What's Changed

• fix(fasthttpproxy): select proxies from the request scheme by @dev-willbird1936 in #2334
• test: scale short timeouts with testTimeout to reduce -race flakiness by @ReneWerner87 in #2339
• fix: drop zeroed entries from the perIPConnCounter map by @ReneWerner87 in #2337
• perf: skip the unusable per-call file cache in ServeFS by @ReneWerner87 in #2338
• test: return after a failed Dial instead of dereferencing a nil conn by @ReneWerner87 in #2341
• fix: don't recycle an idle timestamp its connection still owns by @ReneWerner87 in #2342
• reject Transfer-Encoding on HTTP/1.0 requests by @alhudz in #2330
• only treat "//" in URI.Update as an authority after a scheme by @alhudz in #2345
• fix: consume informational responses before the final response by @dev-willbird1936 in #2333
• fix: reject out-of-range Content-Length instead of wrapping it by @lenamonj in #2343
• perf: zero-copy chunked body writes via io.WriterTo by @sasgas in #2310
• fix: don't close the shutdown done channel twice by @ReneWerner87 in #2340
• Rename ChunkedBodyWriterTo to BodyWriterTo and use in more places by @erikdubbelboer in #2348
• chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in #2349
• fix: small read buffer error doesn't match the ignored string anymore by @Pedr0Rocha in #2356
• Add canonical header lookup by @fzlzjerry in #2354
• chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #2361
• chore(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 by @dependabot[bot] in #2360
• Fix a pooled timer panic and a test data race by @h2zi in #2351
• fix: send / as the path when the request-target is query-only by @official-burak in #2371
• perf: try to avoid reallocations while reading zstd compressed requests by @ethercrow in #2357
• feat: add the QUERY method (RFC 10008) by @h2zi in #2358
• fix: wait for streaming reads before releasing pooled resources by @tbphp in #2353
• Replace github.com/andybalholm/brotli with github.com/molecule-man/go-brrr by @gaby in #2366
• Always stream response bodies when requested by @erikdubbelboer in #2373
• chore(deps): bump securego/gosec from 2.28.0 to 2.29.0 by @dependabot[bot] in #2375
• fix: let request timeouts override client timeouts by @Harshal96 in #2372
• avoid race condition for closing the streaming connection at EOF by @akshaydeo in #2379
• Give TestClientHeadWithBody a CI-proof read timeout by @h2zi in #2374
• fix: prevent stale query string after clearing query args by @cuishuang in #2380
• feat(examples): add zero-allocation server example by @aabishkaryal in #2362
• chore(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 by @dependabot[bot] in #2384

New Contributors

• @lenamonj made their first contribution in #2343
• @sasgas made their first contribution in #2310
• @Pedr0Rocha made their first contribution in #2356
• @fzlzjerry made their first contribution in #2354
• @h2zi made their first contribution in #2351
• @official-burak made their first contribution in #2371
• @ethercrow made their first contribution in #2357
• @tbphp made their first contribution in #2353
• @akshaydeo made their first contribution in #2379

Full Changelog: v1.73.0...v1.74.0

What's Changed

• test: fix host comparison in FuzzURIParse by @ReneWerner87 in #2313
• perf: avoid redundant scans when parsing request headers by @ReneWerner87 in #2312
• Fix temp file leak in SaveMultipartFile on cross-device rename failure by @itxaiohanglover in #2311
• re-enable forcetypeassert by @Harshal96 in #2316
• test: normalize Go test names by @Harshal96 in #2317
• feat: prefix sentinel error strings by @Harshal96 in #2319
• fix(pprofhandler): use exact path matching to prevent debug data exposure by @xbrxr03 in #2302
• avoid following a symlink when writing the FS compressed cache by @alhudz in #2321
• refactor: improve internal interface names by @Harshal96 in #2318
• fix: lowercase error strings by @Harshal96 in #2320
• perf: reduce redundant scans and allocations in hot paths by @ReneWerner87 in #2322
• validate domain and path cookie attribute values on parse by @alhudz in #2315
• chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 by @dependabot[bot] in #2328
• chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #2329
• fix: preserve pre-set status code in NewFastHTTPHandler by @xbrxr03 in #2323
• chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot[bot] in #2331
• reject backslash '..' traversal in fs handler on windows by @alhudz in #2327
• fix: reject Windows alternate data stream paths in FS by @dev-willbird1936 in #2335
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot[bot] in #2307
• chore(deps): bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by @dependabot[bot] in #2308
• chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by @dependabot[bot] in #2309
• chore(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by @dependabot[bot] in #2314
• chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in #2326
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #2324
• chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #2325

New Contributors

• @itxaiohanglover made their first contribution in #2311
• @Harshal96 made their first contribution in #2316
• @dev-willbird1936 made their first contribution in #2335

Full Changelog: v1.72.0...v1.73.0

What's Changed

• Update to go1.25 as minimal version by @erikdubbelboer in #2205
• client: add aggregate connection count metrics by @z9z in #2201
• fix(server): return ErrMissingFile when MultipartForm.File is nil by @u5surf in #2260
• bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (#2218), #2247 by @erikdubbelboer in #2271
• bug: data race on pipeline client c.chR during worker drain (#2220) by @erikdubbelboer in #2272
• bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (#2222) by @erikdubbelboer in #2273
• bug: double concurrency counter increment in ServeConn causes counter leak (#2238) by @erikdubbelboer in #2275
• bug: body stream leak in compression methods when response is discarded (#2244) by @erikdubbelboer in #2276
• bug: InMemoryListener deadlock under high concurrency (#2245) by @erikdubbelboer in #2277
• bug: fasthttpadaptor writer leak, data race, and crash on handler panic (#2246) by @erikdubbelboer in #2278
• bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (#2248) by @erikdubbelboer in #2279
• bug: closeIdleConns TOCTOU race with serveConn idle timestamp (#2250) by @erikdubbelboer in #2280
• bug: AppendCert/AppendCertEmbed not thread-safe (#2251) by @erikdubbelboer in #2281
• bug: SetBodySizePoolLimit data race — plain int written without synchronization (#2252) by @erikdubbelboer in #2282
• bug: file descriptor leak in prefork parent process (#2253) by @erikdubbelboer in #2283
• security: SO_REUSEADDR on Windows enables port hijacking (#2254) by @erikdubbelboer in #2284
• bug: file descriptor leak on z/OS s390x when FcntlInt fails (#2255) by @erikdubbelboer in #2285
• bug: filesLockMap grows unboundedly, leaking memory (#2256) by @erikdubbelboer in #2286
• security: TLS verification silently disabled for malformed addresses (#2236) by @erikdubbelboer in #2274
• fix(fs): remove temporary file when compression fails by @u5surf in #2264
• fix double release of streamed client response body by @Mereng in #2211
• fix(client): switch to GET on 303 redirect per RFC 9110 by @u5surf in #2265
• ci: re-enable gocritic deferInLoop check for non-test code by @u5surf in #2288
• Fix flaky race tests by @erikdubbelboer in #2292
• fix(lbclient): prevent deadlock when all clients are removed by @u5surf in #2287
• reject duplicate Content-Length in response header parser by @alhudz in #2294
• strip cr/lf from header keys in normalizeHeaderKey by @alhudz in #2295
• fix(client): guard nil waiter in decConnsCount by @SAY-5 in #2266
• strip semicolons from cookie setters to block attribute injection by @alhudz in #2298
• feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of #2180 follow-up) by @ReneWerner87 in #2199
• fix: prevent data race on FSCompressedFileSuffixes map by @xbrxr03 in #2300
• reject duplicate Transfer-Encoding in request header parser by @alhudz in #2303
• preserve duplicate request headers in ConvertRequest by @alhudz in #2305
• fix(server): close listener on serve error in ListenAndServe helpers by @fereidani in #2304
• validate trailer values in parseTrailer by @alhudz in #2301
• Avoid default content type for empty requests by @nkgotcode in #2296
• chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2210
• chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #2209
• chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by @dependabot[bot] in #2208
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #2207
• chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by @dependabot[bot] in #2261
• chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by @dependabot[bot] in #2267
• chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #2289
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #2290
• chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #2291
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #2297

New Contributors

• @z9z made their first contribution in #2201
• @Mereng made their first contribution in #2211
• @alhudz made their first contribution in #2294
• @SAY-5 made their first contribution in #2266
• @xbrxr03 made their first contribution in #2300
• @fereidani made their first contribution in #2304
• @nkgotcode made their first contribution in #2296

Full Changelog: v1.71.0...v1.72.0

What's Changed

• feat(client): add RetryIfErrUpstream function to handle upstream information by @mdenushev in #2176
• Match net/http sensitive header redirect policy by @erikdubbelboer in #2181
• Sanitize first-line header setters to prevent CRLF injection by @erikdubbelboer in #2182
• server: apply ReadTimeout before first byte with ReduceMemoryUsage by @erikdubbelboer in #2183
• header: reject invalid trailer names by @erikdubbelboer in #2188
• header: reject pre-colon whitespace in request headers by @erikdubbelboer in #2187
• Sanitize redirect Location header to prevent CRLF injection by @erikdubbelboer in #2186
• server: keep hijacked reader out of pool by @erikdubbelboer in #2184
• Sanitize cookie setters to prevent CRLF injection by @erikdubbelboer in #2185
• feat: add ExpectHandler for richer Expect: 100-continue handling by @miretskiy in #2175
• http: reject whitespace before chunk extensions by @erikdubbelboer in #2193
• header: reject unsupported response Transfer-Encoding by @erikdubbelboer in #2192
• header: match net/http CL+TE handling by @erikdubbelboer in #2190
• chore(deps): bump securego/gosec from 2.25.0 to 2.26.1 by @dependabot[bot] in #2195
• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in #2196
• feat(prefork): Enhance prefork management with WatchMaster, CommandProducer, and Windows support by @ReneWerner87 in #2180

New Contributors

• @miretskiy made their first contribution in #2175

Full Changelog: v1.70.0...v1.71.0

What's Changed

• Go 1.26 and golangci-lint updates by @erikdubbelboer in #2146
• Add WithLimit methods for uncompression by @erikdubbelboer in #2147
• Honor Root for fs.FS and normalize fs-style roots by @erikdubbelboer in #2145
• Sanitize header values in all setter paths to prevent CRLF injection by @erikdubbelboer in #2162
• Add ServeFileLiteral, ServeFSLiteral and SendFileLiteral by @erikdubbelboer in #2163
• Prevent chunk extension request smuggling by @erikdubbelboer in #2165
• Validate request URI format during header parsing to reject malformed requests by @erikdubbelboer in #2168
• HTTP1/1 requires exactly one Host header by @erikdubbelboer in #2164
• Strict HTTP version validation and simplified first line parsing by @erikdubbelboer in #2167
• Only normalize pre-colon whitespace for HTTP headers by @erikdubbelboer in #2172
• fs: reject '..' path segments in rewritten paths by @erikdubbelboer in #2173
• fasthttpproxy: reject CRLF in HTTP proxy CONNECT target by @erikdubbelboer in #2174
• fasthttpproxy: scope proxy auth cache to GetDialFunc by @erikdubbelboer in #2144
• feat: enhance performance by @ReneWerner87 in #2135
• export ErrConnectionClosed by @pjebs in #2152
• fix: detect master process death in prefork children by @meruiden in #2158
• return prev values by @pjebs in #2123
• docs: added httpgo to related projects by @MUlt1mate in #2169
• chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #2149
• chore(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 by @dependabot[bot] in #2170
• chore(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by @dependabot[bot] in #2129
• chore(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by @dependabot[bot] in #2140
• chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @dependabot[bot] in #2166
• chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in #2139
• chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @dependabot[bot] in #2128
• chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 by @dependabot[bot] in #2138
• chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by @dependabot[bot] in #2125
• chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @dependabot[bot] in #2137
• chore(deps): bump securego/gosec from 2.22.11 to 2.23.0 by @dependabot[bot] in #2142
• Update securego/gosec from 2.23.0 to 2.25.0 by @erikdubbelboer in #2161

New Contributors

• @MUlt1mate made their first contribution in #2169
• @meruiden made their first contribution in #2158

Full Changelog: v1.69.0...v1.70.0

What's Changed

• Add sortkeys by @pjebs in #2118
• Expose header parsing error variables by @ReneWerner87 in #2096
• Add documentation that modifying during iteration can panic by @erikdubbelboer in #2122
• update readme by @pjebs in #2114
• chore(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #2092
• chore(deps): bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in #2095
• chore(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by @dependabot[bot] in #2094
• chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 by @dependabot[bot] in #2098
• chore(deps): bump golang.org/x/net from 0.46.0 to 0.47.0 by @dependabot[bot] in #2097
• chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @dependabot[bot] in #2099
• chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #2101
• chore(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by @dependabot[bot] in #2103
• chore(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 by @dependabot[bot] in #2109
• chore(deps): bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #2111
• chore(deps): bump securego/gosec from 2.22.10 to 2.22.11 by @dependabot[bot] in #2110

Full Changelog: v1.68.0...v1.69.0

What's Changed

• Fix named return bugs by @erikdubbelboer in 1b8c559
• chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 by @dependabot[bot] in #2087
• chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 by @dependabot[bot] in #2086
• chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 by @dependabot[bot] in #2085
• chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 by @dependabot[bot] in #2088
• chore(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 by @dependabot[bot] in #2089

Full Changelog: v1.67.0...v1.68.0

Special thanks to the following security researchers who reported the issues fixed in this release:

• @zer0yu (Enze Wang)
• @P3ngu1nW (Jingcheng Yang)
• @9vvert (Zehui Miao)

What's Changed

• Add DNS cache management methods for TCPDialer by @aabishkaryal in #2072
• Fix username:password@ validation in urls by @erikdubbelboer in #2080
• Validate IPv6 addresses in urls by @erikdubbelboer in #2079
• Validate schemes by @erikdubbelboer in #2078
• Reject invalid hosts with multiple port delimiters by @erikdubbelboer in #2077
• Reject backslash absolute URIs and cache parse errors by @erikdubbelboer in #2075
• Reject bad ipv6 hostnames by @erikdubbelboer in #2076
• Reimplement flushing support for fasthttpadaptor by @erikdubbelboer in #2081
• chore(deps): bump securego/gosec from 2.22.8 to 2.22.9 by @dependabot[bot] in #2073

New Contributors

• @aabishkaryal made their first contribution in #2072

Full Changelog: v1.66.0...v1.67.0

What's Changed

• chore(deps): bump securego/gosec from 2.22.7 to 2.22.8 by @dependabot[bot] in #2056
• docs: add fasthttp-auth to related projects section by @FAUST-BENCHOU in #2057
• server: refactor to use atomic type by @cuiweixie in #2058
• chore(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #2060
• Fix extra whitespace parsing in HTTP request lines to prevent cache poisoning by @Copilot in #2061
• Drop Go 1.23 support by @erikdubbelboer in #2065
• Add flushing support to fasthttpadaptor by @grivera64 in #2054

New Contributors

• @FAUST-BENCHOU made their first contribution in #2057
• @cuiweixie made their first contribution in #2058
• @Copilot made their first contribution in #2061 😄
• @grivera64 made their first contribution in #2054

Full Changelog: v1.65.0...v1.66.0

‼️ ⚠️ backwards incompatibility! ⚠️ ‼️

In this version of fasthttp, headers delimited by just \n (instead of \r\n) are no longer supported!

What's Changed

• Rewrite header parsing to improve spec compliance by @erikdubbelboer in #2030
• Simplify Client.Do function and lock usage by @byte0o in #2038
• chore(deps): bump securego/gosec from 2.22.5 to 2.22.7 by @dependabot[bot] in #2039
• Fix trailer security by @erikdubbelboer in #2043
• Fix RequestHeader.ContentLength() if disableSpecialHeader is true by @erikdubbelboer in #2042
• Add reuseport support for Solaris by @jwntree in #2046
• test: replace atomic operations with atomic types by @alexandear in #2048
• chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 by @dependabot[bot] in #2049
• Optimize fs to have 0 allocations by @erikdubbelboer in #2052
• chore(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #2055

New Contributors

• @jwntree made their first contribution in #2046

Full Changelog: v1.64.0...v1.65.0