• Update fasthttp to v1.78.0 (#4779, #4803, #4862) fasthttp v1.78.0 (from v1.75.0) hardens request framing, multipart parsing, redirects and file serving, and speeds up path normalization, query parsing, header setters and Client.Do. https://github.com/valyala/fasthttp/releases/tag/v1.78.0
• Support map fields in query and form binding (#4788) Struct fields of type map[string]T now bind from query strings and form bodies; attributes[color] and attributes.color both give the key color.

  type Filter struct {
      Attributes map[string]string   `query:"attributes"` // ?attributes[color]=red&attributes.size=m
      Tags       map[string][]string `query:"tags"`       // ?tags[sale]=yes&tags[sale]=new
      Limits     map[string]int      `query:"limits"`     // ?limits[max]=5
  }

  https://docs.gofiber.io/api/bind#map-fields
• Add AllowSymlinksOutsideRoot to the static middleware (#4803) A root on disk is now confined: symbolic links that leave it, and absolute ones, are handled like missing files unless AllowSymlinksOutsideRoot is set.

  app.Use("/assets", static.New("./public", static.Config{
      AllowSymlinksOutsideRoot: true, // default: false
  }))

  https://docs.gofiber.io/middleware/static#config
• Let proxy.DoRedirects and the Fiber client drop extra sensitive headers on a redirect (#4800) New opt-in RedirectSensitiveHeaders on proxy.SecurityPolicy and the client (Client, Request, Config) names headers such as X-Api-Key that a redirect to another origin (proxy) or host (client) drops; empty by default.

  policy := proxy.DefaultSecurityPolicy()
  policy.RedirectSensitiveHeaders = []string{"X-Api-Key", "X-Auth-Token"}
  proxy.WithSecurityPolicy(policy)
  
  cli := client.New().SetRedirectSensitiveHeaders("X-Api-Key")

  https://docs.gofiber.io/middleware/proxy#headers-on-a-cross-origin-redirect

• Share host splitting and IDNA folding (#4851)
• Align forwarded header list parsing (#4847)
• Share forwarded IP scanning and ignore empty elements (#4820)
• Share redirect URL normalization (#4824)
• Speed up media type parameter parsing (#4807)
• Avoid allocations for empty typed lookups (#4852)
• Consolidate control-character scanning (#4783)
• cache/limiter: Walk Cache-Control lists with headerlist and write Retry-After without a string (#4833)
• cors/csrf: Share origin allow-list parsing (#4836)
• encryptcookie: Build the AEAD once per middleware instead of per cookie (#4838)
• etag: Checksum bodies with slicing-by-8 (#4794)
• limiter: Format rate-limit header values without allocating (#4822)
• proxy: Copy the forwarder name before storing it in the refused-request test (#4819)
• redirect/rewrite: Share pattern compilation (#4846)
• Share the client cookie jar host normalization (#4844)
• Share the value-redaction helper across middleware (#4821)
• Deduplicate the unit tests with shared helpers (#4825)
• Use a nolint:revive directive on App.Handler (#4831)

• Stop optional path parameters from swallowing a slash (#4778)
• Stat the index for directory SendFile ranges and move the path guards into internal/fspath (#4769)
• Skip empty forwarded host and proto elements and restore the Next loop (#4856)
• Preserve nil first field lines when joining headers (#4840)
• Return an empty charset when its value is not a token (#4781)
• Preserve redirects and errors in Fresh checks (#4811)
• Trim the whitespace around comma-split header values in Bind (#4793)
• Reject out-of-range int and uint in generic parsers on 32-bit (#4832)
• Make Links add to the Link header instead of replacing it (#4829)
• Serve a request with a TLS state over TLS in app.Test (#4839)
• Send the measured Content-Length of an unsized body in app.Test (#4830)
• Make Listen return when GracefulContext is done during startup (#4770)
• cache: End cached entries when a revalidation is refused with 401, 403 or 407 (#4785)
• cache: Release the lock when CacheInvalidator panics and simplify the lock flow (#4765)
• cache/proxy/session: Close the gaps found auditing the recent merges (#4855)
• compress: Honor repeated and quoted response Cache-Control lines (#4802)
• encryptcookie: Handle duplicate cookie names (#4774)
• hostauthorization: Compare IPv6 hosts by address, not by spelling (#4798)
• hostauthorization: Bound the port value, not its digit count (#4796)
• idempotency: Exclude unchanged upstream headers from storage (#4834)
• idempotency/proxy: Stop cookie replay and refuse path parameters (#4791)
• keyauth: Omit the Bearer error parameters from the challenge when no credentials are sent (#4837)
• limiter: Fix spec mismatches and consolidate its code and tests (#4762)
• limiter/proxy: Fix key aliasing and the redirect, SSRF and Balancer issues (#4784)
• static: Refuse a path with an empty first segment on a root mount (#4772)
• Synchronize client cookie jar reads during initialization (#4843)
• Return each key once from the client's QueryParam.Keys and FormData.Keys (#4776)
• Copy client response header keys before reading their values (#4771)
• Fix header, body, routing and session handling defects (#4850)

• Add a Migrate section to the README (#4790)
• Update ctx and intro examples (#4806)
• Explain bounding proxy-derived storage keys (#4841)
• Explain client and server redirect control-byte policies (#4842)
• logger: Explain the ignored SendStatus error in the fallback handler (#4826)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.1...v3.7.0

Thank you @10kartik, @Alifarid0011, @anqorithm, @appdever01, @arditxhuveli1, @b84330808, @Dev-next-gen, @ElsiPotka, @fadiromdhan3, @fadiroot, @gaby, @helmipradita, @IslamElsayed, @kaankucukx, @ninadsutrave, @nk-batman21, @PerryLink, @Rachit-Gandhi, @ReneWerner87, @RS-ITACHI, @via2004, @YOGESH256 and @yxshee for making this release possible.

v1.78.0 fixes lost responses during graceful shutdown and makes streamed bodies report truncation reliably. It also improves redirect handling, preserves multipart uploads when copying requests, and speeds up path normalization, query parsing, header operations, and concurrent client requests.

• Graceful shutdown preserves responses on keep-alive connections. An idle connection could be closed just as its next request entered the handler, leaving the client with EOF even though the handler had done the work. Shutdown now closes the idle connection before the handler runs or lets the active request finish. Buffered pipelined responses are flushed before the connection closes. #2537
• Incomplete chunked streams report an error. Streamed request and response bodies now report io.ErrUnexpectedEOF if the peer closes at a chunk boundary before the terminating chunk arrives. If the trailer section is incomplete, the stream returns ErrBrokenChunk wrapping io.ErrUnexpectedEOF. #2515, #2538
• Adapted net/http handlers preserve the final response after a 1xx status. A handler that writes 103 Early Hints followed by 200 OK now sends the 200 and its body. The adaptor does not forward the interim status; 101 Switching Protocols remains final. #2516
• Body-buffer retention is scoped to the request that enabled it. The server clears a handler's Request.KeepBodyBuffer and Response.KeepBodyBuffer settings before resetting for the next keep-alive request, so oversized buffers can be released according to the configured pool limit. #2508

• Redirects preserve links such as mailto: and native-app callbacks. RequestCtx.Redirect keeps targets with a scheme but no // intact. When the client receives a non-HTTP target of that form, it returns the 3xx response with its Location and no error. For references matching the base scheme, URI.Update resolves the remainder as relative: http:next against http://host/a/b resolves to http://host/a/next. #2503, #2506, #2507
• An invalid redirect location stops the client before it sends another request. When Location cannot be parsed, the client returns the redirect response and the parse error. The new URI.UpdateBytesErr exposes that error to callers; URI.Update and URI.UpdateBytes retain their existing behavior. #2523
• An explicit Authorization header takes precedence over URL credentials. When the header is empty, Basic authentication uses the percent-decoded username and password from the URI: p%40ss becomes p@ss, and a literal + stays +. URI.Parse also validates IPv6 literals with zone identifiers and rejects an empty zone. #2526, #2529, #2535

• Multipart forms parse and copy correctly. Form media types and the boundary parameter name are matched case-insensitively. Multipart parsing accepts optional whitespace around ; and preserves semicolons inside quoted parameter values. Request.CopyTo also preserves uploads parsed directly from the incoming body, so forwarding the copy no longer sends an empty body. #2511, #2512, #2517, #2521
• Cookie parsing preserves usable attributes. Expires again accepts RFC 1123 dates with zone names such as UTC. An unusable Domain or Path is ignored without discarding the cookie or skipping later attributes such as HttpOnly. #2519, #2524
• Compression works with single-file roots, mixed-case encodings, and zstd level zero. FS can again serve compressed content when Root names a file, keeping compressed copies in its parent directory. Body decoders match Content-Encoding case-insensitively, and zstd level 0 selects the default level instead of panicking. #2505, #2509, #2510

Path normalization skips unnecessary dot-segment checks for filenames such as /app.min.js. Query parsing locates escapes while splitting arguments, header operations avoid redundant scans, and Client.Do reduces contention between concurrent callers. #2513

In the PR benchmarks, parsing paths with file extensions took 40% less time, query parsing took 29% less time, and concurrent Client.Do dispatch with a no-op transport took 19% less time at GOMAXPROCS=4. End-to-end improvements were smaller: 4–6% less time for cached small files and 6–8% less time for in-memory client requests. Allocation counts were unchanged, and the pipelined server benchmarks showed no significant change. #2513

• perf: speed up path normalization, query parsing, header setters and Client.Do by @gaby in https://github.com/valyala/fasthttp/pull/2513

• fix: don't drop responses on keep-alive connections during Shutdown by @aaydin-tr in https://github.com/valyala/fasthttp/pull/2537
• fix: report a chunked body stream truncated at a chunk boundary by @jaeminbird in https://github.com/valyala/fasthttp/pull/2515
• Expand HTTP fuzz coverage and reject truncated chunked streams by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2538
• fix(fasthttpadaptor): don't take a 1xx as the final status by @jaeminbird in https://github.com/valyala/fasthttp/pull/2516
• fix: clear KeepBodyBuffer before resetting between keep-alive requests by @jaeminbird in https://github.com/valyala/fasthttp/pull/2508

• fix: keep redirect URIs that have a scheme but no authority by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2503
• fix(client): don't follow redirects to non-HTTP schemes by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2506
• fix: resolve same-scheme references without "//" as relative by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2507
• fix: stop following a redirect whose Location can't be parsed by @gaby in https://github.com/valyala/fasthttp/pull/2523
• fix: decode percent-encoded userinfo in URI.Parse by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2526
• fix: don't replace a set Authorization header with the URI userinfo by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2529
• fix: validate IPv6 literals that have a zone in URI.Parse by @b84330808 in https://github.com/valyala/fasthttp/pull/2535

• fix: match form media types and the boundary parameter case-insensitively by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2511
• fix: allow optional whitespace around ';' in multipart/form-data by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2512
• fix: don't end a multipart/form-data parameter at a ';' inside quotes by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2517
• fix: copy a multipart body that was parsed as it was read in Request.CopyTo by @gaby in https://github.com/valyala/fasthttp/pull/2521
• fix(cookie): accept Expires dates in a time zone other than GMT by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2519
• fix(cookie): ignore a Domain or Path that can't be used instead of failing to parse by @gaby in https://github.com/valyala/fasthttp/pull/2524

• fix(fs): allow compression when Root is a file by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2505
• fix: match Content-Encoding case-insensitively when decoding bodies by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2509
• fix: map zstd level 0 to the default level instead of panicking by @jaeminbird in https://github.com/valyala/fasthttp/pull/2510
• fix(reuseport): return ErrNoReusePort again when SO_REUSEPORT is unsupported by @ElsiPotka in https://github.com/valyala/fasthttp/pull/2527
• fix(pprofhandler): serve the index at /debug/pprof/ again by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2530

• chore(deps): bump github.com/molecule-man/go-brrr from 1.3.0 to 1.3.1 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2514
• chore(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2532

• @jaeminbird made their first contribution in https://github.com/valyala/fasthttp/pull/2508
• @ElsiPotka made their first contribution in https://github.com/valyala/fasthttp/pull/2527
• @b84330808 made their first contribution in https://github.com/valyala/fasthttp/pull/2535

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.77.0...v1.78.0

• 8398d5185416f80016a6077d36209ae87d20eb07: fix(deps): bump golang.org/x/net to v0.62.0 (#320) (@appleboy)

• b941676fdfc4823156524e23c63ee0395d295808: refactor: adopt modern Go idioms (#319) (@appleboy)

• 822c690d995c826b4eb3703dcb4fa3531e70e11d: ci: standardize lint tooling and testing (#317) (@appleboy)

• c9e4025b620bb69c2cfba2156f845883962bdd80: docs: fix CI workflow badges (#318) (@appleboy)

New: Detached(ctx) returns a channel that closes when the browser detaches the target of the context, after the target handled every message that came before the detach. It opens no target and returns the new error ErrNoTarget when the context has none yet. New: the context option WithListener(fn) adds a func of Listen before the first command, so fn sees the events of the start of a tab, such as the runtime.EventExecutionContextCreated events that answer Runtime.enable. Fix: the browser sometimes routed the detach of a target before a reply or an event that Chrome sent earlier, so a command returned ErrTargetDetached and Listen missed the event. The detach now goes through the same queue as the messages. See docs/API.md, examples 29 and 30, and the three decisions dated 2026-11-05. The changes come from onsi, in pull request #1646 and discussion #1645.

• Fuse bind and first step into one CGO crossing by @mattn in https://github.com/mattn/go-sqlite3/pull/1455
• Fuse step and column fetch into one CGO crossing in Next by @mattn in https://github.com/mattn/go-sqlite3/pull/1460
• fix: release replaced authorizer callbacks by @ryanchou1994 in https://github.com/mattn/go-sqlite3/pull/1458
• Return an error instead of crashing when a connection is used after Close by @mattn in https://github.com/mattn/go-sqlite3/pull/1462
• Report missing arguments when Exec has no arguments by @laodouya in https://github.com/mattn/go-sqlite3/pull/1471
• Upgrade SQLite to version 3540100 by @mattn in https://github.com/mattn/go-sqlite3/pull/1472

• @ryanchou1994 made their first contribution in https://github.com/mattn/go-sqlite3/pull/1458
• @laodouya made their first contribution in https://github.com/mattn/go-sqlite3/pull/1471

Full Changelog: https://github.com/mattn/go-sqlite3/compare/v1.14.52...v1.14.53

Fix: a command that is still pending when the browser detaches its target, for example when the page closes, now returns an error that wraps the new ErrTargetDetached. Before, Chrome sent no reply and the command waited until its context ended. A command that starts on a detached target fails at once. The issue was reported by onsi in discussion #1645.

New: Listen and ListenBrowser call a func for each event of the tab or the browser, in the order in which the events arrive from Chrome. The target calls the func before it reads the next message, so the func sees an event that arrived before the reply to a command before that command returns. Events and BrowserEvents give one iterator for each event type and give neither guarantee, so they stay the recommended API, and Listen is the lower level tool for code that needs the order across event types. The func gets the typed events of cdproto and no replies to commands. It runs in the loop that reads the messages of the tab, so it must return fast, must not run a command, must not call Listen and must not panic. See docs/API.md, example 28, and the decision docs/decisions/2026-11-04-export-the-ordered-event-listener.md. The idea comes from discussion #1645 by onsi.

https://ebitengine.org/en/documents/2.10.html#v2.10.6

Nightly preview of the upcoming v3.2.0.

• [v3] refresh systray menus on Menu.Update in PR by @johnmaguire
• [v3/Windows] Implement SetIcon for windows in PR by @hypherionmc

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.2.0-nightly.20261103

Tip: always pin an exact version (e.g. @v3.2.0-nightly.20261103) in go.mod and CI rather than @latest.