🚀 New

Harden proxy middleware (#4405)

New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

proxy.WithSecurityPolicy(proxy.SecurityPolicy{
AllowPrivateIPs: true, // internal upstreams are blocked by default
})

https://docs.gofiber.io/middleware/proxy#security

Add support for custom binding precedence (#4544)

New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

type SearchReq struct {
Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
}

https://docs.gofiber.io/api/bind#custom-precedence

Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486)

New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

app := fiber.New(fiber.Config{
SkipUnmatchedRoutes: true, // default: false
})

https://docs.gofiber.io/api/fiber#skipunmatchedroutes

🧹 Updates

Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)

Quick-reject routes on precomputed slash-count bounds (#4517)

Restore Route inlining lost in the RFC 9110 changes (#4501)

Skip the Accept join allocation in the Format emptiness check (#4503)

Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)

Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)

Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)

Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)

adaptor: Cut allocations on the net/http bridge (#4559)

cache: Optimize key generation and allocation (#4608)

cors: Fold preflight Vary calls into one header scan (#4502)

csrf: Optimize trusted subdomain matching (#4543)

proxy: Optimize balancer round-robin (#4549)

session: Use make() to preallocate relevantExtractors (#4562)

De-flake the clock-sensitive tests (#4575)

🐛 Fixes

Fix open redirects in composed route URLs and redirect rules (#4584)

Preserve published route buckets during rebuilds (#4579)

URL-encode query values in Redirect.Route (#4529)

Accept the full float64 range in the float route constraint (#4528)

Match HTTP field names the way a recipient must (#4585)

Honor Accept weights followed by whitespace before the comma (#4550)

Compare Accept media types case-insensitively (#4493)

Honor q=0 rejections in content negotiation (#4508)

Honor duplicate Content-Encoding after empty values (#4514)

Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)

Avoid reading omitted request bodies in Bind.All (#4565)

Combine repeated proxy headers for client IP extraction (#4568)

Close the listener on Listen error paths to avoid FD leaks (#4532)

Fire OnPostShutdown once with the real shutdown error (#4531)

Keep all NewErrorf args when the first isn't a format string (#4530)

adaptor: Preserve Connection tokens (#4606)

cache: Honor only-if-cached for non-shareable entries (#4589)

cache: Stop charging its own latency as response age (#4578)

healthcheck: Answer HEAD probes with the GET status (#4577)

limiter: Floor sub-second expiration in the sliding window (#4564)

proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)

proxy: Guard runtime helpers against DNS rebinding (#4518)

proxy: Preserve empty-query URL semantics (#4513)

redirect: Rank wildcards behind character classes in rule ordering (#4607)

static: Fix leading-slash normalization for fs.FS root paths (#4507)

Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)

Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

🛠️ Maintenance

22 changes

bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#4602)

bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 (#4583)

bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#4566)

bump github.com/gofiber/utils/v2 from 2.4.0 to 2.4.1 (#4567)

bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 in the fasthttp-modules group (#4561)

bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#4556)

bump actions/checkout from 7.0.0 to 7.0.1 (#4551)

bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#4548)

bump github.com/gofiber/schema from 1.8.2 to 1.8.3 (#4547)

bump release-drafter/release-drafter from 7.5.1 to 7.6.0 (#4546)

bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 (#4545)

bump actions/setup-go from 6.5.0 to 7.0.0 (#4541)

bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#4540)

bump github.com/shamaton/msgpack/v3 from 3.1.2 to 3.2.0 (#4538)

bump actions/setup-node from 6.4.0 to 7.0.0 (#4537)

bump github.com/gofiber/schema from 1.8.1 to 1.8.2 (#4535)

bump github.com/gofiber/utils/v2 from 2.1.1 to 2.1.2 (#4520)

bump the golang-modules group with 3 updates (#4515)

bump DavidAnson/markdownlint-cli2-action from 23.2.0 to 24.0.0 (#4506)

bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-modules group (#4511)

bump golang.org/x/text from 0.38.0 to 0.39.0 in the golang-modules group (#4509)

bump github.com/gofiber/schema from 1.8.0 to 1.8.1 (#4510)

📚 Documentation

Explain adjacent multi-param capture rules (#4597)

Document Ctx as a never-cancelable context (#4560)

Move README.md to the repo root so pkg.go.dev renders it (#4505)

logger: Explain when the error tag is populated (#4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.

Original source

🚀 New

Complete HTTP QUERY method support (#4436, #4456)

Adds the HTTP QUERY method (RFC 10008): fiber.MethodQuery, app.Query() routing, safe/idempotent handling in csrf, idempotency, earlydata and cache, plus client.Query() shorthands.

app.Query("/search", func(c fiber.Ctx) error {
return c.Send(c.Body()) // QUERY carries the query expression in the body
})

https://docs.gofiber.io/client/rest#query

Add WithContext variants for session storage I/O (#4393)

SaveWithContext, DestroyWithContext, RegenerateWithContext and ResetWithContext propagate deadlines/cancellation to the session storage backend; the plain methods keep working unchanged.

sess := session.FromContext(c)
err := sess.SaveWithContext(ctx) // storage write bounded by ctx

https://docs.gofiber.io/middleware/session#session-with-context-timeoutscancellation

Unify internal and custom constraints into a single interface (#4397)

Built-in and custom route constraints now share one ConstraintHandler interface; the optional ConstraintAnalyzer precomputes constraint data at route registration, removing per-request parsing. Existing CustomConstraint implementations keep working unchanged.

app.RegisterCustomConstraint(evenConstraint{}) // implements Name() + Execute()
app.Get("/items/:id<even>", handler)

https://docs.gofiber.io/guide/routing#constrainthandler-interface

Expose prefork RecoverInterval and ShutdownGracePeriod (#4491)

New ListenConfig knobs: PreforkRecoverInterval delays respawning a crashed child (default 0) and PreforkShutdownGracePeriod sets how long the master waits after SIGTERM before SIGKILL (default 5s).

app.Listen(":3000", fiber.ListenConfig{
EnablePrefork: true,
PreforkRecoverInterval: time.Second,
PreforkShutdownGracePeriod: 10 * time.Second,
})

https://docs.gofiber.io/api/fiber#preforkrecoverinterval

🧹 Updates

Reduce avoidable work in the request hot path (#4490)

Avoid per-request heap allocation in DefaultErrorHandler (#4446)

Use sentinel errors on typed-getter and Range parse failures (#4448)

Replace appendLowerBytes with utilsbytes.UnsafeToLower (#4468)

Add MIMETextEventStream constant (#4415)

Cache binder decoder type metadata across requests (#4447)

Eliminate double reflection in binder mergeStruct (-10% allocs) (#4385)

Reduce binder data map allocations (#4379)

cache: Append canonical key segments into the pooled buffer (#4450)

cors: Optimize subdomain origin matching (#4482)

cors: Optimize exact-origin lookup to O(1) (#4368)

csrf/redirect: Share scheme/host matching and skip url.Parse on the hot path (#4449)

Narrow client user hook lock scope safely (#4375)

Raise middleware coverage above 90% for timeout, logger, idempotency, limiter, cache (#4466)

Cover remaining cors/csrf middleware branches (#4462)

Add unit tests for isOriginSerializedOrNull (#4461)

Cover session deadline/error paths and delegate Middleware lifecycle methods (#4435)

Inject clock to make time-dependent tests deterministic (#4430)

Rename benchmark cases (#4383)

Remove test-only dead code and add manual deadcode workflow (#4458)

Remove dead code flagged by static analysis (#4454)

Static analysis cleanups (#4444)

Fix modernize lint issues (#4315)

🐛 Fixes

Evaluate If-Modified-Since when If-None-Match is absent in Fresh (#4488)

Fix open redirect via Redirect().Back() by validating the Referer header origin (#4370)

Fix data race on lazy appListKeys generation in Render (#4440)

Avoid route fallback errors during server error middleware traversal (#4426)

Strip all trusted proxy IPs from X-Forwarded-For chain (#4394)

Guard typed-nil errors (#4407)

Guard typed-nil Fiber error paths without reflection (#4372)

Preserve legacy custom constraint arguments (#4432)

Remove unreachable SameSiteDefaultMode case (#4471)

Detach quoted filename strings from pooled buffers (#4374)

Prevent app.init mutex deadlock on panic (#4366)

Enforce CertClientFile for AutoCertManager TLS (#4312)

cache: Separate authorization key segment (#4467)

cache: Hash QUERY body keys (#4459)

cache: Evaluate freshness after locking (#4419)

cors: Validate wildcard origins before matching (#4438)

cors: Reject empty wildcard labels (#4437)

csrf: Validate nested extractor chains (#4439)

csrf: Port CORS subdomain match fixes (#4455)

etag: Skip Server-Sent Events responses (#4487)

Guard extractor introspection cycles (#4453)

helmet: Use Scheme() for HTTPS detection and validate HSTS configuration (#4389)

hostauthorization: Reject malformed hostnames in wildcard path (#4408)

idempotency: Make MemoryLock safe for zero-value use (#4371)

limiter: Correct fixed-window hit credit on skipped requests (#4422)

logger/cache/storage: Remove unbounded background goroutines (#4378)

pprof/proxy: Fix trailing-slash redirect and balancer empty-server panic (#4421)

proxy: Bound upstream connections by default (#4369)

rewrite/redirect: Anchor rules to the start of the path (#4483)

session: Prevent session fixation by preserving successful extractor in chains (#4469)

session: Prevent store error disclosure (#4424)

session: Restore isFresh field name (#4477)

sse: Preserve trailing newlines in event data (#4414)

timeout: Isolate default timeout responses (#4442)

timeout: Reclaim abandoned fiber.Ctx via ScheduleReclaim latch (#4359, #4400)

Fix client config locking races (#4470)

Fix client default access race in Replace/C path (#4377)

Handle panics in client execFunc without crashing callers (#4365)

Address bugs found in codebase audit (#4420)

Fix cleanup follow-ups and regression coverage (#4380)

🛠️ Maintenance

22 changes

bump github.com/klauspost/compress from 1.18.7 to 1.19.0 (#4489)

bump github.com/klauspost/compress from 1.18.6 to 1.18.7 (#4485)

bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 (#4484)

bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 in the fasthttp-modules group (#4481)

bump actions/cache/restore from 6.0.0 to 6.1.0 (#4480)

bump actions/cache/save from 6.0.0 to 6.1.0 (#4479)

bump release-drafter/release-drafter from 7.5.0 to 7.5.1 (#4463)

bump release-drafter/release-drafter from 7.4.0 to 7.5.0 (#4457)

bump actions/cache from 5.0.5 to 6.0.0 (#4452)

bump actions/setup-go from 6.4.0 to 6.5.0 (#4451)

bump actions/checkout from 6.0.3 to 7.0.0 (#4441)

bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (#4434)

bump golang.org/x/net from 0.55.0 to 0.56.0 in the golang-modules group (#4425)

bump github.com/gofiber/schema from 1.7.2 to 1.8.0 (#4417)

bump the golang-modules group with 2 updates (#4416)

bump golang.org/x/sys from 0.45.0 to 0.46.0 in the golang-modules group (#4412)

bump codecov/codecov-action from 6.0.1 to 7.0.0 (#4413)

bump actions/checkout from 6.0.2 to 6.0.3 (#4398)

bump github.com/gofiber/schema from 1.7.1 to 1.7.2 (#4396)

bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 (#4384)

bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#4314)

bump the golang-modules group with 3 updates (#4310)

📚 Documentation

Restructure routing guide and split handler partials (#4311)

Fix Ctx.Scheme/Protocol documentation (#4473, #4474)

Clarify client hook concurrency contract (#4386)

keyauth: Fix extractor examples (#4409)

Add FAQ troubleshooting entry for the "id <= evictCount" (hpack/gRPC) panic (#4475)

Replace interface{} with any (Go 1.18+) (#4433)

Document thread-safety contracts for mutex-backed public types (#4367)

Enhance sponsorship section in README (#4402)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.3.0...v3.4.0

Thank you @0xghost42, @Amirhf1, @DucMinhNe, @Fenny, @MD-Mushfiqur123, @ReneWerner87, @alexandear, @fereidani, @gaby, @james-yusuke, @ksw2000, @nekoworks-magic, @niksis02, @pageton, @sixcolors and @talktokim for making this release possible.

Original source

🚀 New

Add support for configuring the Regex engine on the router (#4254)

Swap the compiler used for regex() route constraints. Assign a drop-in engine such as coregex.MustCompile for faster matching;Fiber reuses the compiled matcher across requests.

app := fiber.New(fiber.Config{
RegexHandler: coregex.MustCompile, // default: regexp.MustCompile
})

https://docs.gofiber.io/api/fiber#regexhandler

Host auth middleware (#4199)

New hostauthorization middleware that validates the incoming Host header against an allowlist (exact host, .subdomain wildcard, CIDR range) to protect against DNS rebinding attacks.

app.Use(hostauthorization.New(hostauthorization.Config{
AllowedHosts: []string{"api.myapp.com", ".myapp.com", "10.0.0.0/8"},
}))

https://docs.gofiber.io/middleware/hostauthorization

Delegate implementation to fasthttp/prefork (#4210)

Prefork now delegates to fasthttp's prefork package and adds PreforkRecoverThreshold (max child restarts before the master exits) and PreforkLogger to ListenConfig.

https://docs.gofiber.io/api/fiber#preforkrecoverthreshold

Add support for contextual logs (#4241)

Render request-scoped fields in log.WithContext(c) by configuring a template with log.SetContextTemplate, reusing the middleware/logger engine (including ${value:key} for arbitrary context values).

log.MustSetContextTemplate(log.ContextConfig{Format: log.RequestIDFormat})
app.Get("/", func(c fiber.Ctx) error {
log.WithContext(c).Info("start") // renders the request id
return c.SendString("ok")
})

https://docs.gofiber.io/api/log#bind-context

Add storage backed SharedState for prefork applications (#4243)

A prefork-safe, storage-backed key/value store via app.SharedState() for data shared across workers/processes, with JSON/MsgPack/CBOR/XML helpers and automatic key namespacing. app.State() stays process-local.

app := fiber.New(fiber.Config{
SharedStorage: redis.New(), // any fiber.Storage shared across workers
})
app.SharedState().SetJSON("config", cfg, 0)

https://docs.gofiber.io/api/state#sharedstate-prefork-safe

Add lightweight SSE middleware (#4239)

A Fiber-native middleware/sse for Server-Sent Events: SSE headers, event/comment/retry frames, per-write flushing, heartbeats, Last-Event-ID access, and disconnect detection via stream.Context().

app.Get("/events", sse.New(sse.Config{
Handler: func(c fiber.Ctx, stream *sse.Stream) error {
return stream.Event(sse.Event{Name: "message", Data: fiber.Map{"message": "hello"}})
},
}))

https://docs.gofiber.io/middleware/sse

🧹 Updates

Add prefixes to unexported boolean fields (#4300)

Improve error messages in SaveFileToStorage (#4173)

Streamline request handler selection and context management for improved performance (#4233)

🐛 Fixes

Preserve mounted sub-app regex handler during mount prefixing (#4308)

Trim only one trailing dot in host normalization (#4307)

Reject oversized unknown-length adaptor request bodies (#4306)

Fix compress middleware's shouldSkip method to avoid memory growth (#4284)

Reject malformed host authorities in hostauthorization (#4293)

Synchronize view reloads with template rendering (#4288)

Avoid panic for non-struct listeners in TLS config discovery (#4305)

Clear plaintext cookie when encryption fails (#4303)

Fix regex route constraint parsing with literal > (#4292)

Reject empty normalized host before dynamic matching (#4291)

Preserve idempotency replay protection for oversized responses (#4287)

Enforce CookieJar domain acceptance and host-only cookie matching (#4282)

Avoid panic when reading released Fiber context values (#4271)

Enforce static root for fs-backed directory serving (#4277)

Prevent negative paginate start overflow (#4272)

Prevent SharedState namespace key collisions (#4274)

Copy FullURL string before returning pooled buffer (#4275)

Enforce paginate sort allowlist when AllowedSorts is unset (#4276)

Validate and safely apply workflow version updates (#4273)

Close BodyStream in adaptor FiberHandler streaming path (#4267)

Prevent panic when MsgPack is not configured (#4268)

Keep IsFromLocal loopback-only and add unix-socket helper (#4270)

Prevent panic when CBOR is not explicitly configured (#4269)

Guard session logger tag against released middleware (#4265)

Add X-Real-IP protection to Forward and DomainForward variants (#4261)

Ensure BalancerForward overwrites X-Real-IP header (#4260)

Add test coverage for multipart BodyLimit error handling (#4237)

Improve error propagation in Express-style handler (#4250)

Remove SSE Next and clarify SSE handler docs (#4247)

BasicAuth verifier for unknown users (#4245)

🛠️ Maintenance

13 changes

bump github.com/shamaton/msgpack/v3 from 3.1.1 to 3.1.2 (#4296)

bump codecov/codecov-action from 6.0.0 to 6.0.1 (#4294)

bump actions/add-to-project from 1.0.2 to 2.0.0 (#4256)

bump github.com/shamaton/msgpack/v3 from 3.1.0 to 3.1.1 (#4281)

bump the golang-modules group with 3 updates (#4278)

bump golang.org/x/sys from 0.43.0 to 0.44.0 in the golang-modules group (#4262)

bump DavidAnson/markdownlint-cli2-action from 23.1.0 to 23.2.0 (#4259)

bump benchmark-action/github-action-benchmark from 1.22.0 to 1.22.1 (#4258)

bump github.com/valyala/fasthttp from 1.70.0 to 1.71.0 in the fasthttp-modules group (#4255)

bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#4249)

bump DavidAnson/markdownlint-cli2-action from 23.0.0 to 23.1.0 (#4246)

bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 (#4242)

📚 Documentation

Fix invalid RouteChain method chaining example (#4304)

Harden reverse proxy X-Forwarded-For example (#4266)

Correct fasthttpctx Done semantics in context guide (#4264)

Clarify ${bytesSent} behavior in logger middleware (#4251)

Clarify prefork security model and OS-specific socket behavior (#4240)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.2.0...v3.3.0

Thank you @ReneWerner87, @elton-peixoto-lu, @gaby, @gtoxlili, @lyyvalhalla, @mutantkeyboard, @pageton and @pratikramteke for making this release possible.

Original source

New

• Add URL() method to Route for generating URLs with parameters (#4195)
• https://docs.gofiber.io/api/app#getroute
• Add comprehensive tests for binding to pointer scalar types (#4191)
• Add response format support to healthcheck middleware (#4178)
• https://docs.gofiber.io/middleware/healthcheck#config
• Route Domain() func for host-based routing (#4100)
• Add pagination middleware (#4127)
• https://docs.gofiber.io/middleware/paginate
• Add BindError type with source and field metadata (#4120)
• https://docs.gofiber.io/api/bind#binderror
• Add PanicHandler in recover middleware (#4110)
• https://docs.gofiber.io/middleware/recover#config

Updates

• Optimize speed (#4231)
• Remove duplicate benchmark handling and update benchmark action version (#4108)

Fixes

• Fix race condition in TestTimeout_ContextPropagation (#4119)
• Fix ARMv7 build overflow in etag middleware (#4190)
• Fix HTML escaping in AutoFormat (#4228)
• Structured default cache keys, and controls (#4224)
• Enforce BodyLimit on request decompression and multipart form parsing (#4213)
• Implement releaseData function for better resource management (#4209)
• Strip path from referer before matching trusted origins (#4204)
• Improve clarity for ProxyHeader and TrustProxy configuration (#4140)
• Prefork children exit immediately in Docker containers (#4133)
• Fix math.MaxUint32 overflow in etag middleware on 32-bit platforms (#4135)
• Add nil checks to End() to prevent panic in streaming mode (#4128)
• Custom binders bypass StructValidator in Body() and Custom() (#4124)

Maintenance

43 changes

• bump actions/setup-go from 6.2.0 to 6.3.0 (#4114)
• bump golang.org/x/net from 0.50.0 to 0.51.0 in the golang-modules group (#4113)
• bump github.com/gofiber/schema from 1.7.0 to 1.7.1 (#4220)
• bump actions/setup-node from 6.3.0 to 6.4.0 (#4222)
• bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 (#4221)
• bump github.com/tinylib/msgp from 1.6.3 to 1.6.4 (#4215)
• bump github/codeql-action from 4.35.1 to 4.35.2 (#4216)
• bump actions/cache from 5.0.4 to 5.0.5 (#4214)
• bump actions/github-script from 8.0.0 to 9.0.0 (#4207)
• bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#4206)
• bump the golang-modules group with 2 updates (#4205)
• bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#4203)
• bump golang.org/x/text from 0.35.0 to 0.36.0 in the golang-modules group (#4202)
• bump golang.org/x/sys from 0.42.0 to 0.43.0 in the golang-modules group (#4201)
• bump github.com/valyala/fasthttp from 1.69.0 to 1.70.0 in the fasthttp-modules group across 1 directory (#4197)
• bump lewagon/wait-on-check-action from 1.6.0 to 1.6.1 (#4198)
• bump streetsidesoftware/cspell-action from 8.3.0 to 8.4.0 (#4188)
• bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 (#4174)
• bump benchmark-action/github-action-benchmark from 1.21.0 to 1.22.0 (#4172)
• bump actions/setup-go from 6.3.0 to 6.4.0 (#4170)
• bump lewagon/wait-on-check-action from 1.5.0 to 1.6.0 (#4171)
• bump github/codeql-action from 4.35.0 to 4.35.1 (#4169)
• bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 (#4165)
• bump codecov/codecov-action from 5.5.3 to 6.0.0 (#4166)
• bump github/codeql-action from 4.34.1 to 4.35.0 (#4164)
• bump DavidAnson/markdownlint-cli2-action from 22.0.0 to 23.0.0 (#4161)
• bump github.com/klauspost/compress from 1.18.4 to 1.18.5 (#4158)
• bump github/codeql-action from 4.34.0 to 4.34.1 (#4159)
• bump github/codeql-action from 4.33.0 to 4.34.0 (#4156)
• bump codecov/codecov-action from 5.5.2 to 5.5.3 (#4153)
• bump release-drafter/release-drafter from 7.1.0 to 7.1.1 (#4152)
• bump actions/cache from 5.0.3 to 5.0.4 (#4151)
• bump release-drafter/release-drafter from 7.0.0 to 7.1.0 (#4147)
• bump release-drafter/release-drafter from 6.4.0 to 7.0.0 (#4142)
• bump github/codeql-action from 4.32.6 to 4.33.0 (#4141)
• bump the golang-modules group with 3 updates (#4138)
• bump golang.org/x/sys from 0.41.0 to 0.42.0 in the golang-modules group (#4136)
• bump release-drafter/release-drafter from 6.3.0 to 6.4.0 (#4137)
• bump github/codeql-action from 4.32.5 to 4.32.6 (#4131)
• bump release-drafter/release-drafter from 6.2.0 to 6.3.0 (#4130)
• bump actions/setup-node from 6.2.0 to 6.3.0 (#4129)
• bump benchmark-action/github-action-benchmark from 1.20.7 to 1.21.0 (#4126)
• bump github/codeql-action from 4.32.4 to 4.32.5 (#4123)

Documentation

• Key Value Expectation Notice (KeyAuth Middleware) (#4183)
• Document array query parameter formats for Query binder (#4116)
• 📒 Documentation: https://docs.gofiber.io/next/
• 💬 Discord: https://gofiber.io/discord
• Full Changelog: v3.1.0...v3.2.0
• Thank you @JonasDoe, @ReneWerner87, @adrian-lin-1-0-0, @aviu16, @gaby, @ha-sante, @loderunner, @meruiden, @mutantkeyboard and @sixcolors for making this release possible.

Original source

🚀 New

expand middleware context helpers (#4079)

app := fiber.New(fiber.Config{
PassLocalsToContext: true, // default: false
})
// Works for requestid, csrf, session, basicauth, keyauth middlewares
app.Use(requestid.New())
app.Get("/", func(ctx fiber.Ctx) error {
// Value helpers from middlewares works now with 3 different context items
id := requestid.FromContext(ctx) // works always
id := requestid.FromContext(ctx.RequestCtx()) // works always
id := requestid.FromContext(ctx.Context()) // works only when `PassLocalsToContext` is true
return c.SendString(id)
})

https://docs.gofiber.io/api/fiber/#passlocalstocontext

🧹 Updates

update utils and add go 1.26 for test workflow (#4087)

optimize helpers performance (#4049)

harden numeric constraint parsing and expand route tests (#4054)

🐛 Fixes

harden DefaultRes.Format against nil handler panics (#4105)

guard nil request in adaptor LocalContextFromHTTPRequest (#4097)

fix Unix-socket support in IsProxyTrusted (#4088)

harden proxy nil client handling in Do/Forward paths (#4083)

add nil-safety to response decode helpers (#4081)

sanitize attachment/download filenames (#4070)

harden flash cookie detection (#4078)

fix bind struct validation only for struct targets (#4082)

enforce Range header limit configuration (#4071)

apply limits to msgp serialization (#4065)

fix sanitizePath validation logic (#4064)

fix Test method returning empty response on timeout (#4063)

fix nil pointer dereference in context methods when accessed after release (#4062)

retry addon: remove unnecessary sleep after last failed attempt (#4060)

make TLS listener config discovery safer (#4055)

validate nil services early and during lifecycle (#4050)

skip non-string state keys during iteration (#4048)

harden Port() handling (#4051)

prevent panics on non-string log keys (#4046)

🛠️ Maintenance

bump streetsidesoftware/cspell-action from 8.2.0 to 8.3.0 (#4111)

bump the golang-modules group with 3 updates (#4080)

bump github.com/shamaton/msgpack/v3 from 3.0.0 to 3.1.0 (#4075)

bump github.com/klauspost/compress from 1.18.3 to 1.18.4 (#4076)

bump github.com/gofiber/schema from 1.6.0 to 1.7.0 (#4074)

bump golang.org/x/sys from 0.40.0 to 0.41.0 in the golang-modules group (#4073)

bump github/codeql-action from 4.32.3 to 4.32.4 (#4104)

bump github/codeql-action from 4.32.1 to 4.32.2 (#4058)

bump github/codeql-action from 4.32.0 to 4.32.1 (#4047)

📚 Documentation

update versioned storage imports in middleware docs (#4102)

update documentation for parser configuration and request handling (#4096)

fix invalid Go slice literal in middleware registration example (#4095)

document uri struct tag for ctx.Bind().URI() in migration guide (#4092)

document logger Stream rename (#4057)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.0.0...v3.1.0

Thank you @ReneWerner87, @SadikSunbul, @gaby and @sixcolors for making this release possible.

Original source

For a detailed view of all changes and the migration guide, visit:

https://docs.gofiber.io/whats_new

Try our new migration tool to help you upgrade from v2 to v3:

go install github.com/gofiber/cli/fiber@latest
fiber migrate --to v3

What's Changed

🚀 New Features

🚀 App (Docs)

Rename WithTlsConfig method to WithTLSConfig in (#2570)

Use any as default Message type of Error struct in (#1925)

Add support for custom constraints in (#2807)

Add support for trusted origins in (#2910)

Add DialDualStack option for upstream IPv6 support in (#2900)

TrustedOrigins using https://*.example.com style subdomains in (#2925)

Add configuration support to c.SendFile() in (#3017)

Add CHIPS support to Cookie in (#3047)

Add TestConfig to app.Test() for configurable testing in (#3161)

Add buffered streaming support in (#3131)

Add support for AutoTLS / ACME in (#3201)

Add support for configuring TLS Min Version in (#3248)

Fix square bracket notation in Multipart FormData in (#3235)

Add support for application state management in (#3360)

Add support for NewErrorf in (#3463)

Add UNIX socket support in (#3535)

Add support for Msgpack in (#3565)

Add default UTF-8 charset in (#3583)

Support for SendEarlyHints in (#3483)

Add conditional copy helpers in (#3703)

Add request inspection helpers in (#3727)

Add support for redacting values in (#3759)

Add support for handling unsupported HTTP methods as HTTP 501 in (#3854)

Add support for ReloadViews() in (#3876)

Expose startup message customization hooks in (#3824)

Migrate from UUIDv4 to SecureToken for key generation in (#3946)

Add ExpirationFunc for dynamic expiration in (#3984)

Auto-enforce Secure=true for Partitioned cookies in Cookie() in (#3976)

📎 Binding (Docs)

Initial support for binding in (#1981)

Bind: add support for multipart file binding in (#3309)

Add All method to Bind in (#3373)

🌎 Client (Docs)

Client refactor in (#1986)

Add support for creating Fiber client from existing FastHTTP client in (#3214)

Add support for iterator methods to Fiber client in (#3228)

Add support for HostClient and LBClient in (#3774)

Add support for streaming response bodies in client and response handling in (#4014)

🧠 Context (Docs)

Convert fiber.Ctx type to interface in (#1928)

Add Drop method to DefaultCtx for silent connection termination in (#3257)

Add End() method to Ctx in (#3280)

Improve and Optimize ShutdownWithContext Func in (#3162)

Add support for context.Context in keyauth middleware in (#3287)

Fiber.Context implement context.Context in (#3382)

Add NewWithCustomCtx initialization helper in (#3476)

Add context methods to fiber.Storage interface in (#3566)

Add Fiber Context to BasicAuth Authorizer in (#3621)

Implement OverrideParam override behavior for DefaultCtx in (#3962)

Add context common request helpers in (#4007)

Adding GetReqHeaders and GetRespHeaders in (#2831)

Add Req and Res API in (#2894)

🔬 Extractors (Docs)

Introduce Extractor pattern for session ID retrieval in (#3625)

Enhance extractor functionality with metadata and security validation in (#3630)

Add extractors package in (#3725)

🧰 Generic (Docs)

Add QueryParser for get query using generic in (#2776)

Addition of Locals Function with Go Generics as an Alternative to c.Locals in (#2813)

Implement new generic functions: Params, Get and Convert in (#2850)

Support generic configurable logger in (#3705)

🚀 Listen (Docs)

Merge Listen methods & ListenConfig in (#1930)

Add support for graceful shutdown timeout in ListenConfig in (#3220)

Add TLSConfig to ListenConfig in (#4024)

🔌 Addons/retry (Docs)

Add retry mechanism in (#1972)

🧬 Middleware – adaptor (Docs)

Add BodyStream() logic to adaptor.FiberHandler middleware in (#3799)

Add local context support to adaptor middleware in (#3975)

🧬 Middleware – basicauth (Docs)

Add HeaderLimit option to BasicAuth middleware in (#3620)

Support hashed BasicAuth passwords in (#3631)

🧬 Middleware – cache (Docs)

Add Cache Invalidation Option to Cache Middleware in (#3036)

Add Max Func to Limiter Middleware in (#3070)

Support for disabling response headers in Limiter Middleware in (#3618)

🧬 Middleware – compression (Docs)

Add support for zstd compression in (#3041)

Add support for CBOR encoding in (#3173)

🧬 Middleware – cors (Docs)

Add support for Access-Control-Allow-Private-Network in (#2908)

🧬 Middleware – csrf (Docs)

Add support for Sec-Fetch-Site header in CSRF middleware in (#3913)

🧬 Middleware – encryptcookie (Docs)

Add cookie name authentication for EncryptCookie middleware in (#3788)

🧬 Middleware – favicon (Docs)

Add MaxBytes to favicon middleware in (#4016)

🧬 Middleware – earlydata (Docs)

Add earlydata middleware in (#2270)

🧬 Middleware – healthcheck (Docs)

Migrate HealthChecker to v3 in (#2884)

Add Startup Probe to Healthcheck Middleware in (#3069)

🧬 Middleware – idempotency (Docs)

Add idempotency middleware in (#2253)

🧬 Middleware – keyauth (Docs)

Add support for custom KeyLookup functions in the Keyauth middleware in (#3028)

🧬 Middleware – logger (Docs)

Refactor logger middleware in (#1979)

Add AllLogger to Config in (#3153)

Add Skip function to logger middleware in (#3333)

Add predefined log formats in (#3359)

Add support for ForceColors in Logger middleware in (#3428)

🧬 Middleware – proxy (Docs)

Add support for TrustProxy in (#3170)

Add KeepConnectionHeader option to Proxy middleware in (#3662)

🧬 Middleware – requestid (Docs)

Add Context Support to RequestID Middleware in (#3200)

Validate HTTP headers in RequestID middleware in (#3919)

🧬 Middleware – responsetime (Docs)

Add response time middleware in (#3891)

🧬 Middleware – session (Docs)

Re-write session middleware with handler in (#3016)

Add support for Keys() in session middleware in (#3517)

🧬 Middleware – static (Docs)

Add static middleware in (#3006)

🧬 Middleware – timeout (Docs)

Add config for Timeout middleware in (#3604)

🔄️ Redirect (Docs)

New redirection methods in (#2014)

🗺️ Router (Docs)

Router interface changes in (#2176)

Native support for net/http and fasthttp handlers in (#3769)

New Route method in (#2065)

New mounting system in (#2022)

Add support for RebuildTree in (#3074)

Add support for Express.js style req/res handlers in (#3809)

Add support for DisableAutoRegister of HEAD routes in (#3817)

Enhance CheckConstraint method for improved error handling in (#3356)

Add Support for Removing Routes in (#3230)

Add support for embedded Koa-Style Req and Res structs in (#3533)

Support Express-style next callback handlers in (#4029)

🧩 Services (Docs)

Add Support for service dependencies in (#3434)

🧹 Updates

⚙️ Core & API

Replace string functions in (#3923)

Update conditional instructions for startup skip in (#3475)

Update AGENTS startup instructions in (#3474)

Add []byte support to utils.EqualFold in (#2029)

Change startup message in (#2041)

Update to use gofiber/utils/v2 in (#2184)

Router: return status 501 instead of 400 on unknown method in (#2220)

Cleanup in (#2255)

Fix ContextKey collisions in (#2781)

Update Ctx.Format to match Express's res.format in (#2766)

Update handler signature for v3 in (#2794)

Change interface{} to any in (#2796)

Added respects body immutability to ctx.Body() and ctx.BodyRaw() functions. in (#2812)

Print to stderr if log fails for default format in (#2830)

Clean up errcheck config in (#2841)

Update startup message formatting in (#2847)

Simplify content negotiation code in (#2865)

Rename "ClientNew" Function to "New" in (#2896)

Remove repetitive words in (#2917)

Improper query/body parsing with embedded structs in (#2906)

Improve and simplify logic of ctx.Next() in (#3063)

Use Named Fields Instead of Positional and Align Structures to Reduce Memory Usage in (#3079)

Use utils Trim functions instead of the strings/bytes functions in (#3087)

Consolidate Logic of Handling the Request Body in (#3093)

Use msgp for flash message encoding/decoding in (#3099)

Replace vendored gorilla/schema package in (#3152)

Improve naming convention for Context returning functions in (#3193)

Nil pointer dereference with Must Bind binding in (#3171)

Mark go1.23 as minimum go version in (#3226)

Rename the Method Names of FormData and FormDatas (#3251) in (#3255)

Reduce the Memory Usage of ignoreHeaders in (#3322)

Migrate randString to rand v2 in (#3329)

Sorting error in sortAcceptedTypes in (#3331)

Reduce the memory usage of RoutePatternMatch in (#3335)

Replace findLastCharsetPosition with strings.LastIndexByte in (#3338)

Replace isInCharset with bytes.IndexByte in (#3342)

Remove two string fields in DefaultCtx to save 32 bytes in (#3353)

Replace treePath with treePathHash in DefaultCtx to reduce memory usage in (#3368)

Remove redundant field method in DefaultCtx in (#3372)

Add findNextNonEscapedCharPosition for single-byte charset cases in (#3378)

Change c.Redirect() default status in (#3415)

Improve routing treeBuild flow in (#3456)

Make genericParseType return error in (#3473)

Update minimum go version to 1.24 in (#3481)

Use slices.Contains to simplify code in (#3486)

Use maps.Copy to simplify code in (#3490)

Update loop syntax for retry mechanism in (#3516)

Update codecov configuration in (#3528)

Use GetState to reduce duplicate code in (#3542)

Improve Cookie() validation in (#3546)

Improve Accept* compliance with RFC 9110 in (#3548)

Refactor fasthttp iter calls to range loops in (#3559)

Add iterator helpers for client types in (#3560)

Update utils dependency in (#3576)

Refactor Opt-in support for CBOR in (#3580)

Simplify generic function calls in (#3578)

Replace math/rand with crypto/rand in (#3508)

Add sync pool and release helpers for Bind in (#3660)

Add CBOR support to AutoFormat() in (#3665)

Fix AcceptsLanguages() RFC compliance in (#3672)

Respect immutable config in Params(), Protocol(), and Body() in (#3676)

Delay routing error creation in (#3683)

Using reflect.TypeAssert in (#3698)

Handle Transfer-Encoding bodies in HasBody in (#3748)

Improve error handling when using storage drivers in (#3754)

Use sync.Pool for Client hooks in (#3758)

Avoid locking in gc() if nothing to delete in (#3765)

Cleanup return error logic in Bind() in (#3764)

Update RouteChain function in (#3761)

Make boundary a const in (#3783)

Preallocate slice size in Client::Param() in (#3782)

Skip locking garbage collector if nothing to delete in (#3787)

Enhance Body handling in setConfigToRequest for better type su… in (#3820)

Improve propagation of context.Context in (#3822)

Inline Request state wrappers in (#3827)

Remove unneeded "utils" alias in (#3834)

Add FullPath() helper to context in (#3837)

Handle nil map targets in Binder in (#3839)

Extracted generic releasePooledBinder function in (#3841)

Return error during EncryptCookie failure in (#3842)

Fix gocritic httpNoBody and hugeParam issues in (#3855)

Refactor internal errors to use sentinel values in (#3864)

Improve byte-range handling for SendFile() in (#3870)

Use int64 when dealing with HTTP Ranges in (#3874)

Replace strings.TrimSpace with utils.TrimSpace in (#3918)

Replace strings.Index with strings.Cut for improved readallity in (#3956)

Validate constraint by bit operation in (#3963)

Use sync.Pool for form and multipart binding in (#3967)

Use sync.Pool for redirect old input map in (#3971)

Replace anonymous struct key with named type in (#4020)

🧬 Middleware & Addons

Document "null" origin handling in CORS middleware in (#4001)

(Docs)

Refactor CSRF middleware and enhance documentation in (#3598)

Fix pprof middleware docs and default config in (#3642)

Fix CORS docs and comments in (#3637)

Fix CSRF error message mismatch with documentation in (#3636)

Refactor filesystem middleware with io/fs in (#2027) (Docs)

Remove mutex lock in logger middleware in (#2840)

Update CSRF and Limiter to remove repetitive names in (#2846)

Refactor(middleware/cors): Config, lists as list types. in (#2962)

Enforce key length for EncryptCookie middleware default functions in (#3056)

Middleware/CORS Remove Scheme Restriction in (#3163)

Unify and enhance timeout middleware in (#3275)

Simplify HealthCheck middleware in (#3380)

Improve proxy middleware in (#3468)

Enhance KeyAuth middleware to better comply with RFC 6750 in (#3482)

Enhance BasicAuth middleware to better comply with RFC 6750 in (#3484)

Improve cache middleware RFC compliance in (#3488)

Enhance config validation in EncryptCookie middleware in (#3491)

Refactor EnvVar middleware in (#3513)

Improve CORS middleware response headers in (#3505)

Improve BasicAuth middleware default security in (#3522)

Improve static middleware security in (#3595)

Remove SHA-1/MD5 support in BasicAuth middleware in (#3634)

Remove support for PasswordFromContext from BasicAuth middleware in (#3638)

Refactor KeyAuth Middleware: Extractor-Based Configuration and Enhanced Flexibility in (#3685)

Return generic errors in KeyAuth middleware in (#3692)

Fix CSRF subdomain wildcard boundary in (#3694)

Improve Cache middleware defaults in (#3740)

Migrate Session middleware to new extractors package in (#3744)

Improve Compress middleware RFC compliance in (#3745)

Improve KeyAuth middleware RFC compliance in (#3742)

Update CSRF middleware to use shared extractors in (#3746)

Update keyauth middleware to use shared extractors in (#3747)

Fix cache cleanup and redact token values in (#3757)

Ensure middleware prefix matching requires slash boundary in (#3755)

Reduce the memory usage of cacheableStatusCodes in (#3789)

Refactor configuration management for favicon and envvar middlewares in (#3898)

Improve Cache middleware compliance in (#3973)

Further improvements to Cache middleware in (#3989)

Skip caching oversized responses in idempotency middleware in (#4018)

⚡️ Performance & Benchmarks

Optimize the menu item text in (#3267)

Remove utils.Trim* because stdlib has same performance in go1.19 in (#2030)

Performance improvements in (#2838)

Add parallel benchmarks to adaptor middleware in (#2870)

Expand Tests and Benchmarks for Log package in (#2886)

Performance optimizations in (#2947)

Add Benchmarks for IsProxyTrusted() in (#2933)

Optimize Cache middleware handler in (#3031)

Update benchmarks for Logger Middleware in (#3061)

Improve performance of Adaptor Middleware in (#3078)

Refactor Benchmark Results Workflow in (#3082)

Improve performance of helper functions in (#3086)

Improve Performance of c.Body() by 125% in (#3090)

Add Benchmarks for Rewrite Middleware in (#3092)

Optimize IsFromLocal() performance in (#3140)

Improve Performance of Fiber Router in (#3261)

Improve Performance of getSplicedStrList in (#3318)

Optimize routeParser by using sync.Pool in (#3343)

Add Immutable benchmarks for default case in (#3374)

Performance optimizations in (#3477)

Improve performance for "equalFieldType" function in (#3479)

Fix compression benchmarks in (#3561)

Improve iterator performance. in (#3562)

Improve sanitizePath performance in (#3601)

Skip unstable GenericParseType benchmarks in (#3614)

Reduce allocation in AutoFormat in (#3652)

Optimize Fresh header parsing for fasthttp 1.65 in (#3687)

Improve Req/Res Benchmarks in (#3693)

Improve performance analyseConstantPart in (#3753)

Improve allocations for Request Params() in (#3766)

Reduce allocations in Request (saves ~16% B/op) in (#3768)

Benchmark for cache miss case in (#3836)

Improve performance of RebuildTree() by 68% in (#3895)

Optimize string handling and memory allocations in (#3922)

Improve performance (reduce allocations) in (#3964)

🛠️ Testing & Tooling

Use testify for assertion in (#2036)

Generate msgp tests in (#2263)

V3 Feature: Make app.Test accept a time.Duration timeout in (#2269)

Speed up addon/retry tests in (#2800)

Re-enable tparallel linter in (#2801)

Fix testifylint errors in middleware in (#2805)

Fix remaining testifylint errors in (#2806)

Fix force type assertions in session_test.go in (#2815)

Address multiple lint rules in (#2869)

Do not retry flaky tests in (#2875)

Enabling shuffling, cleanup and consistency across tests in (#2931)

Adding a generator to generate the CTX interface in (#3024)

Test(middleware/session): Remove extra release and acquire ctx calls in session_test.go in (#3044)

Test(ctx_test): Fix race condition in (#3081)

The value of map is unused in uniqueRouteStack in (#3320)

Mark unused tests with t.SkipNow in (#3366)

Fix proxy middleware tests for offline environments in (#3467)

Add unit-test for header injection in (#3470)

Add URI Test case for Test_Ctx_Binders in (#3480)

Test: Enhance CSRF tests to address unsafe header value issue (#2045) in (#3485)

Improve EarlyData middleware tests coverage in (#3520)

Improve Idempotency middleware tests coverage in (#3521)

Improve Helmet middleware tests coverage in (#3523)

Improve Retry addon tests coverage in (#3526)

Add missing CSRF token extractor tests in (#3527)

Improve hooks test coverage in (#3524)

Improve Binder tests coverage in (#3529)

Improve CORS tests coverage in (#3530)

Improve CSRF tests coverage in (#3531)

Improve Router tests coverage in (#3550)

Add tests for quoteRawString in (#3613)

Fix Makefile to install tools before running them in (#3612)

Fix Cookie SameSite constants to Pascal case per RFC specification in (#3608)

Fix timing for streaming test in (#3628)

Add missing checks in Ctx tests in (#3670)

Stabilize interrupted stream writer test in (#3669)

Use ephemeral ports in unit tests in (#3686)

Use project toolchain for go run tools in (#3709)

Expand Binder tests coverage in (#3714)

Prevent CopyContextToFiberContext panic and add comprehensive test coverage in (#3770)

Add flushing-related unit tests for net/http adaptor in (#3807)

Fix fatal error calls in adapter_test.go in (#3810)

Test HEAD request compliance in (#3868)

Improve OPTIONS wildcard regression test in (#3869)

Add table-driven integration tests in (#3894)

Improve timing robustness in flaky cache and session tests in (#3994)

🐛 Bug Fixes

Fix logger benchmarks in (#2074)

Fix benchmark results related to handler, next in (#2130)

Testifylint failure that fell through the cracks in (#2821)

Inconsistent and flaky unit-tests in (#2892)

CORS handling in (#2938)

Fix some struct names in comments in (#2974)

Fixes #3038 "v3 Flash Message with redirect is not working" in (#3046)

Mutex for thread safety in (#3049)

Fix data-race with sync.Pool in (#3051)

Fasthttp errors cause panic when Params is used in (#3055)

Use Content-Length for bytesReceived and bytesSent tags in Logger Middleware in (#3066)

Cache middleware: runtime error: "index out of range [0] with length 0" in (#3075)

Error check in Form binder in (#3110)

Client: fix SetProxyURL functionality in (#3109)

Fix handle un-matched open brackets in the query params in (#3126)

Fix issue with default logger when creating RequestCtx in (#3134)

Fix typo in (#3145)

Behavior of DefaultCtx.Fresh when 'Last-Modified' and 'If-Modified-Since' are equal in (#3150)

Adaptor middleware duplicates cookies in (#3151)

Close File After SaveFileToStorage in (#3197)

Make SetValWithStruct set zero values and support more types #3167 in (#3227)

Fix EnableSplittingOnParsers is not functional in (#3231)

Memory leak removal in the idempotency middleware in (#3263)

Make Render bind parameter type any again in (#3270)

Fix app.Test() auto-failing when a connection is closed early in (#3279)

Align cache middleware with RFC7231 in (#3283)

Goroutine leakage in (#3306)

GenericParseType parsing large uint leads to overflow in (#3315)

Fix handler order in routing in (#3321)

Update binder in form_test in (#3336)

Fix client iterators when using break statement in (#3357)

Fix: Logger Middleware tests to use regex for time validation in (#3392)

Handling of next param position in (#3418)

Fix redirection flash messages violate cookie structure in (#3457)

Fix AGENTS markdown lint in (#3460)

Parsing of IPv6 addresses in (#3466)

Middlewares immutable config handling in (#3494)

Subdomains offset handling in (#3495)

Fix Cache-Control header parsing in (#3534)

Fix Content-Type comparison in Is() in (#3536)

Fix Subdomains() parsing for IDNs in (#3538)

Fix Range() parsing of bytes unit in (#3541)

Fix Etag validation per RFC 9110 in (#3554)

Fix Range() handling of HTTP 416 per RFC 9110 in (#3552)

Fix Accept-Language matching per RFC 4647 in (#3553)

Fix Cache middleware handling of Age in (#3547)

Fix Content-Disposition header per RFC 6266 in (#3551)

Fix Body() handling of Content-Encoding per RFC 9110 in (#3543)

Fix multipart boundary for Client per RFC 2046 in (#3563)

Fix address parsing for leading/trailing spaces in (#3569)

Fix missing Allow header in EnvVar middleware per RFC 9110 in (#3570)

Fix static/favicon middlewares file descriptor leaks in (#3579)

Fix CookieJar domain logic in (#3564)

Fix handling of negative BodyLimit in (#3599)

Fix MIME type equality checks in (#3602)

Fix retry config handling in (#3609)

Fix limiter middleware not counting fiber.NewErrorf responses as failed requests in (#3623)

Fix race in cookie tests in (#3629)

Fix bind All() merging logic in (#3659)

Fix Static middleware browser support for subdirectories in (#3673)

Fix CORS subdomain wildcard boundary in (#3690)

Fix support for context.Context in (#3720)

Improve BasicAuth middleware RFC compliance in (#3743)

Handle Unix sockets in adaptor middleware in (#3760)

Fix usage of runtime RO data for ppc64 and s390x platforms in (#3772)

Respect DisablePathNormalizing during client requests in (#3773)

Always close form file in (#3786)

Fix recover middleware panic output formatting in (#3816)

Correct fresh flag logic in getSession in (#3825)

Prevent memory corruption in internal memory storage from pooled buffers in (#3828)

Avoid writing into released Response in core::execFunc() in (#3830)

Remove Flash Cookie from Response headers after parsing in (#3840)

Fix binder splitting for pointer-backed slice fields in (#3844)

Fix typos in some files in (#3847)

Execute middleware routes when handling errors in (#3846)

Fix copying of key/values in internal/memory in (#3829)

Fix maintain CustomCtx across middlewares in (#3852)

Fix default value for MaxFunc in Limiter middleware in (#3871)

Fix handling of wildcard matching in acceptsOffer in (#3880)

Fix handling of no-body HTTP statuses in (#3883)

Fix and improvements for the sliding window Limiter in (#3893)

Improve suffix range normalization in (#3902)

Enhance Origin and Referer Validation in CSRF middleware in (#3904)

Respect Authorization when caching responses in (#3905)

Fprint to use format instead of fmtArgs in (#3925)

Enforce body limits in SaveFileToStorage in (#3929)

V3 fix custom errorhandler invokation in (#3930)

Fix example in whats_new.md in (#3949)

Ensure flash messages are consumed after retrieval in (#3936)

Fix FIPS-140 compliance for EncryptCookie middleware in (#3955)

Guard Binds decoder sync.Pool in (#3969)

Fix Early-Data trusted proxy handling in (#3974)

Preserve session data map across resets in (#3968)

Improve cookie decryption handling by deleting invalid cookies after iteration in (#3988)

Respect body limit configuration in adaptor middleware in (#3990)

Security: Enforce case-sensitive null origin validation in CORS in (#3995)

Optimize CORS origin validation to avoid unnecessary processing in (#3996)

Validate CORS origins before using AllowOriginsFunc in (#3991)

Trim forwarded host values in (#4012)

Normalize forwarded scheme parsing in (#4011)

Return immediately on timeout and propagate context correctly in (#4009)

Trim values from getSplicedStrList in (#4026)

Return bytes read from readContent in (#4027)

Reload mounted view engines in ReloadViews in (#4031)

Handle typed-nil http handler funcs in (#4030)

🛠️ Maintenance

Bump github.com/valyala/fasthttp from 1.51.0 to 1.69.0 in (#2857, #3000, #3037, #3146, #3183, #3244, #3314, #3391, #3440, #3557, #3586, #3684, #3790, #3819, #3992)

Updated fasthttp to 1.54.0 release in (#3010)

Bump github.com/gofiber/schema from 1.2.0 to 1.6.0 in (#3308, #3462, #3504, #3574)

Bump github.com/gofiber/utils/v2 from 2.0.0-beta.3 to 2.0.0-rc.6 in (#2935, #3062, #3174, #3389, #3540, #3568, #3689, #3853, #3914, #3926, #3997)

Bump github.com/tinylib/msgp from 1.1.8 to 1.6.3 in (#3147, #3182, #3185, #3240, #3447, #3716, #3823, #3920, #3977, #3978)

Bump github.com/shamaton/msgpack/v2 from 2.2.3 to 2.4.0 in (#3678, #3719, #3808)

Bump github.com/klauspost/compress from 1.18.1 to 1.18.3 in (#3911, #4013)

Bump github.com/google/uuid from 1.5.0 to 1.6.0 in (#2810)

Bump golang.org/x/crypto from 0.28.0 to 0.45.0 in (#3243, #3247, #3274, #3305, #3327, #3341, #3395, #3438, #3506, #3737, #3796, #3863, #3882)

Bump golang.org/x/net from 0.31.0 to 0.47.0 in (#3293, #3544, #3572, #3738, #3791, #3795, #3861)

Bump golang.org/x/text from 0.29.0 to 0.33.0 in (#3797, #4003)

Bump golang.org/x/sys from 0.39.0 to 0.40.0 in the golang-modules group in (#4000)

Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 in (#3277)

Bump github.com/fxamacker/cbor/v2 from 2.7.0 to 2.9.0 in (#3384, #3581)

Upgrade shamaton/msgpack from v2.4.0 to v3.0.0 in (#4023)

Bump minimum version of Go to 1.21 in (#2911)

Bump golangci-lint from v1.56.1 to v1.62.0 in (#2842, #2862, #3029, #3119, #3135, #3196)

Make golangci-lint config stricter in (#2874)

Add support for longtests during CI in (#3054)

Bump nick-fields/retry from 2 to 3 in (#2824)

Bump benchmark-action/github-action-benchmark from 1.16.2 to 1.20.7 in (#2827, #2950, #3008, #3177, #3730, #3736)

Bump release-drafter/release-drafter from 5 to 6.2.0 in (#2826, #4022, #4025)

Bump golangci/golangci-lint-action from 3 to 9.2.0 in (#2855, #2986, #2994, #3896, #3916)

Bump github.com/stretchr/testify from 1.8.4 to 1.11.1 in (#2888, #3217, #3712, #3715)

Bump codecov/codecov-action from 4.0.1 to 5.5.2 in (#2901, #2941, #2959, #2993, #2999, #3009, #3035, #3154, #3207, #3209, #3210, #3213, #3234, #3256, #3292, #3295, #3334, #3413, #3459, #3701, #3734, #3935)

Bump actions/setup-go from 4 to 6.2.0 in (#2789, #3732, #3886, #4006)

Bump github/codeql-action from 2 to 4.32.0 in (#2788, #3792, #3866, #3878, #3897, #3910, #3927, #3945, #3950, #4004, #4034, #4036)

Bump actions/cache from 3 to 5.0.3 in (#2803, #3944, #3947, #4017, #4040)

Bump fuxingloh/multi-labeler from 2 to 4 in (#2856)

Bump DavidAnson/markdownlint-cli2-action from 16 to 22.0.0 in (#3128, #3208, #3266, #3453, #3873, #3932)

Bump streetsidesoftware/cspell-action from 8.0.0 to 8.2.0 in (#3938, #3993, #4039)

Bump kenchan0130/actions-system-info from 1.3.0 to 1.4.0 in (#3492, #3679)

Bump actions/setup-node from 4 to 6.2.0 in (#3733, #3804, #3915, #4008)

Bump actions/checkout from 3 to 6.0.2 in (#3083, #3681, #3877, #3887, #3917, #4028)

Bump lewagon/wait-on-check-action from 1.4.1 to 1.5.0 in (#4033)

Bump the golang-modules group with 4 updates in (#3931)

Bump the golang-modules group with 2 updates in (#4005)

Add go1.22 to test matrix in (#2835)

Replace release-drafter autolabel with fuxingloh/multi-labeler in (#3872)

Add CODEOWNERS file in (#2851)

Update golangci-lint to v1.55.2 in (#2817)

Update golangci-lint to enable more lint rules in (#2923)

Add support for go1.23 and golangci-lint v1.60.1 in (#3101)

Add go1.24 to CI matrix in (#3325)

Add modernize lint in (#3590)

Add inamedparam linter in (#2848)

Remove repo codecov.yml in (#3525)

Enable govet shadow in (#3617)

Fix benchmark results in (#1982)

Fix spelling issues in (#3813)

Golangci-lint issue for go1.25.0 in (#3775)

Require Go 1.25 in (#3682)

Run tests against Apple M1 platform in (#2852)

Update AGENTS.md in (#3901)

📚 Documentation

Update Version Numbers in Docs in (#2853)

Updates to fiberlog benchmarks and documentation in (#3059)

Remove deprecated comments and documenting recent changes in (#3498)

Update godoc for fiber.New() in (#3928)

Undocumented function in session.md in (#2795)

Fix typo in documentation in (#2802)

Fix a misspelled comment in (#2809)

Update Typo documentation in (#2820)

Typo in routing.md in (#2836)

Fix code snippet indentation in /docs/api/middleware/keyauth.md in (#2868)

Fix TrustedProxies documentation related to IP ranges in (#2887)

Update docs to reflect fiber.Ctx struct to interface change in (#2880)

Improve translation in (#2899)

Update Copilot docs and setup in (#3585)

Refactor Documenation for HealthCheck in (#2905)

Fixed a typo in app.go in (#2912)

Cleanup and updates to README files in (#2914)

Fix merge conflict in documentation in (#2957)

Fix broken link to slim template in FAQ in (#2969)

Update config TrustedOrigin comments in (#2963)

Consolidate and Document Core Changes in v3 in (#2934)

Fix some comments in (#2983)

CORS middleware in (#2979)

Add docs for new client in (#2991)

Update intro.md to make clear fiber.Ctx is not thread-safe. in (#3014)

Improve ctx.Locals method description, godoc and example in (#3032)

Add zero-allocation section to README in (#3039)

Add support for consistent documentation using markdownlint in (#3064)

Update example in middleware/cors to v3 in (#3116)

Update recover docs to not use reserved keyword in (#3129)

Fix typos in client hooks documentation in (#3133)

Replaced link to russian mozilla docs in (#3142)

Removed zero width white space from logger docs in (#3144)

Fix typo on comment in (#3158)

Typo in hooks documentation in (#3164)

Update README.md in (#3165)

Update What's New documentation in (#3181)

Clarify SendFile Docs in (#3172)

Update intro documentation in (#3204)

Updates to API documentation and README in (#3205)

Updates to Context documentation in (#3206)

Update documentation for Fiber client in (#3249)

Fix static middleware CacheDuration data type typo in (#3273)

Add ctx.Drop() to whats_new.md in (#3284)

Add c.Drop() example to whats_new.md in (#3285)

Update intro.md Static Files section in (#3303)

Update adapter middleware documentation in (#3317)

Add Retry Addon documentation in (#3330)

Update Helmet Middleware default values in (#3348)

Update helmet.md default values in (#3350)

Add more validation examples in (#3369)

Update docs for State Management in (#3388)

Fix CSRF handler example in (#3412)

Adjust Funding Custom URL in (#3432)

Fix examples in middleware/session in (#3435)

Idempotency add more detailed description for next method in (#3443)

Document usage of Custom Tags in Logger middleware in (#3446)

Fix typos in (#3464)

Fix more typos across code base in (#3465)

Fix typos in code and docs in (#3507)

Enhance CORS middleware documentation with preflight request details and infrastructure considerations in (#3509)

Add custom constraint example in (#3539)

Incorrect usage of backslash characters in the constraint … in (#3549)

Add net/http compatiblity section in (#3556)

Add documentation for Stale() in (#3555)

Update utils guide documentation in (#3575)

Fix EarlyData middleware docs in (#3646)

Fix Skip middleware docs in (#3649)

Fix context changes doc in (#3650)

Fix RequestID docs in (#3648)

Fix Proxy middleware docs in (#3647)

Fix Compress middleware docs in (#3645)

Fix Cache middleware docs in (#3644)

Fix Favicon middleware documentation in (#3640)

Fix Static middleware docs in (#3643)

Fix Healthcheck middleware documentation in (#3657)

Fix KeyAuth middleware docs in (#3641)

Improve Timeout middleware documentation in (#3675)

Add context guide in (#3677)

Add Learning Resources section with Go Interview Practice platform in (#3691)

Fix typos in documentation in (#3695)

Add early hints documentation in (#3697)

Document utils package migration in (#3704)

Note CSRF ContextKey removal in (#3706)

Note removal of context keys in (#3707)

Add migration tool info in (#3708)

Improve wording and fix typos in (#3713)

Full audit of documentation in (#3717)

Add RoutePatternMatch documentation in (#3722)

Clarify context interface implementation in (#3729)

Ensure all exported elements are documented in (#3752)

Document usage of reverse proxies for SendEarlyHints in (#3778)

Fix broken link in the Routing guide in (#3831)

Update docs/whats_new.md in (#3889)

Clarify handler execution order and usage in Add() in (#3890)

Update cache migration guidance in (#3908)

Clarify client migration examples in (#3921)

Add goroutine cancellation example using context.WithTimeout in (#3884)

Fix some comments to improve readability in (#3943)

Update logger middleware format constants in (#3951)

Refresh adaptor middleware guidance in (#3981)

Update Services icon and prefork warning for State Management in (#4002)

Thank you to all contributors:

@ad3n, @akilesh1706, @alequilesl, @alexandear, @Alijeyrad, @aliziyacevik, @andradei, @arturmelanchyk, @asyslinux, @AuroraTea, @axrav, @balcieren, @Behzad-Khokher, @BigJoe17, @brunodmartins, @canks69, @ckoch786, @cuiweixie, @darwin808, @dave-gray101, @deferdeter, @devhaozi, @devhsoj, @Dishank-Sen, @dockercui, @dojutsu-user, @dozheiny, @dreamscached, @duhnnie, @edvardsanta, @efectn, @emirhansirkeci, @ErfanMomeniii, @Fenny, @findfluctuate, @gaby, @gandaldf, @glensargent, @gopkg-dev, @gozeloglu, @grivera64, @guerzon, @haikalSusanto, @haochunchang, @hcancelik, @hotrungnhan, @hungthai1401, @imsk17, @ItsMeSamey, @JIeJaitt, @jsoref, @K0ng2, @KatzuYoru, @khanhkhanhlele, @kianmeng, @kirankumar-grootan, @kiuber, @KrisCarr, @ksw2000, @ktat, @LaptopCat, @Larinax999, @Lars-Schumann, @laughing-nerd, @leonklingele, @linogomez, @luk3skyw4lker, @mazyaryousefinia, @mdelapenya, @mitulagr2, @miyamo2, @MonkyMars, @negrel, @nexovec, @nickajacks1, @nnnkkk7, @oktayozkan0, @omaskery, @omer-cengel, @orvillesimba, @pjebs, @rabarar, @racerole, @ReneWerner87, @RezaSi, @ryanbekhen, @s19835, @SantiagoBobrik, @sebytza23, @shamaton, @sigmundxia, @SivaPA08, @sixcolors, @StrawHatHacker, @sunnyyssh, @techerfan, @the-hotmann, @TheAspectDev, @theleeeo, @tongjicoder, @trim21, @vhespanha, @wangjq4214, @xEricL, @yinheli, @yorickdewid, @ZihxS, @zingi

Full Changelog: v2.52.11...v3.0.0

For a detailed view of all changes and the migration guide, visit:

https://docs.gofiber.io/whats_new

Original source

🚀 New Features

• Middleware/encryptCookie: Add cookie name authentication for EncryptCookie middleware by @gaby in #3788
• Middleware/proxy: Add BodyStream() logic to adaptor.FiberHandler middleware by @grivera64 in #3799
• Client: Add support for HostClient and LBClient by @gaby in #3774
• Native support for net/http and fasthttp handlers by @gaby in #3769
• Add support for Express.js style req/res handlers by @gaby in #3809
• Add support for DisableAutoRegister of HEAD routes by @ReneWerner87 in #3817
• Add support for handling unsupported HTTP methods as HTTP 501 by @gaby in #3854
• Add support for ReloadViews() by @gaby in #3876
• Expose startup message customization hooks by @efectn in #3824

🧹 Updates

• Middleware/adaptor: prevent CopyContextToFiberContext panic and add comprehensive test coverage by @sixcolors in #3770
• Middleware/adaptor: Add flushing-related unit tests for net/http adaptor by @grivera64 in #3807
• Middleware/encryptCookie: Return error during EncryptCookie failure by @gaby in #3842
• Client: Preallocate slice size in Client::Param() by @arturmelanchyk in #3782
• Reduce allocations in Request (saves ~16% B/op) by @arturmelanchyk in #3768
• Make boundary a const by @arturmelanchyk in #3783
• Skip locking garbage collector if nothing to delete by @arturmelanchyk in #3787
• Reduce the memory usage of cacheableStatusCodes by @ZihxS in #3789
• Merge duplicate constants by @jsoref in #3812
• Improve propagation of context.Context by @gaby in #3822
• Inline Request state wrappers by @arturmelanchyk in #3827
• Remove unneeded "utils" alias by @arturmelanchyk in #3834
• Benchmark for cache miss case by @arturmelanchyk in #3836
• Add FullPath() helper to context by @gaby in #3837
• Handle nil map targets in Binder by @gaby in #3839
• Extracted generic releasePooledBinder function by @arturmelanchyk in #3841
• Refactor internal errors to use sentinel values by @gaby in #3864
• Test HEAD request compliance by @gaby in #3868
• Improve OPTIONS wildcard regression test by @gaby in #3869
• Improve byte-range handling for SendFile() by @gaby in #3870
• Use int64 when dealing with HTTP Ranges by @gaby in #3874

🐛 Bug Fixes

• Middleware/limiter: Fix default value for MaxFunc in Limiter middleware by @gaby in #3871
• Middleware/recover: Fix recover middleware panic output formatting by @gaby in #3816
• Middleware/session: correct fresh flag logic in getSession by @sixcolors in #3825
• Fix spelling issues by @jsoref in #3813
• Fix fatal error calls in adapter_test.go by @ReneWerner87 in #3810
• Fix usage of runtime RO data for ppc64 and s390x platforms by @gaby in #3772
• Respect DisablePathNormalizing during client requests by @gaby in #3773
• Always close form file by @arturmelanchyk in #3786
• Fix gocritic httpNoBody and hugeParam issues by @ReneWerner87 in #3855
• Prevent memory corruption in internal memory storage from pooled buffers by @sixcolors in #3828
• Avoid writing into released Response in core::execFunc() by @arturmelanchyk in #3830
• Remove Flash Cookie from Response headers after parsing by @gaby in #3840
• Fix binder splitting for pointer-backed slice fields by @gaby in #3844
• Execute middleware routes when handling errors by @gaby in #3846
• fix copying of key/values in internal/memory by @sixcolors in #3829
• Fix maintain CustomCtx across middlewares by @ReneWerner87 in #3852
• Enhance Body handling in setConfigToRequest for better type su… by @K0ng2 in #3820

🛠️ Maintenance

• Replace release-drafter autolabel with fuxingloh/multi-labeler by @gaby in #3872
• Golangci-lint issue for go1.25.0 by @laughing-nerd in #3775
• Add automation for v3 label assignments by @ReneWerner87 in #3845
• Update workflow path filters for Go module changes by @ReneWerner87 in #3856
• Improvements to GitHub Workflows by @gaby in #3857
• Update release-drafter workflow by @gaby in #3860
• Add support for codespell in spell-check workflow by @gaby in #3850
• Add spell check CI workflow by @gaby in #3814
• Fix autolabeler for release-drafter by @gaby in #3865
• Enable manual workflow dispatch for CI by @ReneWerner87 in #3881
• build(deps): bump github.com/valyala/fasthttp from 1.65.0 to 1.67.0 by @dependabot[bot] in #3790
• build(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 by @dependabot[bot] in #3791
• build(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #3792
• build(deps): bump golang.org/x/text from 0.29.0 to 0.30.0 by @dependabot[bot] in #3797
• build(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 by @dependabot[bot] in #3796
• build(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 by @dependabot[bot] in #3795
• build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in #3804
• build(deps): bump github.com/shamaton/msgpack/v2 from 2.3.1 to 2.4.0 by @dependabot[bot] in #3808
• build(deps): bump github.com/valyala/fasthttp from 1.67.0 to 1.68.0 by @dependabot[bot] in #3819
• build(deps): bump github.com/tinylib/msgp from 1.4.0 to 1.5.0 by @dependabot[bot] in #3823
• build(deps): bump github.com/gofiber/utils/v2 from 2.0.0-rc.1 to 2.0.0-rc.2 by @dependabot[bot] in #3853
• build(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 by @dependabot[bot] in #3863
• build(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 by @dependabot[bot] in #3861
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @dependabot[bot] in #3866
• build(deps): bump DavidAnson/markdownlint-cli2-action from 20.0.0 to 21.0.0 by @dependabot[bot] in #3873
• build(deps): bump actions/checkout from 5.0.0 to 5.0.1 - by @dependabot[bot] in #3877
• build(deps): bump github/codeql-action from 4.31.3 to 4.31.4 by @dependabot[bot] in #3878

📚 Documentation

• Fix typos in some files by @khanhkhanhlele in #3847
• Document usage of reverse proxies for SendEarlyHints by @akilesh1706 in #3778
• Fix broken link in the Routing guide by @guerzon in #3831

New Contributors

• @akilesh1706 made their first contribution in #3778
• @laughing-nerd made their first contribution in #3775
• @jsoref made their first contribution in #3812
• @K0ng2 made their first contribution in #3820
• @guerzon made their first contribution in #3831
• @khanhkhanhlele made their first contribution in #3847

A fully-detailed view of all new features and the migration guide is available in our

https://docs.gofiber.io/next/whats_new

Full Changelog: v3.0.0-rc.2...v3.0.0-rc.3

Original source