fix(deps): update module github.com/gofiber/fiber/v3 to v3.5.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gofiber/fiber/v3	v3.4.0 → v3.5.0

---

Release Notes

gofiber/fiber (github.com/gofiber/fiber/v3)

v3.5.0

Compare Source

🚀 New

• Harden proxy middleware (#​4405)
  New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })

  https://docs.gofiber.io/middleware/proxy#security
• Add support for custom binding precedence (#​4544)
  New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }

  https://docs.gofiber.io/api/bind#custom-precedence
• Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#​4486)
  New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

🧹 Updates

• Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#​4558)
• Quick-reject routes on precomputed slash-count bounds (#​4517)
• Restore Route inlining lost in the RFC 9110 changes (#​4501)
• Skip the Accept join allocation in the Format emptiness check (#​4503)
• Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#​4500)
• Adopt SWAR-accelerated utils helpers in hot-path scanners (#​4536)
• Adopt gofiber/utils v2.2.0 helpers across hot paths (#​4542)
• Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#​4557)
• adaptor: Cut allocations on the net/http bridge (#​4559)
• cache: Optimize key generation and allocation (#​4608)
• cors: Fold preflight Vary calls into one header scan (#​4502)
• csrf: Optimize trusted subdomain matching (#​4543)
• proxy: Optimize balancer round-robin (#​4549)
• session: Use make() to preallocate relevantExtractors (#​4562)
• De-flake the clock-sensitive tests (#​4575)

🐛 Fixes

• Fix open redirects in composed route URLs and redirect rules (#​4584)
• Preserve published route buckets during rebuilds (#​4579)
• URL-encode query values in Redirect.Route (#​4529)
• Accept the full float64 range in the float route constraint (#​4528)
• Match HTTP field names the way a recipient must (#​4585)
• Honor Accept weights followed by whitespace before the comma (#​4550)
• Compare Accept media types case-insensitively (#​4493)
• Honor q=0 rejections in content negotiation (#​4508)
• Honor duplicate Content-Encoding after empty values (#​4514)
• Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#​4494)
• Avoid reading omitted request bodies in Bind.All (#​4565)
• Combine repeated proxy headers for client IP extraction (#​4568)
• Close the listener on Listen error paths to avoid FD leaks (#​4532)
• Fire OnPostShutdown once with the real shutdown error (#​4531)
• Keep all NewErrorf args when the first isn't a format string (#​4530)
• adaptor: Preserve Connection tokens (#​4606)
• cache: Honor only-if-cached for non-shareable entries (#​4589)
• cache: Stop charging its own latency as response age (#​4578)
• healthcheck: Answer HEAD probes with the GET status (#​4577)
• limiter: Floor sub-second expiration in the sliding window (#​4564)
• proxy: Classify IPv6 transition addresses correctly in upstream validation (#​4553)
• proxy: Guard runtime helpers against DNS rebinding (#​4518)
• proxy: Preserve empty-query URL semantics (#​4513)
• redirect: Rank wildcards behind character classes in rule ordering (#​4607)
• static: Fix leading-slash normalization for fs.FS root paths (#​4507)
• Fix client redirect handling, TLS diagnostics and the JSONP callback (#​4586)
• Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#​4570)

🛠️ Maintenance

22 changes

• bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#​4602)
• bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 (#​4583)
• bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#​4566)
• bump github.com/gofiber/utils/v2 from 2.4.0 to 2.4.1 (#​4567)
• bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 in the fasthttp-modules group (#​4561)
• bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#​4556)
• bump actions/checkout from 7.0.0 to 7.0.1 (#​4551)
• bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#​4548)
• bump github.com/gofiber/schema from 1.8.2 to 1.8.3 (#​4547)
• bump release-drafter/release-drafter from 7.5.1 to 7.6.0 (#​4546)
• bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 (#​4545)
• bump actions/setup-go from 6.5.0 to 7.0.0 (#​4541)
• bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#​4540)
• bump github.com/shamaton/msgpack/v3 from 3.1.2 to 3.2.0 (#​4538)
• bump actions/setup-node from 6.4.0 to 7.0.0 (#​4537)
• bump github.com/gofiber/schema from 1.8.1 to 1.8.2 (#​4535)
• bump github.com/gofiber/utils/v2 from 2.1.1 to 2.1.2 (#​4520)
• bump the golang-modules group with 3 updates (#​4515)
• bump DavidAnson/markdownlint-cli2-action from 23.2.0 to 24.0.0 (#​4506)
• bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-modules group (#​4511)
• bump golang.org/x/text from 0.38.0 to 0.39.0 in the golang-modules group (#​4509)
• bump github.com/gofiber/schema from 1.8.0 to 1.8.1 (#​4510)

📚 Documentation

• Explain adjacent multi-param capture rules (#​4597)
• Document Ctx as a never-cancelable context (#​4560)
• Move README.md to the repo root so pkg.go.dev renders it (#​4505)
• logger: Explain when the error tag is populated (#​4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: gofiber/fiber@v3.4.0...v3.5.0

Thank you @​0xghost42, @​ATKasem, @​Rachit-Gandhi, @​ReneWerner87, @​RubenPari, @​SivaPA08, @​aryan-finbox, @​aryan262, @​gaby, @​james-yusuke, @​nikolauspschuetz, @​sueun-dev and @​sunghyun1999 for making this release possible.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
github.com/gofiber/schema	v1.8.2 -> v1.8.3
github.com/gofiber/utils/v2	v2.2.0 -> v2.4.1
github.com/klauspost/compress	v1.19.0 -> v1.19.2
github.com/mattn/go-isatty	v0.0.23 -> v0.0.24
github.com/valyala/fasthttp	v1.72.0 -> v1.73.0

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​gofiber/​fiber/​v3@​v3.4.0 ⏵ v3.5.0	+1

View full report