](https://github.com/gofiber/fiber/issues/4701)) - basicauth: Equalize verification time across mixed hash algorithms ([#4726](https://github.com/gofiber/fiber/issues/4726)) - basicauth: Refuse a repeated Authorization field ([#4738](https://github.com/gofiber/fiber/issues/4738)) - basicauth/keyauth: Use HTTP quoted strings in auth challenges ([#4631](https://github.com/gofiber/fiber/issues/4631)) - cache: Delete stale entries after uncacheable revalidation ([#4590](https://github.com/gofiber/fiber/issues/4590)) - cache: Key entries by request scheme and host ([#4736](https://github.com/gofiber/fiber/issues/4736)) - cache: Replay Vary on cache hits and mark credential-keyed entries private ([#4744](https://github.com/gofiber/fiber/issues/4744)) - compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper ([#4708](https://github.com/gofiber/fiber/issues/4708)) - idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers ([#4693](https://github.com/gofiber/fiber/issues/4693)) - limiter: Bound the rate-limit key before it reaches storage ([#4677](https://github.com/gofiber/fiber/issues/4677)) - proxy: Apply the client's Connection listing to the request as received ([#4745](https://github.com/gofiber/fiber/issues/4745)) - proxy: Fold DomainForward's configured hostname to Punycode ([#4673](https://github.com/gofiber/fiber/issues/4673)) - proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers ([#4725](https://github.com/gofiber/fiber/issues/4725)) - proxy: Preserve IPv6 brackets in domain forwarding ([#4689](https://github.com/gofiber/fiber/issues/4689)) - redirect/rewrite: Read "$10" as the tenth capture in targets ([#4692](https://github.com/gofiber/fiber/issues/4692)) - session: Honor chain-level extractors and close three write-back holes ([#4679](https://github.com/gofiber/fiber/issues/4679)) - static: Align file resolution with routed paths ([#4712](https://github.com/gofiber/fiber/issues/4712)) - static: Reject partial wildcard matches that cross a path segment boundary ([#4728](https://github.com/gofiber/fiber/issues/4728)) - Decode a path parameter exactly once in FromParam ([#4626](https://github.com/gofiber/fiber/issues/4626)) - Anchor and escape client path parameter substitution ([#4625](https://github.com/gofiber/fiber/issues/4625)) - Keep a stale client Response from releasing a reused Request on Close ([#4659](https://github.com/gofiber/fiber/issues/4659)) - Parse malformed Set-Cookie attributes in the client in linear time ([#4658](https://github.com/gofiber/fiber/issues/4658)) - Make static, proxy, adaptor and rewrite act on the path the router matched ([#4720](https://github.com/gofiber/fiber/issues/4720)) - Fix RFC 9110/9112 compliance gaps in core, static and timeout ([#4747](https://github.com/gofiber/fiber/issues/4747)) - Fix correctness issues across core, router, binder, client and middleware ([#4652](https://github.com/gofiber/fiber/issues/4652)) #### 🛠️ Maintenance <details> <summary>41 changes</summary> - bump the golang-modules group with 2 updates ([#4748](https://github.com/gofiber/fiber/issues/4748)) - bump github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6 ([#4746](https://github.com/gofiber/fiber/issues/4746)) - bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 ([#4743](https://github.com/gofiber/fiber/issues/4743)) - bump github.com/valyala/fasthttp from 1.74.0 to 1.75.0 in the fasthttp-modules group ([#4740](https://github.com/gofiber/fiber/issues/4740)) - bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 ([#4741](https://github.com/gofiber/fiber/issues/4741)) - bump release-drafter/release-drafter from 7.7.0 to 7.9.0 ([#4739](https://github.com/gofiber/fiber/issues/4739)) - bump github.com/tinylib/msgp from 1.6.4 to 1.6.5 ([#4723](https://github.com/gofiber/fiber/issues/4723)) - bump github.com/klauspost/compress from 1.20.0 to 1.20.1 ([#4709](https://github.com/gofiber/fiber/issues/4709)) - bump github.com/gofiber/schema from 1.8.7 to 1.8.8 ([#4706](https://github.com/gofiber/fiber/issues/4706)) - bump github.com/gofiber/utils/v2 from 2.6.0 to 2.6.1 ([#4707](https://github.com/gofiber/fiber/issues/4707)) - bump github.com/gofiber/utils/v2 from 2.5.3 to 2.6.0 ([#4704](https://github.com/gofiber/fiber/issues/4704)) - bump github.com/gofiber/utils/v2 from 2.5.2 to 2.5.3 ([#4700](https://github.com/gofiber/fiber/issues/4700)) - bump codecov/codecov-action from 7.1.0 to 7.1.1 ([#4699](https://github.com/gofiber/fiber/issues/4699)) - bump github.com/molecule-man/go-brrr from 1.1.0 to 1.1.1 ([#4698](https://github.com/gofiber/fiber/issues/4698)) - bump codecov/codecov-action from 7.0.0 to 7.1.0 ([#4691](https://github.com/gofiber/fiber/issues/4691)) - bump github.com/gofiber/schema from 1.8.6 to 1.8.7 ([#4686](https://github.com/gofiber/fiber/issues/4686)) - bump github.com/fxamacker/cbor/v2 from 2.9.3 to 2.9.4 ([#4685](https://github.com/gofiber/fiber/issues/4685)) - bump github.com/gofiber/utils/v2 from 2.5.1 to 2.5.2 ([#4681](https://github.com/gofiber/fiber/issues/4681)) - bump github.com/shamaton/msgpack/v3 from 3.2.2 to 3.2.3 ([#4680](https://github.com/gofiber/fiber/issues/4680)) - bump github.com/molecule-man/go-brrr from 1.0.1 to 1.1.0 ([#4676](https://github.com/gofiber/fiber/issues/4676)) - bump the golang-modules group with 3 updates ([#4672](https://github.com/gofiber/fiber/issues/4672)) - bump golang.org/x/sys from 0.47.0 to 0.48.0 in the golang-modules group ([#4670](https://github.com/gofiber/fiber/issues/4670)) - bump github.com/gofiber/schema from 1.8.5 to 1.8.6 ([#4671](https://github.com/gofiber/fiber/issues/4671)) - bump github.com/gofiber/utils/v2 from 2.5.0 to 2.5.1 ([#4668](https://github.com/gofiber/fiber/issues/4668)) - bump github.com/valyala/fasthttp from 1.73.0 to 1.74.0 in the fasthttp-modules group ([#4667](https://github.com/gofiber/fiber/issues/4667)) - bump streetsidesoftware/cspell-action from 9.0.1 to 9.1.0 ([#4665](https://github.com/gofiber/fiber/issues/4665)) - bump github.com/shamaton/msgpack/v3 from 3.2.1 to 3.2.2 ([#4660](https://github.com/gofiber/fiber/issues/4660)) - bump github.com/gofiber/utils/v2 from 2.4.3 to 2.5.0 ([#4661](https://github.com/gofiber/fiber/issues/4661)) - bump golang.org/x/crypto from 0.55.0 to 0.56.0 in the golang-modules group ([#4651](https://github.com/gofiber/fiber/issues/4651)) - bump github.com/gofiber/utils/v2 from 2.4.2 to 2.4.3 ([#4650](https://github.com/gofiber/fiber/issues/4650)) - bump github.com/klauspost/compress from 1.19.2 to 1.20.0 ([#4649](https://github.com/gofiber/fiber/issues/4649)) - bump github.com/gofiber/schema from 1.8.4 to 1.8.5 ([#4647](https://github.com/gofiber/fiber/issues/4647)) - bump github.com/shamaton/msgpack/v3 from 3.2.0 to 3.2.1 ([#4645](https://github.com/gofiber/fiber/issues/4645)) - bump github.com/andybalholm/brotli from 1.2.2 to 1.2.3 ([#4639](https://github.com/gofiber/fiber/issues/4639)) - bump github.com/gofiber/utils/v2 from 2.4.1 to 2.4.2 ([#4634](https://github.com/gofiber/fiber/issues/4634)) - bump github.com/stretchr/testify from 1.12.0 to 1.12.1 ([#4627](https://github.com/gofiber/fiber/issues/4627)) - bump streetsidesoftware/cspell-action from 8.4.0 to 9.0.1 ([#4624](https://github.com/gofiber/fiber/issues/4624)) - bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3 ([#4623](https://github.com/gofiber/fiber/issues/4623)) - bump github.com/stretchr/testify from 1.11.1 to 1.12.0 ([#4622](https://github.com/gofiber/fiber/issues/4622)) - bump the golang-modules group with 3 updates ([#4611](https://github.com/gofiber/fiber/issues/4611)) - bump github.com/gofiber/schema from 1.8.3 to 1.8.4 ([#4609](https://github.com/gofiber/fiber/issues/4609)) </details> #### 📚 Documentation - Clarify that c.IP() walks the proxy chain only with EnableIPValidation ([#4737](https://github.com/gofiber/fiber/issues/4737)) - Explain what MIMETypes does to an existing format ([#4664](https://github.com/gofiber/fiber/issues/4664)) - Document the nested and array field notations in Bind ([#4616](https://github.com/gofiber/fiber/issues/4616)) - Add a minimal CRUD and healthcheck guide ([#4696](https://github.com/gofiber/fiber/issues/4696)) - Fix British to American English spellings across docs ([#4697](https://github.com/gofiber/fiber/issues/4697)) - Update README documentation links ([#4711](https://github.com/gofiber/fiber/issues/4711)) **📒 Documentation**: <https://docs.gofiber.io/> **💬 Discord**: <https://gofiber.io/discord> **Full Changelog**: <https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0> Thank you [@00200200](https://github.com/00200200), [@Arvin-Lee](https://github.com/Arvin-Lee), [@AshSgDe29071999](https://github.com/AshSgDe29071999), [@BitWeaverDev](https://github.com/BitWeaverDev), [@Dev-next-gen](https://github.com/Dev-next-gen), [@Rachit-Gandhi](https://github.com/Rachit-Gandhi), [@ReneWerner87](https://github.com/ReneWerner87), [@Rohilalala](https://github.com/Rohilalala), [@RubenPari](https://github.com/RubenPari), [@VedantMadane](https://github.com/VedantMadane), [@ZihxS](https://github.com/ZihxS), [@aditya-rohilla](https://github.com/aditya-rohilla), [@drakeo338](https://github.com/drakeo338), [@evgenyponomarev](https://github.com/evgenyponomarev), [@fadiromdhan3](https://github.com/fadiromdhan3), [@fadiroot](https://github.com/fadiroot), [@gaby](https://github.com/gaby), [@h2zi](https://github.com/h2zi), [@haimingZZ](https://github.com/haimingZZ), [@ibraah007](https://github.com/ibraah007), [@jabrailkhalil](https://github.com/jabrailkhalil), [@lazerg](https://github.com/lazerg), [@official-burak](https://github.com/official-burak) and [@truongbo17](https://github.com/truongbo17) for making this release possible. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

samuel added 1 commit

2026-10-26 04:04:50 +00:00

fix(deps): update module github.com/gofiber/fiber/v3 to v3.6.1

PR Check / build (pull_request) Successful in 2m35s

Details

PR Check / test (pull_request) Successful in 1m45s

Details

ad4b2b697c

samuel commented

2026-10-26 04:04:51 +00:00

Author

Owner

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

8 additional dependencies were updated

Details:

Package	Change
`github.com/gofiber/schema`	`v1.8.3` -> `v1.8.8`
`github.com/gofiber/utils/v2`	`v2.4.1` -> `v2.6.2`
`github.com/klauspost/compress`	`v1.19.2` -> `v1.20.3`
`github.com/mattn/go-colorable`	`v0.1.15` -> `v0.1.16`
`github.com/tinylib/msgp`	`v1.6.4` -> `v1.6.5`
`github.com/valyala/fasthttp`	`v1.73.0` -> `v1.75.0`
`golang.org/x/crypto`	`v0.57.0` -> `v0.58.0`
`golang.org/x/net`	`v0.59.0` -> `v0.61.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 8 additional dependencies were updated Details: | **Package** | **Change** | | :------------------------------ | :--------------------- | | `github.com/gofiber/schema` | `v1.8.3` -> `v1.8.8` | | `github.com/gofiber/utils/v2` | `v2.4.1` -> `v2.6.2` | | `github.com/klauspost/compress` | `v1.19.2` -> `v1.20.3` | | `github.com/mattn/go-colorable` | `v0.1.15` -> `v0.1.16` | | `github.com/tinylib/msgp` | `v1.6.4` -> `v1.6.5` | | `github.com/valyala/fasthttp` | `v1.73.0` -> `v1.75.0` | | `golang.org/x/crypto` | `v0.57.0` -> `v0.58.0` | | `golang.org/x/net` | `v0.59.0` -> `v0.61.0` |

PR Check / build (pull_request) Successful in 2m35s

Details

PR Check / test (pull_request) Successful in 1m45s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/go-dependencies:renovate/go-dependencies

git switch renovate/go-dependencies

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/go-dependencies

git switch renovate/go-dependencies

git rebase main

git switch main

git merge --ff-only renovate/go-dependencies

git switch renovate/go-dependencies

git rebase main

git switch main

git merge --no-ff renovate/go-dependencies

git switch main

git merge --squash renovate/go-dependencies

git switch main

git merge --ff-only renovate/go-dependencies

git switch main

git merge renovate/go-dependencies

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

samuel/dash!31

No description provided.

Rows
Columns