[dependabot]

Bumps the go-modules group with 1 update: github.com/valyala/fasthttp.

Updates github.com/valyala/fasthttp from 1.76.0 to 1.77.0

Release notes

Sourced from github.com/valyala/fasthttp's releases.

v1.77.0

v1.77.0 strengthens static-file confinement, fixes hijacked connection handling, and improves HTTP and cookie compatibility. It also adds an opt-in bounded stream reader, configurable body-buffer retention, and deadline support for adapted net/http handlers.

Static-file symlink behavior changes by default. The default OS-backed FS now rejects symlinks that leave Root or CompressRoot, as well as absolute symlinks even when their targets are inside the root. Relative symlinks that stay inside the root continue to work. Set FS.AllowSymlinksOutsideRoot to restore the previous behavior when external symlinks are intentional. Custom FS.FS implementations are unaffected. #2490

Security fixes and hardening

• Default static-file operations stay within their configured roots. File reads and compressed-cache operations use os.Root to prevent symlink traversal outside Root and CompressRoot. Each root is confined independently; empty roots with AllowEmptyRoot and whole-volume roots retain their existing behavior. #2490
• Custom filesystems no longer trigger unrelated disk deletions. A stale compressed file in a custom FS.FS previously caused an os.Remove call using its filesystem-relative name, potentially deleting a matching file in the process working directory. Custom filesystems now regenerate stale compressed content in memory without removing a disk file. #2489
• Kept hijacked connections no longer depend on a recycled request context. With both KeepHijackedConns and ReduceMemoryUsage enabled, the hijacked reader is detached from the context before the hijack handler runs. This prevents later reads from panicking or accessing another client's connection after context reuse. #2495

Features and resource management

• An opt-in stream reader bounds copied payload buffering. NewBoundedStreamReader works with SetBodyStream and applies backpressure when consumers fall behind. Active copied payload is limited to 160 KiB per bridge, or 320 KiB across the two bridges used by its bounded compression path. These limits exclude caller buffers, codecs, sockets, and other overhead; wrapping the reader loses the combined compression bound. Existing NewStreamReader and SetBodyStreamWriter behavior is unchanged. #2488
• Request and response body buffers can be retained explicitly. The exported Request.KeepBodyBuffer and Response.KeepBodyBuffer fields preserve body buffers across resets for reuse. Releasing a request or response to the pool clears the retention setting. #2451
• Adapted handlers can configure connection deadlines. RequestCtx.SetReadDeadline and SetWriteDeadline are also exposed through fasthttpadaptor, enabling http.ResponseController deadline calls. The adaptor still buffers the request body before invoking the handler, so a read deadline set inside an adapted handler cannot govern the preceding upload. #2452

HTTP compatibility and connection handling

• Weighted compression codings are recognized. Accept-Encoding entries such as gzip;q=0.8 now match, while q=0 makes a coding unacceptable. Matching remains case-insensitive and requires a complete coding token; quality-based preference ordering and wildcard matching are not added. #2491
• HTTP/1.0 clients no longer receive unsupported informational responses. Expect: 100-continue is ignored for HTTP/1.0 requests, and 103 Early Hints is not sent to HTTP/1.0 clients. #2492, #2496
• Hijacking works with server keep-alive limits. DisableKeepalive and reaching MaxRequestsPerConn no longer suppress a registered hijack handler or add an unwanted Connection: close to an upgrade response. Explicit connection-close requests and other existing close conditions still apply. #2494
• Pipe connection deadlines interrupt pending operations. Updating deadlines on fasthttputil.PipeConns now affects blocked reads and writes, and write-deadline updates no longer race with writes. #2471
• Cookie parsing tolerates invalid attributes and handles names consistently. Invalid Max-Age attributes are ignored, Secure, HttpOnly, and Partitioned are recognized even with a value, and surrounding tabs are trimmed. Set-Cookie values without = are stored under the same empty key returned by Cookie.ParseBytes, keeping lookup and deletion consistent. #2497, #2498, #2500, #2501

Proxy authentication now uses decoded credentials in Proxy-Authorization, and static-file 416 Range Not Satisfiable responses include Content-Range. #2499, #2502

What's Changed

Security and hardening

• fix(fs): resolve default FS paths with os.Root so they stay inside Root by @​Thanatos9404 in valyala/fasthttp#2490
• fix(fs): don't remove stale compressed files of a custom FS.FS from disk by @​Thanatos9404 in valyala/fasthttp#2489
• fix: detach kept hijacked connections from the request context's reader by @​h2zi in valyala/fasthttp#2495

Features

• Add an opt-in bounded stream reader by @​CSXizhang in valyala/fasthttp#2488
• Export KeepBodyBuffer on Request and Response by @​AdamMagued in valyala/fasthttp#2451
• fasthttpadaptor: add support for ResponseController SetReadDeadline and SetWriteDeadline by @​AdamMagued in valyala/fasthttp#2452

Fixes

• fix: accept Accept-Encoding codings that carry a quality value by @​ybai08 in valyala/fasthttp#2491
• fix: ignore Expect: 100-continue in HTTP/1.0 requests by @​LuisFigueroaG in valyala/fasthttp#2492
• fix: don't send 103 Early Hints to HTTP/1.0 clients by @​LuisFigueroaG in valyala/fasthttp#2496
• fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn by @​h2zi in valyala/fasthttp#2494
• make PipeConns deadlines interrupt pending reads and writes by @​h2zi in valyala/fasthttp#2471
• fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse by @​nk-batman21 in valyala/fasthttp#2497
• fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization by @​nk-batman21 in valyala/fasthttp#2499

... (truncated)

Commits

• 61bdcc3 fix(fs): send Content-Range with 416 responses (#2502)
• 020e4ed fix(cookie): store Set-Cookie without '=' under the key ParseBytes gives it (...
• 33b5261 fix(cookie): trim tabs around cookie names, values and attributes (#2500)
• 7e7f8ec fix(cookie): recognize Secure, HttpOnly and Partitioned with a value (#2498)
• 720d20e fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization (#2...
• 91b4512 fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse ...
• e0f6199 Export KeepBodyBuffer on Request and Response (#2451)
• d9bf5c5 fix: detach kept hijacked connections from the request context's reader (#2495)
• ad21d1b make PipeConns deadlines interrupt pending reads and writes (#2471)
• 09cba73 fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn (#2494)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Thanks for opening your first pull request on fiber-guard!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• The PR body says Closes #N for an open issue (the issue-link check enforces it); chores take the no-issue label
• gofmt -l . reports no files
• go vet ./... is clean
• go test ./... passes (add -tags integration with Redis for the integration suite)
• go build ./... compiles the adapter and the example apps
• govulncheck ./... is clean
• No nolint / unchecked-error shortcuts; pre-existing violations in touched files are fixed
• If you changed adapter behavior, it stays aligned with gin-guard and nethttp-guard and the README reflects it

See README.md for the adapter contract and AGENTS.md for the boundary rules.

Welcome aboard - a maintainer will review shortly.