What's Changed
- Go 1.26 and golangci-lint updates by @erikdubbelboer in #2146
- Add WithLimit methods for uncompression by @erikdubbelboer in #2147
- Honor Root for fs.FS and normalize fs-style roots by @erikdubbelboer in #2145
- Sanitize header values in all setter paths to prevent CRLF injection by @erikdubbelboer in #2162
- Add ServeFileLiteral, ServeFSLiteral and SendFileLiteral by @erikdubbelboer in #2163
- Prevent chunk extension request smuggling by @erikdubbelboer in #2165
- Validate request URI format during header parsing to reject malformed requests by @erikdubbelboer in #2168
- HTTP1/1 requires exactly one Host header by @erikdubbelboer in #2164
- Strict HTTP version validation and simplified first line parsing by @erikdubbelboer in #2167
- Only normalize pre-colon whitespace for HTTP headers by @erikdubbelboer in #2172
- fs: reject '..' path segments in rewritten paths by @erikdubbelboer in #2173
- fasthttpproxy: reject CRLF in HTTP proxy CONNECT target by @erikdubbelboer in #2174
- fasthttpproxy: scope proxy auth cache to GetDialFunc by @erikdubbelboer in #2144
- feat: enhance performance by @ReneWerner87 in #2135
- export ErrConnectionClosed by @pjebs in #2152
- fix: detect master process death in prefork children by @meruiden in #2158
- return prev values by @pjebs in #2123
- docs: added httpgo to related projects by @MUlt1mate in #2169
- chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #2149
- chore(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 by @dependabot[bot] in #2170
- chore(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by @dependabot[bot] in #2129
- chore(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by @dependabot[bot] in #2140
- chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in #2166
- chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #2139
- chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @dependabot[bot] in #2128
- chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 by @dependabot[bot] in #2138
- chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by @dependabot[bot] in #2125
- chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @dependabot[bot] in #2137
- chore(deps): bump securego/gosec from 2.22.11 to 2.23.0 by @dependabot[bot] in #2142
- Update securego/gosec from 2.23.0 to 2.25.0 by @erikdubbelboer in #2161
New Contributors
- @MUlt1mate made their first contribution in #2169
- @meruiden made their first contribution in #2158
Full Changelog: v1.69.0...v1.70.0