Special thanks to the following security researchers who reported the issues fixed in this release:
What's Changed
- Add DNS cache management methods for TCPDialer by @aabishkaryal in https://github.com/valyala/fasthttp/pull/2072
- Fix username:password@ validation in urls by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2080
- Validate IPv6 addresses in urls by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2079
- Validate schemes by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2078
- Reject invalid hosts with multiple port delimiters by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2077
- Reject backslash absolute URIs and cache parse errors by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2075
- Reject bad ipv6 hostnames by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2076
- Reimplement flushing support for fasthttpadaptor by @erikdubbelboer in https://github.com/valyala/fasthttp/pull/2081
- chore(deps): bump securego/gosec from 2.22.8 to 2.22.9 by @dependabot[bot] in https://github.com/valyala/fasthttp/pull/2073
New Contributors
- @aabishkaryal made their first contribution in https://github.com/valyala/fasthttp/pull/2072
Full Changelog: https://github.com/valyala/fasthttp/compare/v1.66.0...v1.67.0