d238e60fed
Add ServeFileLiteral, ServeFSLiteral and SendFileLiteral ( #2163 )
...
ServeFile and ServeFS interpret the path as a URI, so percent-encoded
sequences are decoded and characters like '?' and '#' act as URI
delimiters. This makes it impossible to serve files whose names
contain those characters.
Changing this behavior would be backwards incompatible. So instead the
new ServeFileLiteral, ServeFSLiteral and SendFileLiteral are added.
The new Literal variants percent-encode the path before setting it as
the request URI, preserving every byte of the original filesystem path.
Thanks to @thesmartshadow for reporting this issue.
2026-03-23 03:21:36 +01:00
e2f8a255a0
Sanitize header values in all setter paths to prevent CRLF injection ( #2162 )
...
Prevents `header.Set("Key", "value\r\nEvil-Header: injected")` from
producing extra header lines in the HTTP response/request.
Thanks to @instantraaamen for reporting this issue.
2026-03-23 03:21:27 +01:00
87f0fe1394
Update securego/gosec from 2.23.0 to 2.25.0 ( #2161 )
2026-03-20 07:27:24 +01:00
4001e91911
Fix acquireRealZstdWriter panic
...
Pass the normalized compression level to prevent zstd.WithEncoderLevel
from returning an error.
Fixes https://github.com/valyala/fasthttp/issues/2157
2026-03-16 02:35:36 +01:00
1ceb192a9b
Remove stripTrailingSlashes
...
It was unused.
2026-03-16 02:30:39 +01:00
6fcfcb1ac0
export ErrConnectionClosed ( #2152 )
2026-03-04 08:40:34 +09:00
bed2c19699
chore(deps): bump actions/upload-artifact from 6 to 7 ( #2149 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-27 05:50:32 +01:00
1d3c69196c
Honor Root for fs.FS and normalize fs-style roots ( #2145 )
...
- Apply `fs.Root` in non-`os.FS` path resolution.
- Normalize `fs.FS` roots (`./`, trailing slash, leading slash, separators).
- Handle `PathRewrite` outputs without a leading slash.
- Add tests for `MapFS` and `DirFS` root enforcement.
2026-02-22 18:15:07 +01:00
f0d5d9a5cb
Add WithLimit methods for uncompression ( #2147 )
...
* Add WithLimit methods for uncompression
The current uncompress methods don't enforce a memory limit and are
susceptible to things like zip bombs. This pull introduces new methods
so retain backwards compatibility. The old methods might be deprecated
in the future.
* Fix suggestion
2026-02-22 18:13:40 +01:00
c2b317d47d
Go 1.26 and golangci-lint updates ( #2146 )
...
Keep Go 1.24 compatibility for now (by not using `wg.Go()`).
2026-02-21 10:28:39 +01:00
80e3281747
fasthttpproxy: scope proxy auth cache to GetDialFunc ( #2144 )
...
Move auth cache from package-level to GetDialFunc lifetime to prevent
leaks.
2026-02-20 22:53:25 +01:00
a4ae8ef778
chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 ( #2138 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.49.0 to 0.50.0.
- [Commits](https://github.com/golang/net/compare/v0.49.0...v0.50.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.50.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-15 12:27:21 +01:00
407041cba6
chore(deps): bump securego/gosec from 2.22.11 to 2.23.0 ( #2142 )
...
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.11 to 2.23.0.
- [Release notes](https://github.com/securego/gosec/releases )
- [Commits](https://github.com/securego/gosec/compare/v2.22.11...v2.23.0 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 08:45:43 +01:00
5002cc2c99
chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 ( #2139 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.47.0 to 0.48.0.
- [Commits](https://github.com/golang/crypto/compare/v0.47.0...v0.48.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.48.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-10 08:40:19 +01:00
6a47a4c24d
chore(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 ( #2140 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.18.3 to 1.18.4.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.3...v1.18.4 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.18.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-10 08:40:04 +01:00
29c900bf8c
chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 ( #2137 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.40.0 to 0.41.0.
- [Commits](https://github.com/golang/sys/compare/v0.40.0...v0.41.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-09 19:39:41 +01:00
3471acf23f
Limit url length in FuzzURIParse
...
We had fuzzers use urls of 500kb which doesn't make sense to test with.
2026-01-30 22:55:42 +01:00
5fbda86a8e
chore(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 ( #2129 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.18.2 to 1.18.3.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.2...v1.18.3 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.18.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-19 16:41:29 -03:00
a47d28f18f
chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 ( #2128 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.48.0 to 0.49.0.
- [Commits](https://github.com/golang/net/compare/v0.48.0...v0.49.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-13 14:11:36 -03:00
4df3fcd1fe
chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 ( #2125 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.39.0 to 0.40.0.
- [Commits](https://github.com/golang/sys/compare/v0.39.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-09 13:15:33 -05:00
21dbfe80ce
return prev values ( #2123 )
2026-01-07 18:13:11 -05:00
7cf1fb7967
Add documentation that modifying during iteration can panic ( #2122 )
...
Fixes https://github.com/valyala/fasthttp/issues/2120
2026-01-05 15:10:34 +01:00
7b5cb77b95
Add sortkeys ( #2118 )
...
* added Args.SortKeys
* add test for SortKeys
* fix comment
2025-12-29 15:00:35 -03:00
42f89fbefd
update readme ( #2114 )
2025-12-25 21:16:03 -03:00
fb6b6d160c
chore(deps): bump securego/gosec from 2.22.10 to 2.22.11 ( #2110 )
...
* chore(deps): bump securego/gosec from 2.22.10 to 2.22.11
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.10 to 2.22.11.
- [Release notes](https://github.com/securego/gosec/releases )
- [Commits](https://github.com/securego/gosec/compare/v2.22.10...v2.22.11 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.22.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* Ignore invalid warnings
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Erik Dubbelboer <erik@dubbelboer.com >
2025-12-18 16:34:33 +01:00
fe7e70d901
chore(deps): bump actions/upload-artifact from 5 to 6 ( #2111 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-15 12:24:35 -03:00
69ef8f70f6
chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 ( #2109 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.47.0 to 0.48.0.
- [Commits](https://github.com/golang/net/compare/v0.47.0...v0.48.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.48.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 10:05:58 -03:00
c2db56193f
chore(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 ( #2103 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.18.1 to 1.18.2.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.1...v1.18.2 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.18.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-02 12:10:32 +01:00
ec00ff0e62
chore(deps): bump actions/checkout from 5 to 6 ( #2101 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-21 06:44:31 -03:00
5d415acb4e
chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 ( #2099 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.45.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:18:51 +01:00
cc8220f692
chore(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 ( #2097 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.46.0 to 0.47.0.
- [Commits](https://github.com/golang/net/compare/v0.46.0...v0.47.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.47.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-13 02:36:51 +01:00
7b3edaf4d9
chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 ( #2098 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.43.0 to 0.44.0.
- [Commits](https://github.com/golang/crypto/compare/v0.43.0...v0.44.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.44.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-13 01:22:27 +01:00
2a82a57b9d
Expose header parsing error variables ( #2096 )
2025-11-12 02:31:36 +01:00
e6c64e1d18
chore(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 ( #2094 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/sys/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-10 13:22:23 -05:00
afeeda6f6e
chore(deps): bump golangci/golangci-lint-action from 8 to 9 ( #2095 )
...
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action ) from 8 to 9.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases )
- [Commits](https://github.com/golangci/golangci-lint-action/compare/v8...v9 )
---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-10 13:22:04 -05:00
a38233e07d
chore(deps): bump actions/upload-artifact from 4 to 5 ( #2092 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-27 06:20:53 -06:00
1b8c5593da
Fix named return bugs
...
The new golangci-lint doesn't allow empty return statements anymore.
But returning a specific value with named return variables actually assigns it to the variable.
See: https://go.dev/play/p/kNhVx2scGx5
This caused a bug here: https://github.com/valyala/fasthttp/issues/2090
2025-10-23 23:47:40 +02:00
9ca6293984
chore(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 ( #2089 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.18.0 to 1.18.1.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Changelog](https://github.com/klauspost/compress/blob/master/.goreleaser.yml )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.0...v1.18.1 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.18.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-21 10:41:03 +02:00
77468f66c6
chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 ( #2088 )
...
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.9 to 2.22.10.
- [Release notes](https://github.com/securego/gosec/releases )
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml )
- [Commits](https://github.com/securego/gosec/compare/v2.22.9...v2.22.10 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.22.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-16 06:50:58 +02:00
3a2fdec290
chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 ( #2085 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.45.0 to 0.46.0.
- [Commits](https://github.com/golang/net/compare/v0.45.0...v0.46.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.46.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 12:47:32 +08:00
59f58c07be
chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 ( #2086 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.42.0 to 0.43.0.
- [Commits](https://github.com/golang/crypto/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 12:15:24 +08:00
dbfb82aabe
chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 ( #2087 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.36.0 to 0.37.0.
- [Commits](https://github.com/golang/sys/compare/v0.36.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 12:12:35 +08:00
b26ff48669
chore(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 ( #2084 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/net/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-08 06:32:00 +02:00
1962450629
Fix copyTrailer
...
Don't use it in PeekTrailerKeys and have it reuse the byte slices it might already
have.
2025-10-06 03:45:12 +02:00
2272d532e1
Reimplement flushing support for fasthttpadaptor ( #2081 )
...
Use a simpler implementation, and do more tests.
Instead of https://github.com/valyala/fasthttp/pull/2069
2025-10-06 03:22:13 +02:00
a17ec74999
Reject bad ipv6 hostnames ( #2076 )
2025-10-05 03:14:32 +02:00
f18eb9ef0c
Reject backslash absolute URIs and cache parse errors ( #2075 )
...
Keep our server behaviour the same as net/http.
2025-10-05 02:47:11 +02:00
bed90bcf09
Reject invalid hosts with multiple port delimiters ( #2077 )
2025-10-05 02:46:46 +02:00
d3fc682391
Validate schemes ( #2078 )
2025-10-05 02:23:42 +02:00
af41f54adb
Validate IPv6 addresses in urls ( #2079 )
2025-10-05 02:10:52 +02:00
Erik Dubbelboer
pj
dependabot[bot]
RW