gofiber/fiber v3.5.0

on GitHub

🚀 New

• Harden proxy middleware (#4405)
  New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })

  https://docs.gofiber.io/middleware/proxy#security
• Add support for custom binding precedence (#4544)
  New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }

  https://docs.gofiber.io/api/bind#custom-precedence
• Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486)
  New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

🧹 Updates

• Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
• Quick-reject routes on precomputed slash-count bounds (#4517)
• Restore Route inlining lost in the RFC 9110 changes (#4501)
• Skip the Accept join allocation in the Format emptiness check (#4503)
• Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
• Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
• Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
• Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
• adaptor: Cut allocations on the net/http bridge (#4559)
• cache: Optimize key generation and allocation (#4608)
• cors: Fold preflight Vary calls into one header scan (#4502)
• csrf: Optimize trusted subdomain matching (#4543)
• proxy: Optimize balancer round-robin (#4549)
• session: Use make() to preallocate relevantExtractors (#4562)
• De-flake the clock-sensitive tests (#4575)

🐛 Fixes

• Fix open redirects in composed route URLs and redirect rules (#4584)
• Preserve published route buckets during rebuilds (#4579)
• URL-encode query values in Redirect.Route (#4529)
• Accept the full float64 range in the float route constraint (#4528)
• Match HTTP field names the way a recipient must (#4585)
• Honor Accept weights followed by whitespace before the comma (#4550)
• Compare Accept media types case-insensitively (#4493)
• Honor q=0 rejections in content negotiation (#4508)
• Honor duplicate Content-Encoding after empty values (#4514)
• Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)
• Avoid reading omitted request bodies in Bind.All (#4565)
• Combine repeated proxy headers for client IP extraction (#4568)
• Close the listener on Listen error paths to avoid FD leaks (#4532)
• Fire OnPostShutdown once with the real shutdown error (#4531)
• Keep all NewErrorf args when the first isn't a format string (#4530)
• adaptor: Preserve Connection tokens (#4606)
• cache: Honor only-if-cached for non-shareable entries (#4589)
• cache: Stop charging its own latency as response age (#4578)
• healthcheck: Answer HEAD probes with the GET status (#4577)
• limiter: Floor sub-second expiration in the sliding window (#4564)
• proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)
• proxy: Guard runtime helpers against DNS rebinding (#4518)
• proxy: Preserve empty-query URL semantics (#4513)
• redirect: Rank wildcards behind character classes in rule ordering (#4607)
• static: Fix leading-slash normalization for fs.FS root paths (#4507)
• Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)
• Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

🛠️ Maintenance

📚 Documentation

• Explain adjacent multi-param capture rules (#4597)
• Document Ctx as a never-cancelable context (#4560)
• Move README.md to the repo root so pkg.go.dev renders it (#4505)
• logger: Explain when the error tag is populated (#4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.