fix(deps): update module github.com/gofiber/fiber/v2 to v3 by renovate[bot] · Pull Request #142 · TeamPiped/instances-api

renovate · 2026-02-02T18:54:16Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gofiber/fiber/v2	`v2.52.15` → `v3.5.0`

Release Notes

gofiber/fiber (github.com/gofiber/fiber/v2)

`v3.5.0`

Compare Source

🚀 New

Harden proxy middleware (#4405)
New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.
```
proxy.WithSecurityPolicy(proxy.SecurityPolicy{
    AllowPrivateIPs: true, // internal upstreams are blocked by default
})
```
https://docs.gofiber.io/middleware/proxy#security
Add support for custom binding precedence (#4544)
New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.
```
type SearchReq struct {
    Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
}
```
https://docs.gofiber.io/api/bind#custom-precedence
Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486)
New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).
```
app := fiber.New(fiber.Config{
    SkipUnmatchedRoutes: true, // default: false
})
```
https://docs.gofiber.io/api/fiber#skipunmatchedroutes

🧹 Updates

Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
Quick-reject routes on precomputed slash-count bounds (#4517)
Restore Route inlining lost in the RFC 9110 changes (#4501)
Skip the Accept join allocation in the Format emptiness check (#4503)
Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
adaptor: Cut allocations on the net/http bridge (#4559)
cache: Optimize key generation and allocation (#4608)
cors: Fold preflight Vary calls into one header scan (#4502)
csrf: Optimize trusted subdomain matching (#4543)
proxy: Optimize balancer round-robin (#4549)
session: Use make() to preallocate relevantExtractors (#4562)
De-flake the clock-sensitive tests (#4575)

🐛 Fixes

Fix open redirects in composed route URLs and redirect rules (#4584)
Preserve published route buckets during rebuilds (#4579)
URL-encode query values in Redirect.Route (#4529)
Accept the full float64 range in the float route constraint (#4528)
Match HTTP field names the way a recipient must (#4585)
Honor Accept weights followed by whitespace before the comma (#4550)
Compare Accept media types case-insensitively (#4493)
Honor q=0 rejections in content negotiation (#4508)
Honor duplicate Content-Encoding after empty values (#4514)
Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)
Avoid reading omitted request bodies in Bind.All (#4565)
Combine repeated proxy headers for client IP extraction (#4568)
Close the listener on Listen error paths to avoid FD leaks (#4532)
Fire OnPostShutdown once with the real shutdown error (#4531)
Keep all NewErrorf args when the first isn't a format string (#4530)
adaptor: Preserve Connection tokens (#4606)
cache: Honor only-if-cached for non-shareable entries (#4589)
cache: Stop charging its own latency as response age (#4578)
healthcheck: Answer HEAD probes with the GET status (#4577)
limiter: Floor sub-second expiration in the sliding window (#4564)
proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)
proxy: Guard runtime helpers against DNS rebinding (#4518)
proxy: Preserve empty-query URL semantics (#4513)
redirect: Rank wildcards behind character classes in rule ordering (#4607)
static: Fix leading-slash normalization for fs.FS root paths (#4507)
Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)
Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

🛠️ Maintenance

22 changes

bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#4602)
bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 (#4583)
bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#4566)
bump github.com/gofiber/utils/v2 from 2.4.0 to 2.4.1 (#4567)
bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 in the fasthttp-modules group (#4561)
bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#4556)
bump actions/checkout from 7.0.0 to 7.0.1 (#4551)
bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#4548)
bump github.com/gofiber/schema from 1.8.2 to 1.8.3 (#4547)
bump release-drafter/release-drafter from 7.5.1 to 7.6.0 (#4546)
bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 (#4545)
bump actions/setup-go from 6.5.0 to 7.0.0 (#4541)
bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#4540)
bump github.com/shamaton/msgpack/v3 from 3.1.2 to 3.2.0 (#4538)
bump actions/setup-node from 6.4.0 to 7.0.0 (#4537)
bump github.com/gofiber/schema from 1.8.1 to 1.8.2 (#4535)
bump github.com/gofiber/utils/v2 from 2.1.1 to 2.1.2 (#4520)
bump the golang-modules group with 3 updates (#4515)
bump DavidAnson/markdownlint-cli2-action from 23.2.0 to 24.0.0 (#4506)
bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-modules group (#4511)
bump golang.org/x/text from 0.38.0 to 0.39.0 in the golang-modules group (#4509)
bump github.com/gofiber/schema from 1.8.0 to 1.8.1 (#4510)

📚 Documentation

Explain adjacent multi-param capture rules (#4597)
Document Ctx as a never-cancelable context (#4560)
Move README.md to the repo root so pkg.go.dev renders it (#4505)
logger: Explain when the error tag is populated (#4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: gofiber/fiber@v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.

`v3.4.0`

Compare Source

🚀 New

Complete HTTP QUERY method support (#4436, #4456)
Adds the HTTP QUERY method (RFC 10008): fiber.MethodQuery, app.Query() routing, safe/idempotent handling in csrf, idempotency, earlydata and cache, plus client.Query() shorthands.
```
app.Query("/search", func(c fiber.Ctx) error {
    return c.Send(c.Body()) // QUERY carries the query expression in the body
})
```
https://docs.gofiber.io/client/rest#query
Add WithContext variants for session storage I/O (#4393)
SaveWithContext, DestroyWithContext, RegenerateWithContext and ResetWithContext propagate deadlines/cancellation to the session storage backend; the plain methods keep working unchanged.
```
sess := session.FromContext(c)
err := sess.SaveWithContext(ctx) // storage write bounded by ctx
```
https://docs.gofiber.io/middleware/session#session-with-context-timeoutscancellation
Unify internal and custom constraints into a single interface (#4397)
Built-in and custom route constraints now share one ConstraintHandler interface; the optional ConstraintAnalyzer precomputes constraint data at route registration, removing per-request parsing. Existing CustomConstraint implementations keep working unchanged.
```
app.RegisterCustomConstraint(evenConstraint{}) // implements Name() + Execute()
app.Get("/items/:id<even>", handler)
```
https://docs.gofiber.io/guide/routing#constrainthandler-interface
Expose prefork RecoverInterval and ShutdownGracePeriod (#4491)
New ListenConfig knobs: PreforkRecoverInterval delays respawning a crashed child (default 0) and PreforkShutdownGracePeriod sets how long the master waits after SIGTERM before SIGKILL (default 5s).
```
app.Listen(":3000", fiber.ListenConfig{
    EnablePrefork:              true,
    PreforkRecoverInterval:     time.Second,
    PreforkShutdownGracePeriod: 10 * time.Second,
})
```
https://docs.gofiber.io/api/fiber#preforkrecoverinterval

🧹 Updates

Reduce avoidable work in the request hot path (#4490)
Avoid per-request heap allocation in DefaultErrorHandler (#4446)
Use sentinel errors on typed-getter and Range parse failures (#4448)
Replace appendLowerBytes with utilsbytes.UnsafeToLower (#4468)
Add MIMETextEventStream constant (#4415)
Cache binder decoder type metadata across requests (#4447)
Eliminate double reflection in binder mergeStruct (-10% allocs) (#4385)
Reduce binder data map allocations (#4379)
cache: Append canonical key segments into the pooled buffer (#4450)
cors: Optimize subdomain origin matching (#4482)
cors: Optimize exact-origin lookup to O(1) (#4368)
csrf/redirect: Share scheme/host matching and skip url.Parse on the hot path (#4449)
Narrow client user hook lock scope safely (#4375)
Raise middleware coverage above 90% for timeout, logger, idempotency, limiter, cache (#4466)
Cover remaining cors/csrf middleware branches (#4462)
Add unit tests for isOriginSerializedOrNull (#4461)
Cover session deadline/error paths and delegate Middleware lifecycle methods (#4435)
Inject clock to make time-dependent tests deterministic (#4430)
Rename benchmark cases (#4383)
Remove test-only dead code and add manual deadcode workflow (#4458)
Remove dead code flagged by static analysis (#4454)
Static analysis cleanups (#4444)
Fix modernize lint issues (#4315)

🐛 Fixes

Evaluate If-Modified-Since when If-None-Match is absent in Fresh (#4488)
Fix open redirect via Redirect().Back() by validating the Referer header origin (#4370)
Fix data race on lazy appListKeys generation in Render (#4440)
Avoid route fallback errors during server error middleware traversal (#4426)
Strip all trusted proxy IPs from X-Forwarded-For chain (#4394)
Guard typed-nil errors (#4407)
Guard typed-nil Fiber error paths without reflection (#4372)
Preserve legacy custom constraint arguments (#4432)
Remove unreachable SameSiteDefaultMode case (#4471)
Detach quoted filename strings from pooled buffers (#4374)
Prevent app.init mutex deadlock on panic (#4366)
Enforce CertClientFile for AutoCertManager TLS (#4312)
cache: Separate authorization key segment (#4467)
cache: Hash QUERY body keys (#4459)
cache: Evaluate freshness after locking (#4419)
cors: Validate wildcard origins before matching (#4438)
cors: Reject empty wildcard labels (#4437)
csrf: Validate nested extractor chains (#4439)
csrf: Port CORS subdomain match fixes (#4455)
etag: Skip Server-Sent Events responses (#4487)
Guard extractor introspection cycles (#4453)
helmet: Use Scheme() for HTTPS detection and validate HSTS configuration (#4389)
hostauthorization: Reject malformed hostnames in wildcard path (#4408)
idempotency: Make MemoryLock safe for zero-value use (#4371)
limiter: Correct fixed-window hit credit on skipped requests (#4422)
logger/cache/storage: Remove unbounded background goroutines (#4378)
pprof/proxy: Fix trailing-slash redirect and balancer empty-server panic (#4421)
proxy: Bound upstream connections by default (#4369)
rewrite/redirect: Anchor rules to the start of the path (#4483)
session: Prevent session fixation by preserving successful extractor in chains (#4469)
session: Prevent store error disclosure (#4424)
session: Restore isFresh field name (#4477)
sse: Preserve trailing newlines in event data (#4414)
timeout: Isolate default timeout responses (#4442)
timeout: Reclaim abandoned fiber.Ctx via ScheduleReclaim latch (#4359, #4400)
Fix client config locking races (#4470)
Fix client default access race in Replace/C path (#4377)
Handle panics in client execFunc without crashing callers (#4365)
Address bugs found in codebase audit (#4420)
Fix cleanup follow-ups and regression coverage (#4380)

🛠️ Maintenance

22 changes

bump github.com/klauspost/compress from 1.18.7 to 1.19.0 (#4489)
bump github.com/klauspost/compress from 1.18.6 to 1.18.7 (#4485)
bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 (#4484)
bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0 in the fasthttp-modules group (#4481)
bump actions/cache/restore from 6.0.0 to 6.1.0 (#4480)
bump actions/cache/save from 6.0.0 to 6.1.0 (#4479)
bump release-drafter/release-drafter from 7.5.0 to 7.5.1 (#4463)
bump release-drafter/release-drafter from 7.4.0 to 7.5.0 (#4457)
bump actions/cache from 5.0.5 to 6.0.0 (#4452)
bump actions/setup-go from 6.4.0 to 6.5.0 (#4451)
bump actions/checkout from 6.0.3 to 7.0.0 (#4441)
bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (#4434)
bump golang.org/x/net from 0.55.0 to 0.56.0 in the golang-modules group (#4425)
bump github.com/gofiber/schema from 1.7.2 to 1.8.0 (#4417)
bump the golang-modules group with 2 updates (#4416)
bump golang.org/x/sys from 0.45.0 to 0.46.0 in the golang-modules group (#4412)
bump codecov/codecov-action from 6.0.1 to 7.0.0 (#4413)
bump actions/checkout from 6.0.2 to 6.0.3 (#4398)
bump github.com/gofiber/schema from 1.7.1 to 1.7.2 (#4396)
bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 (#4384)
bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#4314)
bump the golang-modules group with 3 updates (#4310)

📚 Documentation

Restructure routing guide and split handler partials (#4311)
Fix Ctx.Scheme/Protocol documentation (#4473, #4474)
Clarify client hook concurrency contract (#4386)
keyauth: Fix extractor examples (#4409)
Add FAQ troubleshooting entry for the "id <= evictCount" (hpack/gRPC) panic (#4475)
Replace interface{} with any (Go 1.18+) (#4433)
Document thread-safety contracts for mutex-backed public types (#4367)
Enhance sponsorship section in README (#4402)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: gofiber/fiber@v3.3.0...v3.4.0

Thank you @0xghost42, @Amirhf1, @DucMinhNe, @Fenny, @MD-Mushfiqur123, @ReneWerner87, @alexandear, @fereidani, @gaby, @james-yusuke, @ksw2000, @nekoworks-magic, @niksis02, @pageton, @sixcolors and @talktokim for making this release possible.

`v3.3.0`

Compare Source

🚀 New

Add support for configuring the Regex engine on the router (#4254)
Swap the compiler used for regex() route constraints. Assign a drop-in engine such as coregex.MustCompile for faster matching;Fiber reuses the compiled matcher across requests.
```
app := fiber.New(fiber.Config{
    RegexHandler: coregex.MustCompile, // default: regexp.MustCompile
})
```
https://docs.gofiber.io/api/fiber#regexhandler
Host auth middleware (#4199)
New hostauthorization middleware that validates the incoming Host header against an allowlist (exact host, .subdomain wildcard, CIDR range) to protect against DNS rebinding attacks.
```
app.Use(hostauthorization.New(hostauthorization.Config{
    AllowedHosts: []string{"api.myapp.com", ".myapp.com", "10.0.0.0/8"},
}))
```
https://docs.gofiber.io/middleware/hostauthorization
Delegate implementation to fasthttp/prefork (#4210)
Prefork now delegates to fasthttp's prefork package and adds PreforkRecoverThreshold (max child restarts before the master exits) and PreforkLogger to ListenConfig.
https://docs.gofiber.io/api/fiber#preforkrecoverthreshold
Add support for contextual logs (#4241)
Render request-scoped fields in log.WithContext(c) by configuring a template with log.SetContextTemplate, reusing the middleware/logger engine (including ${value:key} for arbitrary context values).
```
log.MustSetContextTemplate(log.ContextConfig{Format: log.RequestIDFormat})

app.Get("/", func(c fiber.Ctx) error {
    log.WithContext(c).Info("start") // renders the request id
    return c.SendString("ok")
})
```
https://docs.gofiber.io/api/log#bind-context
Add storage backed SharedState for prefork applications (#4243)
A prefork-safe, storage-backed key/value store via app.SharedState() for data shared across workers/processes, with JSON/MsgPack/CBOR/XML helpers and automatic key namespacing. app.State() stays process-local.
```
app := fiber.New(fiber.Config{
    SharedStorage: redis.New(), // any fiber.Storage shared across workers
})
app.SharedState().SetJSON("config", cfg, 0)
```
https://docs.gofiber.io/api/state#sharedstate-prefork-safe
Add lightweight SSE middleware (#4239)
A Fiber-native middleware/sse for Server-Sent Events: SSE headers, event/comment/retry frames, per-write flushing, heartbeats,
Last-Event-ID access, and disconnect detection via stream.Context().
```
app.Get("/events", sse.New(sse.Config{
    Handler: func(c fiber.Ctx, stream *sse.Stream) error {
        return stream.Event(sse.Event{Name: "message", Data: fiber.Map{"message": "hello"}})
    },
}))
```
https://docs.gofiber.io/middleware/sse

🧹 Updates

Add prefixes to unexported boolean fields (#4300)
Improve error messages in SaveFileToStorage (#4173)
Streamline request handler selection and context management for improved performance (#4233)

🐛 Fixes

Preserve mounted sub-app regex handler during mount prefixing (#4308)
Trim only one trailing dot in host normalization (#4307)
Reject oversized unknown-length adaptor request bodies (#4306)
Fix compress middleware's shouldSkip method to avoid memory growth (#4284)
Reject malformed host authorities in hostauthorization (#4293)
Synchronize view reloads with template rendering (#4288)
Avoid panic for non-struct listeners in TLS config discovery (#4305)
Clear plaintext cookie when encryption fails (#4303)
Fix regex route constraint parsing with literal > (#4292)
Reject empty normalized host before dynamic matching (#4291)
Preserve idempotency replay protection for oversized responses (#4287)
Enforce CookieJar domain acceptance and host-only cookie matching (#4282)
Avoid panic when reading released Fiber context values (#4271)
Enforce static root for fs-backed directory serving (#4277)
Prevent negative paginate start overflow (#4272)
Prevent SharedState namespace key collisions (#4274)
Copy FullURL string before returning pooled buffer (#4275)
Enforce paginate sort allowlist when AllowedSorts is unset (#4276)
Validate and safely apply workflow version updates (#4273)
Close BodyStream in adaptor FiberHandler streaming path (#4267)
Prevent panic when MsgPack is not configured (#4268)
Keep IsFromLocal loopback-only and add unix-socket helper (#4270)
Prevent panic when CBOR is not explicitly configured (#4269)
Guard session logger tag against released middleware (#4265)
Add X-Real-IP protection to Forward and DomainForward variants (#4261)
Ensure BalancerForward overwrites X-Real-IP header (#4260)
Add test coverage for multipart BodyLimit error handling (#4237)
Improve error propagation in Express-style handler (#4250)
Remove SSE Next and clarify SSE handler docs (#4247)
BasicAuth verifier for unknown users (#4245)

🛠️ Maintenance

13 changes

bump github.com/shamaton/msgpack/v3 from 3.1.1 to 3.1.2 (#4296)
bump codecov/codecov-action from 6.0.0 to 6.0.1 (#4294)
bump actions/add-to-project from 1.0.2 to 2.0.0 (#4256)
bump github.com/shamaton/msgpack/v3 from 3.1.0 to 3.1.1 (#4281)
bump the golang-modules group with 3 updates (#4278)
bump golang.org/x/sys from 0.43.0 to 0.44.0 in the golang-modules group (#4262)
bump DavidAnson/markdownlint-cli2-action from 23.1.0 to 23.2.0 (#4259)
bump benchmark-action/github-action-benchmark from 1.22.0 to 1.22.1 (#4258)
bump github.com/valyala/fasthttp from 1.70.0 to 1.71.0 in the fasthttp-modules group (#4255)
bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#4249)
bump DavidAnson/markdownlint-cli2-action from 23.0.0 to 23.1.0 (#4246)
bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 (#4242)

📚 Documentation

Fix invalid RouteChain method chaining example (#4304)
Harden reverse proxy X-Forwarded-For example (#4266)
Correct fasthttpctx Done semantics in context guide (#4264)
Clarify ${bytesSent} behavior in logger middleware (#4251)
Clarify prefork security model and OS-specific socket behavior (#4240)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: gofiber/fiber@v3.2.0...v3.3.0

Thank you @ReneWerner87, @elton-peixoto-lu, @gaby, @gtoxlili, @lyyvalhalla, @mutantkeyboard, @pageton and @pratikramteke for making this release possible.

`v3.2.0`

Compare Source

🚀 New

Add URL() method to Route for generating URLs with parameters (#4195)
https://docs.gofiber.io/api/app#getroute
Add comprehensive tests for binding to pointer scalar types (#4191)
Add response format support to healthcheck middleware (#4178)
https://docs.gofiber.io/middleware/healthcheck#config
Route Domain() func for host-based routing (#4100)
Add pagination middleware (#4127)
https://docs.gofiber.io/middleware/paginate
Add BindError type with source and field metadata (#4120)
https://docs.gofiber.io/api/bind#binderror
Add PanicHandler in recover middleware (#4110)
https://docs.gofiber.io/middleware/recover#config

🧹 Updates

Optimize speed (#4231)
Remove duplicate benchmark handling and update benchmark action version (#4108)

🐛 Fixes

Fix race condition in TestTimeout_ContextPropagation (#4119)
Fix ARMv7 build overflow in etag middleware (#4190)
Fix HTML escaping in AutoFormat (#4228)
Structured default cache keys, and controls (#4224)
Enforce BodyLimit on request decompression and multipart form parsing (#4213)
Implement releaseData function for better resource management (#4209)
Strip path from referer before matching trusted origins (#4204)
Improve clarity for ProxyHeader and TrustProxy configuration (#4140)
Prefork children exit immediately in Docker containers (#4133)
Fix math.MaxUint32 overflow in etag middleware on 32-bit platforms (#4135)
Add nil checks to End() to prevent panic in streaming mode (#4128)
Custom binders bypass StructValidator in Body() and Custom() (#4124)

🛠️ Maintenance

43 changes

bump actions/setup-go from 6.2.0 to 6.3.0 (#4114)
bump golang.org/x/net from 0.50.0 to 0.51.0 in the golang-modules group (#4113)
bump github.com/gofiber/schema from 1.7.0 to 1.7.1 (#4220)
bump actions/setup-node from 6.3.0 to 6.4.0 (#4222)
bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 (#4221)
bump github.com/tinylib/msgp from 1.6.3 to 1.6.4 (#4215)
bump github/codeql-action from 4.35.1 to 4.35.2 (#4216)
bump actions/cache from 5.0.4 to 5.0.5 (#4214)
bump actions/github-script from 8.0.0 to 9.0.0 (#4207)
bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#4206)
bump the golang-modules group with 2 updates (#4205)
bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#4203)
bump golang.org/x/text from 0.35.0 to 0.36.0 in the golang-modules group (#4202)
bump golang.org/x/sys from 0.42.0 to 0.43.0 in the golang-modules group (#4201)
bump github.com/valyala/fasthttp from 1.69.0 to 1.70.0 in the fasthttp-modules group across 1 directory (#4197)
bump lewagon/wait-on-check-action from 1.6.0 to 1.6.1 (#4198)
bump streetsidesoftware/cspell-action from 8.3.0 to 8.4.0 (#4188)
bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 (#4174)
bump benchmark-action/github-action-benchmark from 1.21.0 to 1.22.0 (#4172)
bump actions/setup-go from 6.3.0 to 6.4.0 (#4170)
bump lewagon/wait-on-check-action from 1.5.0 to 1.6.0 (#4171)
bump github/codeql-action from 4.35.0 to 4.35.1 (#4169)
bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 (#4165)
bump codecov/codecov-action from 5.5.3 to 6.0.0 (#4166)
bump github/codeql-action from 4.34.1 to 4.35.0 (#4164)
bump DavidAnson/markdownlint-cli2-action from 22.0.0 to 23.0.0 (#4161)
bump github.com/klauspost/compress from 1.18.4 to 1.18.5 (#4158)
bump github/codeql-action from 4.34.0 to 4.34.1 (#4159)
bump github/codeql-action from 4.33.0 to 4.34.0 (#4156)
bump codecov/codecov-action from 5.5.2 to 5.5.3 (#4153)
bump release-drafter/release-drafter from 7.1.0 to 7.1.1 (#4152)
bump actions/cache from 5.0.3 to 5.0.4 (#4151)
bump release-drafter/release-drafter from 7.0.0 to 7.1.0 (#4147)
bump release-drafter/release-drafter from 6.4.0 to 7.0.0 (#4142)
bump github/codeql-action from 4.32.6 to 4.33.0 (#4141)
bump the golang-modules group with 3 updates (#4138)
bump golang.org/x/sys from 0.41.0 to 0.42.0 in the golang-modules group (#4136)
bump release-drafter/release-drafter from 6.3.0 to 6.4.0 (#4137)
bump github/codeql-action from 4.32.5 to 4.32.6 (#4131)
bump release-drafter/release-drafter from 6.2.0 to 6.3.0 (#4130)
bump actions/setup-node from 6.2.0 to 6.3.0 (#4129)
bump benchmark-action/github-action-benchmark from 1.20.7 to 1.21.0 (#4126)
bump github/codeql-action from 4.32.4 to 4.32.5 (#4123)

📚 Documentation

Key Value Expectation Notice (KeyAuth Middleware) (#4183)
Document array query parameter formats for Query binder (#4116)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: gofiber/fiber@v3.1.0...v3.2.0

Thank you @JonasDoe, @ReneWerner87, @adrian-lin-1-0-0, @aviu16, @gaby, @ha-sante, @loderunner, @meruiden, @mutantkeyboard and @sixcolors for making this release possible.

`v3.1.0`

Compare Source

🚀 New

expand middleware context helpers (#4079)

app := fiber.New(fiber.Config{
    PassLocalsToContext: true, // default: false
})

// Works for requestid, csrf, session, basicauth, keyauth middlewares
app.Use(requestid.New())

app.Get("/", func(ctx fiber.Ctx) error {
    // Value helpers from middlewares works now with 3 different context items
    id := requestid.FromContext(ctx)              // works always
    id := requestid.FromContext(ctx.RequestCtx()) // works always
    id := requestid.FromContext(ctx.Context())    // works only when `PassLocalsToContext` is true
    
    return c.SendString(id)
})

https://docs.gofiber.io/api/fiber/#passlocalstocontext

🧹 Updates

update utils and add go 1.26 for test workflow (#4087)
optimize helpers performance (#4049)
harden numeric constraint parsing and expand route tests (#4054)

🐛 Fixes

harden DefaultRes.Format against nil handler panics (#4105)
guard nil request in adaptor LocalContextFromHTTPRequest (#4097)
fix Unix-socket support in IsProxyTrusted (#4088)
harden proxy nil client handling in Do/Forward paths (#4083)
add nil-safety to response decode helpers (#4081)
sanitize attachment/download filenames (#4070)
harden flash cookie detection (#4078)
fix bind struct validation only for struct targets (#4082)
enforce Range header limit configuration (#4071)
apply limits to msgp serialization (#4065)
fix sanitizePath validation logic (#4064)
fix Test method returning empty response on timeout (#4063)
fix nil pointer dereference in context methods when accessed after release (#4062)
retry addon: remove unnecessary sleep after last failed attempt (#4060)
make TLS listener config discovery safer (#4055)
validate nil services early and during lifecycle (#4050)
skip non-string state keys during iteration (#4048)
harden Port() handling (#4051)
prevent panics on non-string log keys (#4046)

🛠️ Maintenance

bump streetsidesoftware/cspell-action from 8.2.0 to 8.3.0 (#4111)
bump the golang-modules group with 3 updates (#4080)
bump github.com/shamaton/msgpack/v3 from 3.0.0 to 3.1.0 (#4075)
bump github.com/klauspost/compress from 1.18.3 to 1.18.4 (#4076)
bump github.com/gofiber/schema from 1.6.0 to 1.7.0 (#4074)
bump golang.org/x/sys from 0.40.0 to 0.41.0 in the golang-modules group (#4073)
bump github/codeql-action from 4.32.3 to 4.32.4 (#4104)
bump github/codeql-action from 4.32.1 to 4.32.2 (#4058)
bump github/codeql-action from 4.32.0 to 4.32.1 (#4047)

📚 Documentation

update versioned storage imports in middleware docs (#4102)
update documentation for parser configuration and request handling (#4096)
fix invalid Go slice literal in middleware registration example (#4095)
document uri struct tag for ctx.Bind().URI() in migration guide (#4092)
document logger Stream rename (#4057)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: gofiber/fiber@v3.0.0...v3.1.0

Thank you @ReneWerner87, @SadikSunbul, @gaby and @sixcolors for making this release possible.

`v3.0.0`

Compare Source

For a detailed view of all changes and the migration guide, visit:
https://docs.gofiber.io/whats_new

Try our new migration tool to help you upgrade from v2 to v3:

go install github.com/gofiber/cli/fiber@latest
fiber migrate --to v3

What's Changed

🚀 New Features

🚀 App (Docs)
- Rename WithTlsConfig method to WithTLSConfig in (#2570)
- Use any as default Message type of Error struct in (#1925)
- Add support for custom constraints in (#2807)
- Add support for trusted origins in (#2910)
- Add DialDualStack option for upstream IPv6 support in (#2900)
- TrustedOrigins using https://*.example.com style subdomains in (#2925)
- Add configuration support to c.SendFile() in (#3017)
- Add CHIPS support to Cookie in (#3047)
- Add TestConfig to app.Test() for configurable testing in (#3161)
- Add buffered streaming support in (#3131)
- Add support for AutoTLS / ACME in (#3201)
- Add support for configuring TLS Min Version in (#3248)
- Fix square bracket notation in Multipart FormData in (#3235)
- Add support for application state management in (#3360)
- Add support for NewErrorf in (#3463)
- Add UNIX socket support in (#3535)
- Add support for Msgpack in (#3565)
- Add default UTF-8 charset in (#3583)
- Support for SendEarlyHints in (#3483)
- Add conditional copy helpers in (#3703)
- Add request inspection helpers in ([#&fix(deps): update module github.com/google/go-github/v60 to v62 - autoclosed #82

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-02-02T18:54:17Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

12 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.22.7` -> `1.25.0`
`github.com/andybalholm/brotli`	`v1.1.0` -> `v1.2.2`
`github.com/klauspost/compress`	`v1.17.9` -> `v1.19.2`
`github.com/mattn/go-colorable`	`v0.1.13` -> `v0.1.15`
`github.com/mattn/go-isatty`	`v0.0.20` -> `v0.0.24`
`github.com/stretchr/testify`	`v1.10.0` -> `v1.11.1`
`github.com/valyala/fasthttp`	`v1.51.0` -> `v1.73.0`
`golang.org/x/mod`	`v0.17.0` -> `v0.37.0`
`golang.org/x/net`	`v0.29.0` -> `v0.57.0`
`golang.org/x/sync`	`v0.8.0` -> `v0.22.0`
`golang.org/x/sys`	`v0.28.0` -> `v0.47.0`
`golang.org/x/text`	`v0.18.0` -> `v0.40.0`
`golang.org/x/tools`	`v0.21.1-0.20240508182429-e35e4ccd0d2d` -> `v0.47.0`

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from b3776d4 to 8b714d9 Compare February 12, 2026 13:49

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch 2 times, most recently from fa2ad8b to 78dc12a Compare February 25, 2026 01:22

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from 78dc12a to 3983fb7 Compare March 13, 2026 11:57

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch 2 times, most recently from 51d21be to f912bd4 Compare April 25, 2026 17:00

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from f912bd4 to b325f02 Compare May 12, 2026 11:53

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from b325f02 to 825427e Compare May 22, 2026 09:58

renovate Bot changed the title ~~fix(deps): update module github.com/gofiber/fiber/v2 to v3~~ fix(deps): update module github.com/gofiber/fiber/v2 to v3 - autoclosed Jul 2, 2026

renovate Bot closed this Jul 2, 2026

renovate Bot deleted the renovate/github.com-gofiber-fiber-v2-3.x branch July 2, 2026 06:53

renovate Bot changed the title ~~fix(deps): update module github.com/gofiber/fiber/v2 to v3 - autoclosed~~ fix(deps): update module github.com/gofiber/fiber/v2 to v3 Jul 2, 2026

renovate Bot reopened this Jul 2, 2026

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch 3 times, most recently from d2d4859 to f5e285f Compare July 6, 2026 21:01

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from f5e285f to 6d9c665 Compare July 12, 2026 11:50

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from 6d9c665 to 9a93560 Compare August 13, 2026 04:43

fix(deps): update module github.com/gofiber/fiber/v2 to v3

f38325f

renovate Bot force-pushed the renovate/github.com-gofiber-fiber-v2-3.x branch from 9a93560 to f38325f Compare August 13, 2026 14:07

Navigation Menu

Uh oh!

fix(deps): update module github.com/gofiber/fiber/v2 to v3 - #142

fix(deps): update module github.com/gofiber/fiber/v2 to v3#142
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-gofiber-fiber-v2-3.x

renovate Bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.5.0

🚀 New

🧹 Updates

🐛 Fixes

🛠️ Maintenance

📚 Documentation

v3.4.0

🚀 New

🧹 Updates

🐛 Fixes

🛠️ Maintenance

📚 Documentation

v3.3.0

🚀 New

🧹 Updates

🐛 Fixes

🛠️ Maintenance

📚 Documentation

v3.2.0

🚀 New

🧹 Updates

🐛 Fixes

🛠️ Maintenance

📚 Documentation

v3.1.0

🚀 New

🧹 Updates

🐛 Fixes

🛠️ Maintenance

📚 Documentation

v3.0.0

What's Changed

🚀 New Features

Configuration

Uh oh!

renovate Bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 2, 2026 •

edited

Loading

`v3.5.0`

`v3.4.0`

`v3.3.0`

`v3.2.0`

`v3.1.0`

`v3.0.0`

renovate Bot commented Feb 2, 2026 •

edited

Loading