🚀 New

• Harden proxy middleware (#4405) New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })

  https://docs.gofiber.io/middleware/proxy#security
• Add support for custom binding precedence (#4544) New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }

  https://docs.gofiber.io/api/bind#custom-precedence
• Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486) New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

🧹 Updates

• Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
• Quick-reject routes on precomputed slash-count bounds (#4517)
• Restore Route inlining lost in the RFC 9110 changes (#4501)
• Skip the Accept join allocation in the Format emptiness check (#4503)
• Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
• Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
• Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
• Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
• adaptor: Cut allocations on the net/http bridge (#4559)
• cache: Optimize key generation and allocation (#4608)
• cors: Fold preflight Vary calls into one header scan (#4502)
• csrf: Optimize trusted subdomain matching (#4543)
• proxy: Optimize balancer round-robin (#4549)
• session: Use make() to preallocate relevantExtractors (#4562)
• De-flake the clock-sensitive tests (#4575)

🐛 Fixes

• Fix open redirects in composed route URLs and redirect rules (#4584)
• Preserve published route buckets during rebuilds (#4579)
• URL-encode query values in Redirect.Route (#4529)
• Accept the full float64 range in the float route constraint (#4528)
• Match HTTP field names the way a recipient must (#4585)
• Honor Accept weights followed by whitespace before the comma (#4550)
• Compare Accept media types case-insensitively (#4493)
• Honor q=0 rejections in content negotiation (#4508)
• Honor duplicate Content-Encoding after empty values (#4514)
• Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)
• Avoid reading omitted request bodies in Bind.All (#4565)
• Combine repeated proxy headers for client IP extraction (#4568)
• Close the listener on Listen error paths to avoid FD leaks (#4532)
• Fire OnPostShutdown once with the real shutdown error (#4531)
• Keep all NewErrorf args when the first isn't a format string (#4530)
• adaptor: Preserve Connection tokens (#4606)
• cache: Honor only-if-cached for non-shareable entries (#4589)
• cache: Stop charging its own latency as response age (#4578)
• healthcheck: Answer HEAD probes with the GET status (#4577)
• limiter: Floor sub-second expiration in the sliding window (#4564)
• proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)
• proxy: Guard runtime helpers against DNS rebinding (#4518)
• proxy: Preserve empty-query URL semantics (#4513)
• redirect: Rank wildcards behind character classes in rule ordering (#4607)
• static: Fix leading-slash normalization for fs.FS root paths (#4507)
• Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)
• Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

🛠️ Maintenance

22 changes

• bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#4602)
• bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 (#4583)
• bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#4566)
• bump github.com/gofiber/utils/v2 from 2.4.0 to 2.4.1 (#4567)
• bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 in the fasthttp-modules group (#4561)
• bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#4556)
• bump actions/checkout from 7.0.0 to 7.0.1 (#4551)
• bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#4548)
• bump github.com/gofiber/schema from 1.8.2 to 1.8.3 (#4547)
• bump release-drafter/release-drafter from 7.5.1 to 7.6.0 (#4546)
• bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 (#4545)
• bump actions/setup-go from 6.5.0 to 7.0.0 (#4541)
• bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#4540)
• bump github.com/shamaton/msgpack/v3 from 3.1.2 to 3.2.0 (#4538)
• bump actions/setup-node from 6.4.0 to 7.0.0 (#4537)
• bump github.com/gofiber/schema from 1.8.1 to 1.8.2 (#4535)
• bump github.com/gofiber/utils/v2 from 2.1.1 to 2.1.2 (#4520)
• bump the golang-modules group with 3 updates (#4515)
• bump DavidAnson/markdownlint-cli2-action from 23.2.0 to 24.0.0 (#4506)
• bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-modules group (#4511)
• bump golang.org/x/text from 0.38.0 to 0.39.0 in the golang-modules group (#4509)
• bump github.com/gofiber/schema from 1.8.0 to 1.8.1 (#4510)

📚 Documentation

• Explain adjacent multi-param capture rules (#4597)
• Document Ctx as a never-cancelable context (#4560)
• Move README.md to the repo root so pkg.go.dev renders it (#4505)
• logger: Explain when the error tag is populated (#4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.