ec00ff0e62
chore(deps): bump actions/checkout from 5 to 6 ( #2101 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-21 06:44:31 -03:00
5d415acb4e
chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 ( #2099 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.45.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:18:51 +01:00
cc8220f692
chore(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 ( #2097 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.46.0 to 0.47.0.
- [Commits](https://github.com/golang/net/compare/v0.46.0...v0.47.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.47.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-13 02:36:51 +01:00
7b3edaf4d9
chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 ( #2098 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.43.0 to 0.44.0.
- [Commits](https://github.com/golang/crypto/compare/v0.43.0...v0.44.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.44.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-13 01:22:27 +01:00
2a82a57b9d
Expose header parsing error variables ( #2096 )
2025-11-12 02:31:36 +01:00
e6c64e1d18
chore(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 ( #2094 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/sys/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-10 13:22:23 -05:00
afeeda6f6e
chore(deps): bump golangci/golangci-lint-action from 8 to 9 ( #2095 )
...
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action ) from 8 to 9.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases )
- [Commits](https://github.com/golangci/golangci-lint-action/compare/v8...v9 )
---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-10 13:22:04 -05:00
a38233e07d
chore(deps): bump actions/upload-artifact from 4 to 5 ( #2092 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-27 06:20:53 -06:00
1b8c5593da
Fix named return bugs
...
The new golangci-lint doesn't allow empty return statements anymore.
But returning a specific value with named return variables actually assigns it to the variable.
See: https://go.dev/play/p/kNhVx2scGx5
This caused a bug here: https://github.com/valyala/fasthttp/issues/2090
2025-10-23 23:47:40 +02:00
9ca6293984
chore(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 ( #2089 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.18.0 to 1.18.1.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Changelog](https://github.com/klauspost/compress/blob/master/.goreleaser.yml )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.0...v1.18.1 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.18.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-21 10:41:03 +02:00
77468f66c6
chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 ( #2088 )
...
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.9 to 2.22.10.
- [Release notes](https://github.com/securego/gosec/releases )
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml )
- [Commits](https://github.com/securego/gosec/compare/v2.22.9...v2.22.10 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.22.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-16 06:50:58 +02:00
3a2fdec290
chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 ( #2085 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.45.0 to 0.46.0.
- [Commits](https://github.com/golang/net/compare/v0.45.0...v0.46.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.46.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 12:47:32 +08:00
59f58c07be
chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 ( #2086 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.42.0 to 0.43.0.
- [Commits](https://github.com/golang/crypto/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 12:15:24 +08:00
dbfb82aabe
chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 ( #2087 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.36.0 to 0.37.0.
- [Commits](https://github.com/golang/sys/compare/v0.36.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 12:12:35 +08:00
b26ff48669
chore(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 ( #2084 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/net/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-08 06:32:00 +02:00
1962450629
Fix copyTrailer
...
Don't use it in PeekTrailerKeys and have it reuse the byte slices it might already
have.
2025-10-06 03:45:12 +02:00
2272d532e1
Reimplement flushing support for fasthttpadaptor ( #2081 )
...
Use a simpler implementation, and do more tests.
Instead of https://github.com/valyala/fasthttp/pull/2069
2025-10-06 03:22:13 +02:00
a17ec74999
Reject bad ipv6 hostnames ( #2076 )
2025-10-05 03:14:32 +02:00
f18eb9ef0c
Reject backslash absolute URIs and cache parse errors ( #2075 )
...
Keep our server behaviour the same as net/http.
2025-10-05 02:47:11 +02:00
bed90bcf09
Reject invalid hosts with multiple port delimiters ( #2077 )
2025-10-05 02:46:46 +02:00
d3fc682391
Validate schemes ( #2078 )
2025-10-05 02:23:42 +02:00
af41f54adb
Validate IPv6 addresses in urls ( #2079 )
2025-10-05 02:10:52 +02:00
75dcdb8bba
Fix username:password@ validation in urls ( #2080 )
2025-10-05 02:10:23 +02:00
ede09fad73
Limit FuzzTestHeaderScanner body size
2025-10-03 05:03:38 +02:00
0ad54a45d9
Update lint and fix new lint errors
2025-09-28 02:59:00 +02:00
e7d310fd76
Add DNS cache management methods for TCPDialer ( #2072 )
...
* Add DNS cache management methods for TCPDialer
Resolves #2066
This commit introduces two new methods for managing DNS cache in TCPDialer:
1. FlushDNSCache() - Clears all cached DNS entries, forcing fresh lookups
2. CleanDNSCache() - Removes only expired entries based on DNSCacheDuration
Key changes:
- Add FlushDNSCache() and CleanDNSCache() methods to TCPDialer
- Add global FlushDNSCache() and CleanDNSCache() functions for default dialer
- Refactor tcpAddrsClean() to extract reusable cleanExpiredDNSEntries() method
- Add comprehensive tests with mock resolver to verify caching behavior
Use case: Users can now set longer cache durations (e.g., 30 minutes) and
manually refresh DNS when needed, providing better control over DNS resolution
timing while maintaining performance benefits of caching.
* Remove CleanDNSCache method to reduce the API surface layer and related tests from TCPDialer
* fix: resolve godot linter issue in client_test.go
Add missing period to comment to comply with godot linter rule requiring
comments to end with proper punctuation.
2025-09-25 14:53:57 +08:00
563f4f66ed
chore(deps): bump securego/gosec from 2.22.8 to 2.22.9 ( #2073 )
...
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.8 to 2.22.9.
- [Release notes](https://github.com/securego/gosec/releases )
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml )
- [Commits](https://github.com/securego/gosec/compare/v2.22.8...v2.22.9 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.22.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-23 12:34:51 +08:00
e04490f830
Add flushing support to fasthttpadaptor ( #2054 )
...
* Add flushing support to fasthttpadaptor
* refactor(fasthttphandler): Fix comment typos
* refactor(fasthttphandler): Fix early closing of net/http handler
* refactor(fasthttphandler): Apply requested changes
* refactor(fasthttphandler): Reduce memory allocations by using sync.Pool
* refactor(fasthttphandler): Fix improper releaseNetHTTPResponseWriter
* refactor(fasthttphandler): Add buffer sync.Pool with panic assert
* refactor(fasthttphandler): Fix hijacked-related response writer race condition
* refactor(fasthttphandler): Rename bufW to bufRW
* refactor(fasthttphandler): Ensure proper responseMutex use
* refactor(fasthttphandler): Specify minBufferSize to ensure reading 32 KiB chunks in streaming mode
* refactor(fasthttphandler): Fix release logic
* refactor(fasthttphandler): Fix handlerConn race condition
* refactor(fasthttphandler): Explicitly ignore handlerConn close error
* refactor(fasthttphandler): Use sync.Once, sync.Cond, and a single channel for mode management
* refactor(fasthttphandler): Remove commented code
* refactor(fasthttphandler): Add period to respect linter
* refactor(fasthttphandler): Remove return else clauses to respect lint
2025-09-11 17:36:02 +02:00
e9640b4d39
Update benchmarks in readme
...
Remove benchmarks that don't work well.
2025-09-10 22:17:12 +02:00
4d25421ae5
Drop Go 1.23 support ( #2065 )
...
The Go team doesn't support this version anymore. This is required to
update our golang.org/x/... dependencies.
2025-09-10 22:16:01 +02:00
72dccd04fb
Fix extra whitespace parsing in HTTP request lines to prevent cache poisoning ( #2061 )
...
* Initial plan
* Fix FastHTTP whitespace parsing issue - reject extra spaces in request lines
Co-authored-by: erikdubbelboer <522870+erikdubbelboer@users.noreply.github.com >
* Format header.go and header_test.go with gofmt
Co-authored-by: erikdubbelboer <522870+erikdubbelboer@users.noreply.github.com >
* Fix gofumpt formatting and mirror linting issues in header_test.go
Co-authored-by: erikdubbelboer <522870+erikdubbelboer@users.noreply.github.com >
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: erikdubbelboer <522870+erikdubbelboer@users.noreply.github.com >
2025-09-09 13:42:19 -05:00
8c7d2bc051
chore(deps): bump actions/setup-go from 5 to 6 ( #2060 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5 to 6.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-05 12:56:20 +02:00
28b7880b32
server: refactor to use atomic type ( #2058 )
2025-08-24 13:49:14 +02:00
68d21ed008
docs: add fasthttp-auth to related projects section ( #2057 )
2025-08-24 12:58:03 +02:00
7ad0219d24
chore(deps): bump securego/gosec from 2.22.7 to 2.22.8 ( #2056 )
...
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.7 to 2.22.8.
- [Release notes](https://github.com/securego/gosec/releases )
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml )
- [Commits](https://github.com/securego/gosec/compare/v2.22.7...v2.22.8 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.22.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15 06:00:15 -04:00
f9d84d7c52
Rewrite header parsing to improve spec compliance ( #2030 )
...
This change updates header parsing to match the behavior of net/http more closely.
**Breaking change**: headers delimited by `\n` (instead of `\r\n`) are no longer supported.
Previously, fasthttp accepted `\n` as a delimiter, which is not spec compliant.
This made it difficult to correctly parse headers containing both `\n` and `\r\n`.
2025-08-12 15:49:35 +02:00
89010cb2c6
chore(deps): bump actions/checkout from 4 to 5 ( #2055 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-12 15:21:57 +02:00
1828bd4eee
Optimize fs to have 0 allocations ( #2052 )
...
When using caching fs shouldn't cause any allocations.
Only do []byte to string conversions when really needed. When a file is
already cached the conversion shouldn't be needed.
Fixes https://github.com/valyala/fasthttp/issues/2045
2025-08-10 00:06:11 +02:00
81ebee8c79
Fix PeekKeys()
...
RequestHeader.PeekKeys() and ResponseHeader.PeekKeys() were both
implemented wrong. The tests were also wrong causing this to never be
noticed. They both never actually returned all header keys, this has
been fixed now.
While this is a backwards incompatible change, I'm still going to
release it. Anyone using these functions would have noticed they
didn't work as documented and probably would not have continued using
them.
Fixes https://github.com/valyala/fasthttp/issues/2044
2025-08-09 13:50:07 +02:00
c20414a496
Remove BenchmarkCoarseTimeNow
...
This is not relevant anymore since CoarseTimeNow is just time.Now.
2025-08-09 13:12:17 +02:00
3f641c3246
chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 ( #2049 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.42.0 to 0.43.0.
- [Commits](https://github.com/golang/net/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-08 13:41:58 +02:00
51b4947320
test: replace atomic operations with atomic types ( #2048 )
2025-08-07 19:02:12 -04:00
1d8fe19359
Add reuseport support for Solaris ( #2046 )
2025-08-04 16:27:16 +02:00
01d533ad15
Fix RequestHeader.ContentLength() if disableSpecialHeader is true ( #2042 )
2025-07-27 08:20:03 +02:00
a1c842f19e
Fix trailer security ( #2043 )
...
Bad trailers weren't checked correctly.
Some bad trailers that could cause security issues weren't being
disallowed.
2025-07-27 08:19:46 +02:00
dab027680c
chore(deps): bump securego/gosec from 2.22.5 to 2.22.7 ( #2039 )
...
Bumps [securego/gosec](https://github.com/securego/gosec ) from 2.22.5 to 2.22.7.
- [Release notes](https://github.com/securego/gosec/releases )
- [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml )
- [Commits](https://github.com/securego/gosec/compare/v2.22.5...v2.22.7 )
---
updated-dependencies:
- dependency-name: securego/gosec
dependency-version: 2.22.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-22 12:40:29 +08:00
ab3c358753
zstdEncoderPool was never used
...
releaseZstdWriter() is never called, so zstdEncoderPool is only used for Get(), never Put().
We can just inline the non Get() path of acquireZstdWriter() and remove releaseZstdWriter().
Also fixed some spelling mistakes.
2025-07-21 05:33:35 +02:00
7e15e31a33
Simplify Client.Do function and lock usage ( #2038 )
...
* Optimization:
1. Simplify the Client.Do function, extract the acquisition of HostClient object into a separate function, and simplify the lock code
2. Remove redundant code from the AcquireReader and AcquireWriter functions of HostClient
* fix []byte to string 1 allocs/op
2025-07-19 14:37:13 +08:00
b1a54c8de5
chore(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 ( #2035 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.41.0 to 0.42.0.
- [Commits](https://github.com/golang/net/compare/v0.41.0...v0.42.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-11 07:32:40 +02:00
7ac856f71f
chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 ( #2036 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.39.0 to 0.40.0.
- [Commits](https://github.com/golang/crypto/compare/v0.39.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-11 07:21:09 +02:00
dependabot[bot]
RW
Erik Dubbelboer
Aabishkar Aryal
Giovanni Rivera
Copilot
cui
FAUST.
Oleksandr Redko
jwntree
byte0o