• Update fasthttp to v1.78.0 (#4779, #4803, #4862) fasthttp v1.78.0 (from v1.75.0) hardens request framing, multipart parsing, redirects and file serving, and speeds up path normalization, query parsing, header setters and Client.Do. https://github.com/valyala/fasthttp/releases/tag/v1.78.0
• Support map fields in query and form binding (#4788) Struct fields of type map[string]T now bind from query strings and form bodies; attributes[color] and attributes.color both give the key color.

  type Filter struct {
      Attributes map[string]string   `query:"attributes"` // ?attributes[color]=red&attributes.size=m
      Tags       map[string][]string `query:"tags"`       // ?tags[sale]=yes&tags[sale]=new
      Limits     map[string]int      `query:"limits"`     // ?limits[max]=5
  }

  https://docs.gofiber.io/api/bind#map-fields
• Add AllowSymlinksOutsideRoot to the static middleware (#4803) A root on disk is now confined: symbolic links that leave it, and absolute ones, are handled like missing files unless AllowSymlinksOutsideRoot is set.

  app.Use("/assets", static.New("./public", static.Config{
      AllowSymlinksOutsideRoot: true, // default: false
  }))

  https://docs.gofiber.io/middleware/static#config
• Let proxy.DoRedirects and the Fiber client drop extra sensitive headers on a redirect (#4800) New opt-in RedirectSensitiveHeaders on proxy.SecurityPolicy and the client (Client, Request, Config) names headers such as X-Api-Key that a redirect to another origin (proxy) or host (client) drops; empty by default.

  policy := proxy.DefaultSecurityPolicy()
  policy.RedirectSensitiveHeaders = []string{"X-Api-Key", "X-Auth-Token"}
  proxy.WithSecurityPolicy(policy)
  
  cli := client.New().SetRedirectSensitiveHeaders("X-Api-Key")

  https://docs.gofiber.io/middleware/proxy#headers-on-a-cross-origin-redirect

• Share host splitting and IDNA folding (#4851)
• Align forwarded header list parsing (#4847)
• Share forwarded IP scanning and ignore empty elements (#4820)
• Share redirect URL normalization (#4824)
• Speed up media type parameter parsing (#4807)
• Avoid allocations for empty typed lookups (#4852)
• Consolidate control-character scanning (#4783)
• cache/limiter: Walk Cache-Control lists with headerlist and write Retry-After without a string (#4833)
• cors/csrf: Share origin allow-list parsing (#4836)
• encryptcookie: Build the AEAD once per middleware instead of per cookie (#4838)
• etag: Checksum bodies with slicing-by-8 (#4794)
• limiter: Format rate-limit header values without allocating (#4822)
• proxy: Copy the forwarder name before storing it in the refused-request test (#4819)
• redirect/rewrite: Share pattern compilation (#4846)
• Share the client cookie jar host normalization (#4844)
• Share the value-redaction helper across middleware (#4821)
• Deduplicate the unit tests with shared helpers (#4825)
• Use a nolint:revive directive on App.Handler (#4831)

• Stop optional path parameters from swallowing a slash (#4778)
• Stat the index for directory SendFile ranges and move the path guards into internal/fspath (#4769)
• Skip empty forwarded host and proto elements and restore the Next loop (#4856)
• Preserve nil first field lines when joining headers (#4840)
• Return an empty charset when its value is not a token (#4781)
• Preserve redirects and errors in Fresh checks (#4811)
• Trim the whitespace around comma-split header values in Bind (#4793)
• Reject out-of-range int and uint in generic parsers on 32-bit (#4832)
• Make Links add to the Link header instead of replacing it (#4829)
• Serve a request with a TLS state over TLS in app.Test (#4839)
• Send the measured Content-Length of an unsized body in app.Test (#4830)
• Make Listen return when GracefulContext is done during startup (#4770)
• cache: End cached entries when a revalidation is refused with 401, 403 or 407 (#4785)
• cache: Release the lock when CacheInvalidator panics and simplify the lock flow (#4765)
• cache/proxy/session: Close the gaps found auditing the recent merges (#4855)
• compress: Honor repeated and quoted response Cache-Control lines (#4802)
• encryptcookie: Handle duplicate cookie names (#4774)
• hostauthorization: Compare IPv6 hosts by address, not by spelling (#4798)
• hostauthorization: Bound the port value, not its digit count (#4796)
• idempotency: Exclude unchanged upstream headers from storage (#4834)
• idempotency/proxy: Stop cookie replay and refuse path parameters (#4791)
• keyauth: Omit the Bearer error parameters from the challenge when no credentials are sent (#4837)
• limiter: Fix spec mismatches and consolidate its code and tests (#4762)
• limiter/proxy: Fix key aliasing and the redirect, SSRF and Balancer issues (#4784)
• static: Refuse a path with an empty first segment on a root mount (#4772)
• Synchronize client cookie jar reads during initialization (#4843)
• Return each key once from the client's QueryParam.Keys and FormData.Keys (#4776)
• Copy client response header keys before reading their values (#4771)
• Fix header, body, routing and session handling defects (#4850)

• Add a Migrate section to the README (#4790)
• Update ctx and intro examples (#4806)
• Explain bounding proxy-derived storage keys (#4841)
• Explain client and server redirect control-byte policies (#4842)
• logger: Explain the ignored SendStatus error in the fallback handler (#4826)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.1...v3.7.0

Thank you @10kartik, @Alifarid0011, @anqorithm, @appdever01, @arditxhuveli1, @b84330808, @Dev-next-gen, @ElsiPotka, @fadiromdhan3, @fadiroot, @gaby, @helmipradita, @IslamElsayed, @kaankucukx, @ninadsutrave, @nk-batman21, @PerryLink, @Rachit-Gandhi, @ReneWerner87, @RS-ITACHI, @via2004, @YOGESH256 and @yxshee for making this release possible.

• mark the fiber/v2 module as deprecated in favor of v3 by @gaby in https://github.com/gofiber/fiber/pull/4789

• cors: reject empty subdomain labels in CORS wildcard origins by @ReneWerner87 in https://github.com/gofiber/fiber/pull/4792

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.15...v2.52.16

• Consolidate media-type parameter parsing into internal/mediatype (#4750)
• Fix modernize and revive lint issues (#4759)

• Fix client, session, basicauth and other bugs found in the audit (#4752)

• bump github.com/gofiber/utils/v2 from 2.6.1 to 2.6.2 (#4760)
• bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#4757)
• bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 (#4758)
• bump the golang-modules group with 3 updates (#4755)
• bump release-drafter/release-drafter from 7.9.0 to 7.10.0 (#4756)
• bump actions/setup-node from 7.0.0 to 7.1.0 (#4754)

• Sync the documentation with the v3.6.0 code (#4751)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.0...v3.6.1

Thank you @alexandear, @gaby, @ninadsutrave and @ReneWerner87 for making this release possible.

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

Negative is faster than v2. v3.6.0 was measured on main three days before the release. All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again. https://gofiber.github.io/benchmarks/

• Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596) New tokenless middleware that rejects unsafe cross-origin browser requests by their Sec-Fetch-Site and Origin headers; no cookie, token or storage needed.

  app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
      TrustedOrigins: []string{"https://admin.example.com"},
  }))

  https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
• Update fasthttp to v1.75.0 (#4667, #4740) fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing. https://github.com/valyala/fasthttp/releases/tag/v1.75.0
• Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715) ReadBufferSize and WriteBufferSize now default to 8192 bytes (was 4096), which also raises the default request header limit; explicitly configured values are kept.

  app := fiber.New(fiber.Config{
      ReadBufferSize:  4096, // previous default, now 8192
      WriteBufferSize: 4096, // previous default, now 8192
  })

  https://docs.gofiber.io/api/fiber#readbuffersize
• Expand context, response and request helpers (#4638) New helpers on Req, Res and Ctx such as Bearer, Origin, IsSafe, Del, StatusCode, GetCookies, Elapsed and RouteName; request helpers are now also reachable through c.Req().

  token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
  c.Del("X-Powered-By") // remove a response header
  took := c.Elapsed()   // time spent on this request so far

  https://docs.gofiber.io/api/ctx
• Add Endpoint() for middleware look-ahead (#4601) New c.Endpoint() returns the route that will handle the request without advancing the handler chain (nil on 404/405).

  app.Use(func(c fiber.Ctx) error {
      if route := c.Endpoint(); route != nil {
          // enforce access control using route.Path or route.Name
      }
      return c.Next()
  })

  https://docs.gofiber.io/api/ctx#endpoint
• Add ordered RuleList to the redirect and rewrite middleware (#4621, #4633) New RuleList []Rule in redirect and rewrite is tried in the order written, first match wins; the Rules map is deprecated and setting both panics.

  app.Use(redirect.New(redirect.Config{
      RuleList: []redirect.Rule{
          {From: "/old", To: "/new"},      // checked first
          {From: "/old/*", To: "/new/$1"}, // takes everything else
      },
  }))

  https://docs.gofiber.io/middleware/redirect#rule-order
• Render configured templates to a writer (#4594) New app.Render writes a template through the configured view engine to any io.Writer without creating an HTTP response, e.g. for SSE or HTMX partials.

  var buf bytes.Buffer
  if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil {
      return err
  }

  https://docs.gofiber.io/api/app#render
• Add final request hooks to the HTTP client (#4595) New AddFinalRequestHook runs after the built-in hooks, immediately before the request is sent, when RawRequest holds the resolved URL, merged headers and serialized body.

  cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error {
      raw := req.RawRequest
      raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body()))
      return nil
  })

  https://docs.gofiber.io/client/hooks#final-request-hooks
• Add SetLocal, a request-local store without the variadic's heap slice (#4687) New c.SetLocal(key, value) stores a request-local value exactly like c.Locals(key, value), without the one-element slice that call allocates. https://docs.gofiber.io/api/ctx#setlocal
• Add DisableFlashMessages and filter route candidates with a probe constant (#4655) New fiber.Config option DisableFlashMessages turns off redirect flash messages and the per-request fiber_flash cookie scan (off by default); the router gains a precomputed probe-constant filter.

  app := fiber.New(fiber.Config{
      DisableFlashMessages: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#disableflashmessages
• Add source-aware extraction to extractors without a new struct field (#4603) New extractors.Resolve returns the value together with the Source and Key of the chain child that produced it; the Extractor struct is unchanged.

  ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key"))
  res, err := extractors.Resolve(ex, c)
  // res.Value, plus res.Source and res.Key of the child that won

  https://docs.gofiber.io/guide/extractors#source-aware-extraction

• Require Go 1.26 (#4654)
• Filter large route buckets before loading routes and bind without building a map (#4705)
• Filter a route bucket by static path before loading the route (#4688)
• Consolidate route pattern preprocessing (#4710)
• Share route and client :name path delimiters (#4636)
• Normalize header keys in one pass and match canonical media types directly (#4690)
• Share streaming header join logic (#4734)
• Consolidate comma-list header scanning into internal/headerlist (#4637)
• Consolidate entity-tag parsing into internal/etag (#4632)
• Adopt utils/v2 helpers and cut per-request allocations in the hot path (#4666)
• cors/csrf: Consolidate origin matching into internal/origin (#4653)
• limiter: Lock keys per shard instead of globally (#4702)
• redirect/rewrite: Share capture substitution (#4749)
• session: Skip the gob re-encode when a session was only read (#4703)
• Cut the per-request cost of the extractors (#4678)
• Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps (#4729)
• Close three test coverage gaps in logger, shutdown and docs (#4615)
• Add a regression test and docs example for CustomCtx overrides behind middleware (#4598)
• Add a regression test and docs note that Context() is not canceled on graceful shutdown (#4599)
• Trigger Dependabot in gofiber/benchmarks after releases (#4682)

• Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware (#4695)
• Keep stray percents from forging escapes, root every request target and take the SendFile name literally (#4719)
• Let empty optional params yield to later required segments (#4722)
• Fix panic on route pattern with trailing escape character (#4717)
• Preserve names for merged multi-method routes (#4663)
• Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount (#4620)
• Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()[4:]) (#4674)
• Escape parameter values in generated route URLs (#4629)
• Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent (#4721)
• Accept tab OWS in X-Forwarded-For and share one OWS trim helper (#4735)
• Treat Vary field names as case-insensitive (#4642)
• Unify cookie SameSite handling (#4630)
• Prevent unbounded handler growth when SendFile serves a function-backed fs.FS (#4656)
• Prevent typed-nil view engine panics (#4662)
• Report the real status for fasthttp-level request errors (#4614)
• Drain in-flight requests before Listen returns (#4701)
• basicauth: Equalize verification time across mixed hash algorithms (#4726)
• basicauth: Refuse a repeated Authorization field (#4738)
• basicauth/keyauth: Use HTTP quoted strings in auth challenges (#4631)
• cache: Delete stale entries after uncacheable revalidation (#4590)
• cache: Key entries by request scheme and host (#4736)
• cache: Replay Vary on cache hits and mark credential-keyed entries private (#4744)
• compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper (#4708)
• idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers (#4693)
• limiter: Bound the rate-limit key before it reaches storage (#4677)
• proxy: Apply the client's Connection listing to the request as received (#4745)
• proxy: Fold DomainForward's configured hostname to Punycode (#4673)
• proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers (#4725)
• proxy: Preserve IPv6 brackets in domain forwarding (#4689)
• redirect/rewrite: Read "$10" as the tenth capture in targets (#4692)
• session: Honor chain-level extractors and close three write-back holes (#4679)
• static: Align file resolution with routed paths (#4712)
• static: Reject partial wildcard matches that cross a path segment boundary (#4728)
• Decode a path parameter exactly once in FromParam (#4626)
• Anchor and escape client path parameter substitution (#4625)
• Keep a stale client Response from releasing a reused Request on Close (#4659)
• Parse malformed Set-Cookie attributes in the client in linear time (#4658)
• Make static, proxy, adaptor and rewrite act on the path the router matched (#4720)
• Fix RFC 9110/9112 compliance gaps in core, static and timeout (#4747)
• Fix correctness issues across core, router, binder, client and middleware (#4652)

• Clarify that c.IP() walks the proxy chain only with EnableIPValidation (#4737)
• Explain what MIMETypes does to an existing format (#4664)
• Document the nested and array field notations in Bind (#4616)
• Add a minimal CRUD and healthcheck guide (#4696)
• Fix British to American English spellings across docs (#4697)
• Update README documentation links (#4711)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0

Thank you @00200200, @Arvin-Lee, @AshSgDe29071999, @BitWeaverDev, @Dev-next-gen, @Rachit-Gandhi, @ReneWerner87, @Rohilalala, @RubenPari, @VedantMadane, @ZihxS, @aditya-rohilla, @drakeo338, @evgenyponomarev, @fadiromdhan3, @fadiroot, @gaby, @h2zi, @haimingZZ, @ibraah007, @jabrailkhalil, @lazerg, @official-burak and @truongbo17 for making this release possible.

• Harden proxy middleware (#4405) New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })

  https://docs.gofiber.io/middleware/proxy#security
• Add support for custom binding precedence (#4544) New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }

  https://docs.gofiber.io/api/bind#custom-precedence
• Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486) New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

• Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
• Quick-reject routes on precomputed slash-count bounds (#4517)
• Restore Route inlining lost in the RFC 9110 changes (#4501)
• Skip the Accept join allocation in the Format emptiness check (#4503)
• Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
• Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
• Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
• Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
• adaptor: Cut allocations on the net/http bridge (#4559)
• cache: Optimize key generation and allocation (#4608)
• cors: Fold preflight Vary calls into one header scan (#4502)
• csrf: Optimize trusted subdomain matching (#4543)
• proxy: Optimize balancer round-robin (#4549)
• session: Use make() to preallocate relevantExtractors (#4562)
• De-flake the clock-sensitive tests (#4575)

• Fix open redirects in composed route URLs and redirect rules (#4584)
• Preserve published route buckets during rebuilds (#4579)
• URL-encode query values in Redirect.Route (#4529)
• Accept the full float64 range in the float route constraint (#4528)
• Match HTTP field names the way a recipient must (#4585)
• Honor Accept weights followed by whitespace before the comma (#4550)
• Compare Accept media types case-insensitively (#4493)
• Honor q=0 rejections in content negotiation (#4508)
• Honor duplicate Content-Encoding after empty values (#4514)
• Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)
• Avoid reading omitted request bodies in Bind.All (#4565)
• Combine repeated proxy headers for client IP extraction (#4568)
• Close the listener on Listen error paths to avoid FD leaks (#4532)
• Fire OnPostShutdown once with the real shutdown error (#4531)
• Keep all NewErrorf args when the first isn't a format string (#4530)
• adaptor: Preserve Connection tokens (#4606)
• cache: Honor only-if-cached for non-shareable entries (#4589)
• cache: Stop charging its own latency as response age (#4578)
• healthcheck: Answer HEAD probes with the GET status (#4577)
• limiter: Floor sub-second expiration in the sliding window (#4564)
• proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)
• proxy: Guard runtime helpers against DNS rebinding (#4518)
• proxy: Preserve empty-query URL semantics (#4513)
• redirect: Rank wildcards behind character classes in rule ordering (#4607)
• static: Fix leading-slash normalization for fs.FS root paths (#4507)
• Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)
• Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

• Explain adjacent multi-param capture rules (#4597)
• Document Ctx as a never-cancelable context (#4560)
• Move README.md to the repo root so pkg.go.dev renders it (#4505)
• logger: Explain when the error tag is populated (#4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.

• idempotency: release MemoryLock keys on unlock #4569

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.14...v2.52.15

• backport BalancerForward X-Real-IP overwrite fix to v2 by @terraincognita07 in https://github.com/gofiber/fiber/pull/4495

• @terraincognita07 made their first contribution

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.13...v2.52.14

• Complete HTTP QUERY method support (#4436, #4456) Adds the HTTP QUERY method (RFC 10008): fiber.MethodQuery, app.Query() routing, safe/idempotent handling in csrf, idempotency, earlydata and cache, plus client.Query() shorthands.

  app.Query("/search", func(c fiber.Ctx) error {
      return c.Send(c.Body()) // QUERY carries the query expression in the body
  })

  https://docs.gofiber.io/client/rest#query
• Add WithContext variants for session storage I/O (#4393) SaveWithContext, DestroyWithContext, RegenerateWithContext and ResetWithContext propagate deadlines/cancellation to the session storage backend; the plain methods keep working unchanged.

  sess := session.FromContext(c)
  err := sess.SaveWithContext(ctx) // storage write bounded by ctx

  https://docs.gofiber.io/middleware/session#session-with-context-timeoutscancellation
• Unify internal and custom constraints into a single interface (#4397) Built-in and custom route constraints now share one ConstraintHandler interface; the optional ConstraintAnalyzer precomputes constraint data at route registration, removing per-request parsing. Existing CustomConstraint implementations keep working unchanged.

  app.RegisterCustomConstraint(evenConstraint{}) // implements Name() + Execute()
  app.Get("/items/:id<even>", handler)

  https://docs.gofiber.io/guide/routing#constrainthandler-interface
• Expose prefork RecoverInterval and ShutdownGracePeriod (#4491) New ListenConfig knobs: PreforkRecoverInterval delays respawning a crashed child (default 0) and PreforkShutdownGracePeriod sets how long the master waits after SIGTERM before SIGKILL (default 5s).

  app.Listen(":3000", fiber.ListenConfig{
      EnablePrefork:              true,
      PreforkRecoverInterval:     time.Second,
      PreforkShutdownGracePeriod: 10 * time.Second,
  })

  https://docs.gofiber.io/api/fiber#preforkrecoverinterval

• Reduce avoidable work in the request hot path (#4490)
• Avoid per-request heap allocation in DefaultErrorHandler (#4446)
• Use sentinel errors on typed-getter and Range parse failures (#4448)
• Replace appendLowerBytes with utilsbytes.UnsafeToLower (#4468)
• Add MIMETextEventStream constant (#4415)
• Cache binder decoder type metadata across requests (#4447)
• Eliminate double reflection in binder mergeStruct (-10% allocs) (#4385)
• Reduce binder data map allocations (#4379)
• cache: Append canonical key segments into the pooled buffer (#4450)
• cors: Optimize subdomain origin matching (#4482)
• cors: Optimize exact-origin lookup to O(1) (#4368)
• csrf/redirect: Share scheme/host matching and skip url.Parse on the hot path (#4449)
• Narrow client user hook lock scope safely (#4375)
• Raise middleware coverage above 90% for timeout, logger, idempotency, limiter, cache (#4466)
• Cover remaining cors/csrf middleware branches (#4462)
• Add unit tests for isOriginSerializedOrNull (#4461)
• Cover session deadline/error paths and delegate Middleware lifecycle methods (#4435)
• Inject clock to make time-dependent tests deterministic (#4430)
• Rename benchmark cases (#4383)
• Remove test-only dead code and add manual deadcode workflow (#4458)
• Remove dead code flagged by static analysis (#4454)
• Static analysis cleanups (#4444)
• Fix modernize lint issues (#4315)

• Evaluate If-Modified-Since when If-None-Match is absent in Fresh (#4488)
• Fix open redirect via Redirect().Back() by validating the Referer header origin (#4370)
• Fix data race on lazy appListKeys generation in Render (#4440)
• Avoid route fallback errors during server error middleware traversal (#4426)
• Strip all trusted proxy IPs from X-Forwarded-For chain (#4394)
• Guard typed-nil errors (#4407)
• Guard typed-nil Fiber error paths without reflection (#4372)
• Preserve legacy custom constraint arguments (#4432)
• Remove unreachable SameSiteDefaultMode case (#4471)
• Detach quoted filename strings from pooled buffers (#4374)
• Prevent app.init mutex deadlock on panic (#4366)
• Enforce CertClientFile for AutoCertManager TLS (#4312)
• cache: Separate authorization key segment (#4467)
• cache: Hash QUERY body keys (#4459)
• cache: Evaluate freshness after locking (#4419)
• cors: Validate wildcard origins before matching (#4438)
• cors: Reject empty wildcard labels (#4437)
• csrf: Validate nested extractor chains (#4439)
• csrf: Port CORS subdomain match fixes (#4455)
• etag: Skip Server-Sent Events responses (#4487)
• Guard extractor introspection cycles (#4453)
• helmet: Use Scheme() for HTTPS detection and validate HSTS configuration (#4389)
• hostauthorization: Reject malformed hostnames in wildcard path (#4408)
• idempotency: Make MemoryLock safe for zero-value use (#4371)
• limiter: Correct fixed-window hit credit on skipped requests (#4422)
• logger/cache/storage: Remove unbounded background goroutines (#4378)
• pprof/proxy: Fix trailing-slash redirect and balancer empty-server panic (#4421)
• proxy: Bound upstream connections by default (#4369)
• rewrite/redirect: Anchor rules to the start of the path (#4483)
• session: Prevent session fixation by preserving successful extractor in chains (#4469)
• session: Prevent store error disclosure (#4424)
• session: Restore isFresh field name (#4477)
• sse: Preserve trailing newlines in event data (#4414)
• timeout: Isolate default timeout responses (#4442)
• timeout: Reclaim abandoned fiber.Ctx via ScheduleReclaim latch (#4359, #4400)
• Fix client config locking races (#4470)
• Fix client default access race in Replace/C path (#4377)
• Handle panics in client execFunc without crashing callers (#4365)
• Address bugs found in codebase audit (#4420)
• Fix cleanup follow-ups and regression coverage (#4380)

• Restructure routing guide and split handler partials (#4311)
• Fix Ctx.Scheme/Protocol documentation (#4473, #4474)
• Clarify client hook concurrency contract (#4386)
• keyauth: Fix extractor examples (#4409)
• Add FAQ troubleshooting entry for the "id <= evictCount" (hpack/gRPC) panic (#4475)
• Replace interface{} with any (Go 1.18+) (#4433)
• Document thread-safety contracts for mutex-backed public types (#4367)
• Enhance sponsorship section in README (#4402)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.3.0...v3.4.0

Thank you @0xghost42, @Amirhf1, @DucMinhNe, @Fenny, @MD-Mushfiqur123, @ReneWerner87, @alexandear, @fereidani, @gaby, @james-yusuke, @ksw2000, @nekoworks-magic, @niksis02, @pageton, @sixcolors and @talktokim for making this release possible.

• Add support for configuring the Regex engine on the router (#4254) Swap the compiler used for regex() route constraints. Assign a drop-in engine such as coregex.MustCompile for faster matching;Fiber reuses the compiled matcher across requests.

  app := fiber.New(fiber.Config{
      RegexHandler: coregex.MustCompile, // default: regexp.MustCompile
  })

  https://docs.gofiber.io/api/fiber#regexhandler
• Host auth middleware (#4199) New hostauthorization middleware that validates the incoming Host header against an allowlist (exact host, .subdomain wildcard, CIDR range) to protect against DNS rebinding attacks.

  app.Use(hostauthorization.New(hostauthorization.Config{
      AllowedHosts: []string{"api.myapp.com", ".myapp.com", "10.0.0.0/8"},
  }))

  https://docs.gofiber.io/middleware/hostauthorization
• Delegate implementation to fasthttp/prefork (#4210) Prefork now delegates to fasthttp's prefork package and adds PreforkRecoverThreshold (max child restarts before the master exits) and PreforkLogger to ListenConfig. https://docs.gofiber.io/api/fiber#preforkrecoverthreshold
• Add support for contextual logs (#4241) Render request-scoped fields in log.WithContext(c) by configuring a template with log.SetContextTemplate, reusing the middleware/logger engine (including ${value:key} for arbitrary context values).

  log.MustSetContextTemplate(log.ContextConfig{Format: log.RequestIDFormat})
  
  app.Get("/", func(c fiber.Ctx) error {
      log.WithContext(c).Info("start") // renders the request id
      return c.SendString("ok")
  })

  https://docs.gofiber.io/api/log#bind-context
• Add storage backed SharedState for prefork applications (#4243) A prefork-safe, storage-backed key/value store via app.SharedState() for data shared across workers/processes, with JSON/MsgPack/CBOR/XML helpers and automatic key namespacing. app.State() stays process-local.

  app := fiber.New(fiber.Config{
      SharedStorage: redis.New(), // any fiber.Storage shared across workers
  })
  app.SharedState().SetJSON("config", cfg, 0)

  https://docs.gofiber.io/api/state#sharedstate-prefork-safe
• Add lightweight SSE middleware (#4239) A Fiber-native middleware/sse for Server-Sent Events: SSE headers, event/comment/retry frames, per-write flushing, heartbeats, Last-Event-ID access, and disconnect detection via stream.Context().

  app.Get("/events", sse.New(sse.Config{
      Handler: func(c fiber.Ctx, stream *sse.Stream) error {
          return stream.Event(sse.Event{Name: "message", Data: fiber.Map{"message": "hello"}})
      },
  }))

  https://docs.gofiber.io/middleware/sse

• Add prefixes to unexported boolean fields (#4300)
• Improve error messages in SaveFileToStorage (#4173)
• Streamline request handler selection and context management for improved performance (#4233)

• Preserve mounted sub-app regex handler during mount prefixing (#4308)
• Trim only one trailing dot in host normalization (#4307)
• Reject oversized unknown-length adaptor request bodies (#4306)
• Fix compress middleware's shouldSkip method to avoid memory growth (#4284)
• Reject malformed host authorities in hostauthorization (#4293)
• Synchronize view reloads with template rendering (#4288)
• Avoid panic for non-struct listeners in TLS config discovery (#4305)
• Clear plaintext cookie when encryption fails (#4303)
• Fix regex route constraint parsing with literal > (#4292)
• Reject empty normalized host before dynamic matching (#4291)
• Preserve idempotency replay protection for oversized responses (#4287)
• Enforce CookieJar domain acceptance and host-only cookie matching (#4282)
• Avoid panic when reading released Fiber context values (#4271)
• Enforce static root for fs-backed directory serving (#4277)
• Prevent negative paginate start overflow (#4272)
• Prevent SharedState namespace key collisions (#4274)
• Copy FullURL string before returning pooled buffer (#4275)
• Enforce paginate sort allowlist when AllowedSorts is unset (#4276)
• Validate and safely apply workflow version updates (#4273)
• Close BodyStream in adaptor FiberHandler streaming path (#4267)
• Prevent panic when MsgPack is not configured (#4268)
• Keep IsFromLocal loopback-only and add unix-socket helper (#4270)
• Prevent panic when CBOR is not explicitly configured (#4269)
• Guard session logger tag against released middleware (#4265)
• Add X-Real-IP protection to Forward and DomainForward variants (#4261)
• Ensure BalancerForward overwrites X-Real-IP header (#4260)
• Add test coverage for multipart BodyLimit error handling (#4237)
• Improve error propagation in Express-style handler (#4250)
• Remove SSE Next and clarify SSE handler docs (#4247)
• BasicAuth verifier for unknown users (#4245)

• Fix invalid RouteChain method chaining example (#4304)
• Harden reverse proxy X-Forwarded-For example (#4266)
• Correct fasthttpctx Done semantics in context guide (#4264)
• Clarify ${bytesSent} behavior in logger middleware (#4251)
• Clarify prefork security model and OS-specific socket behavior (#4240)

📒 Documentation: https://docs.gofiber.io/next/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.2.0...v3.3.0

Thank you @ReneWerner87, @elton-peixoto-lu, @gaby, @gtoxlili, @lyyvalhalla, @mutantkeyboard, @pageton and @pratikramteke for making this release possible.

• Escape HTML output in Ctx.Format by @gaby in https://github.com/gofiber/fiber/pull/4232

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.12...v2.52.13