[dependabot]

Bumps github.com/valyala/fasthttp from 1.60.0 to 1.76.0.

Release notes

Sourced from github.com/valyala/fasthttp's releases.

v1.76.0

v1.76.0 strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to TCPDialer.

Security fixes and hardening

• Multipart parsing consumes the entire declared body. Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. #2336
• Outgoing messages preserve framing. Raw Content-Length headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. FS and SendFile also stop at the advertised Content-Length when a file grows during serving. #2470, #2462
• Requests with both Content-Length and Transfer-Encoding close the connection. The connection is no longer reused after a request containing both framing headers. #2476
• Virtual-host file serving preserves directory isolation. NewVHostPathRewriter avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under FS.Root. This affects FS handlers using NewVHostPathRewriter. #2487
• Rejected TLS connections no longer block the accept loop. Connections rejected by MaxConnsPerIP or Concurrency are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a ClientHello. IPv6 clients are now also counted against MaxConnsPerIP. #2486, #2468

Performance improvements

• Trailer parsing avoids quadratic work. Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted Trailer headers and chunked trailer sections while preserving trailer order. #2465

HTTP compatibility and features

• Static files handle range and conditional requests more accurately. Unsupported range units and multiple ranges are ignored instead of returning 416; invalid single byte ranges still return 416. Range is also ignored when If-Range does not match, and both Range and If-Modified-Since are ignored for methods other than GET and HEAD. #2467, #2473, #2474, #2475
• Pipeline clients handle HEAD responses without reading a body. PipelineClient skips the response body for HEAD requests. #2469
• HTTP parsing accepts valid legacy formats and matches tokens correctly. ParseHTTPDate accepts obsolete HTTP-date formats, cookies with an invalid Expires attribute remain parseable, Expect: 100-continue is matched case-insensitively, and Accept-Encoding matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. #2466, #2481, #2482, #2479, #2463
• TCP keep-alives are configurable. The new TCPDialer.KeepAlive field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. #2484

What's Changed

Security and hardening

• consume the rest of the declared body in readMultipartForm by @​alhudz in valyala/fasthttp#2336
• fix: validate outgoing request framing by @​erikdubbelboer in valyala/fasthttp#2470
• stop FS and SendFile at Content-Length when the file has grown by @​alhudz in valyala/fasthttp#2462
• fix: close the connection after a request with both Content-Length and Transfer-Encoding by @​LuisFigueroaG in valyala/fasthttp#2476
• fix(fs): preserve vhost isolation during path rewriting by @​koyokr in valyala/fasthttp#2487
• Fix TLS connection rejection blocking the accept loop by @​erikdubbelboer in valyala/fasthttp#2486
• count IPv6 clients against MaxConnsPerIP by @​alhudz in valyala/fasthttp#2468

Performance

• make addTrailerKey linear in the size of the trailer set by @​alhudz in valyala/fasthttp#2465

Features

• feat: add KeepAlive option to TCPDialer by @​littfed in valyala/fasthttp#2484

Fixes

• fix(header): reject asterisk-form request-target for non-OPTIONS methods by @​aadieng100 in valyala/fasthttp#2463
• fix: accept the obsolete HTTP-date formats in ParseHTTPDate by @​LuisFigueroaG in valyala/fasthttp#2466
• fix(fs): ignore Range headers FS can't serve instead of replying 416 by @​LuisFigueroaG in valyala/fasthttp#2467
• skip the response body for HEAD requests in PipelineClient by @​alhudz in valyala/fasthttp#2469
• fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by @​LuisFigueroaG in valyala/fasthttp#2474
• fix(fs): ignore Range when the If-Range validator doesn't match by @​LuisFigueroaG in valyala/fasthttp#2473

... (truncated)

Commits

• 634ef44 fix(fs): preserve vhost isolation during path rewriting (#2487)
• 7aea379 feat: add KeepAlive option to TCPDialer (#2484)
• 89a91a8 fix: match complete Accept-Encoding tokens (#2479)
• 414aa59 Fix TLS connection rejection blocking the accept loop (#2486)
• 0880727 consume the rest of the declared body in readMultipartForm (#2336)
• 14a2406 fix flaky TestStreamBodyRequestContentLength
• 24922f6 chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#2485)
• 260b438 fix: match the Expect: 100-continue value case-insensitively (#2482)
• 95bdd1c chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 (#2483)
• 4e0f08c fix(cookie): ignore an invalid Expires attribute instead of failing to parse ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)