gofiber/fiber v3.7.0

on GitHub

🚀 New

• Update fasthttp to v1.78.0 (#4779, #4803, #4862)
  fasthttp v1.78.0 (from v1.75.0) hardens request framing, multipart parsing, redirects and file serving, and speeds up path normalization, query parsing, header setters and Client.Do.
  https://github.com/valyala/fasthttp/releases/tag/v1.78.0
• Support map fields in query and form binding (#4788)
  Struct fields of type map[string]T now bind from query strings and form bodies; attributes[color] and attributes.color both give the key color.

  type Filter struct {
      Attributes map[string]string   `query:"attributes"` // ?attributes[color]=red&attributes.size=m
      Tags       map[string][]string `query:"tags"`       // ?tags[sale]=yes&tags[sale]=new
      Limits     map[string]int      `query:"limits"`     // ?limits[max]=5
  }

  https://docs.gofiber.io/api/bind#map-fields
• Add AllowSymlinksOutsideRoot to the static middleware (#4803)
  A root on disk is now confined: symbolic links that leave it, and absolute ones, are handled like missing files unless AllowSymlinksOutsideRoot is set.

  app.Use("/assets", static.New("./public", static.Config{
      AllowSymlinksOutsideRoot: true, // default: false
  }))

  https://docs.gofiber.io/middleware/static#config
• Let proxy.DoRedirects and the Fiber client drop extra sensitive headers on a redirect (#4800)
  New opt-in RedirectSensitiveHeaders on proxy.SecurityPolicy and the client (Client, Request, Config) names headers such as X-Api-Key that a redirect to another origin (proxy) or host (client) drops; empty by default.

  policy := proxy.DefaultSecurityPolicy()
  policy.RedirectSensitiveHeaders = []string{"X-Api-Key", "X-Auth-Token"}
  proxy.WithSecurityPolicy(policy)
  
  cli := client.New().SetRedirectSensitiveHeaders("X-Api-Key")

  https://docs.gofiber.io/middleware/proxy#headers-on-a-cross-origin-redirect

🧹 Updates

• Share host splitting and IDNA folding (#4851)
• Align forwarded header list parsing (#4847)
• Share forwarded IP scanning and ignore empty elements (#4820)
• Share redirect URL normalization (#4824)
• Speed up media type parameter parsing (#4807)
• Avoid allocations for empty typed lookups (#4852)
• Consolidate control-character scanning (#4783)
• cache/limiter: Walk Cache-Control lists with headerlist and write Retry-After without a string (#4833)
• cors/csrf: Share origin allow-list parsing (#4836)
• encryptcookie: Build the AEAD once per middleware instead of per cookie (#4838)
• etag: Checksum bodies with slicing-by-8 (#4794)
• limiter: Format rate-limit header values without allocating (#4822)
• proxy: Copy the forwarder name before storing it in the refused-request test (#4819)
• redirect/rewrite: Share pattern compilation (#4846)
• Share the client cookie jar host normalization (#4844)
• Share the value-redaction helper across middleware (#4821)
• Deduplicate the unit tests with shared helpers (#4825)
• Use a nolint:revive directive on App.Handler (#4831)

🐛 Fixes

• Stop optional path parameters from swallowing a slash (#4778)
• Stat the index for directory SendFile ranges and move the path guards into internal/fspath (#4769)
• Skip empty forwarded host and proto elements and restore the Next loop (#4856)
• Preserve nil first field lines when joining headers (#4840)
• Return an empty charset when its value is not a token (#4781)
• Preserve redirects and errors in Fresh checks (#4811)
• Trim the whitespace around comma-split header values in Bind (#4793)
• Reject out-of-range int and uint in generic parsers on 32-bit (#4832)
• Make Links add to the Link header instead of replacing it (#4829)
• Serve a request with a TLS state over TLS in app.Test (#4839)
• Send the measured Content-Length of an unsized body in app.Test (#4830)
• Make Listen return when GracefulContext is done during startup (#4770)
• cache: End cached entries when a revalidation is refused with 401, 403 or 407 (#4785)
• cache: Release the lock when CacheInvalidator panics and simplify the lock flow (#4765)
• cache/proxy/session: Close the gaps found auditing the recent merges (#4855)
• compress: Honor repeated and quoted response Cache-Control lines (#4802)
• encryptcookie: Handle duplicate cookie names (#4774)
• hostauthorization: Compare IPv6 hosts by address, not by spelling (#4798)
• hostauthorization: Bound the port value, not its digit count (#4796)
• idempotency: Exclude unchanged upstream headers from storage (#4834)
• idempotency/proxy: Stop cookie replay and refuse path parameters (#4791)
• keyauth: Omit the Bearer error parameters from the challenge when no credentials are sent (#4837)
• limiter: Fix spec mismatches and consolidate its code and tests (#4762)
• limiter/proxy: Fix key aliasing and the redirect, SSRF and Balancer issues (#4784)
• static: Refuse a path with an empty first segment on a root mount (#4772)
• Synchronize client cookie jar reads during initialization (#4843)
• Return each key once from the client's QueryParam.Keys and FormData.Keys (#4776)
• Copy client response header keys before reading their values (#4771)
• Fix header, body, routing and session handling defects (#4850)

🛠️ Maintenance

📚 Documentation

• Add a Migrate section to the README (#4790)
• Update ctx and intro examples (#4806)
• Explain bounding proxy-derived storage keys (#4841)
• Explain client and server redirect control-byte policies (#4842)
• logger: Explain the ignored SendStatus error in the fallback handler (#4826)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.6.1...v3.7.0

Thank you @10kartik, @Alifarid0011, @anqorithm, @appdever01, @arditxhuveli1, @b84330808, @Dev-next-gen, @ElsiPotka, @fadiromdhan3, @fadiroot, @gaby, @helmipradita, @IslamElsayed, @kaankucukx, @ninadsutrave, @nk-batman21, @PerryLink, @Rachit-Gandhi, @ReneWerner87, @RS-ITACHI, @via2004, @YOGESH256 and @yxshee for making this release possible.