v1.77.0 strengthens static-file confinement, fixes hijacked connection handling, and improves HTTP and cookie compatibility. It also adds an opt-in bounded stream reader, configurable body-buffer retention, and deadline support for adapted net/http handlers.

Static-file symlink behavior changes by default. The default OS-backed FS now rejects symlinks that leave Root or CompressRoot, as well as absolute symlinks even when their targets are inside the root. Relative symlinks that stay inside the root continue to work. Set FS.AllowSymlinksOutsideRoot to restore the previous behavior when external symlinks are intentional. Custom FS.FS implementations are unaffected. #2490

Security fixes and hardening

• Default static-file operations stay within their configured roots. File reads and compressed-cache operations use os.Root to prevent symlink traversal outside Root and CompressRoot. Each root is confined independently; empty roots with AllowEmptyRoot and whole-volume roots retain their existing behavior. #2490
• Custom filesystems no longer trigger unrelated disk deletions. A stale compressed file in a custom FS.FS previously caused an os.Remove call using its filesystem-relative name, potentially deleting a matching file in the process working directory. Custom filesystems now regenerate stale compressed content in memory without removing a disk file. #2489
• Kept hijacked connections no longer depend on a recycled request context. With both KeepHijackedConns and ReduceMemoryUsage enabled, the hijacked reader is detached from the context before the hijack handler runs. This prevents later reads from panicking or accessing another client's connection after context reuse. #2495

Features and resource management

• An opt-in stream reader bounds copied payload buffering. NewBoundedStreamReader works with SetBodyStream and applies backpressure when consumers fall behind. Active copied payload is limited to 160 KiB per bridge, or 320 KiB across the two bridges used by its bounded compression path. These limits exclude caller buffers, codecs, sockets, and other overhead; wrapping the reader loses the combined compression bound. Existing NewStreamReader and SetBodyStreamWriter behavior is unchanged. #2488
• Request and response body buffers can be retained explicitly. The exported Request.KeepBodyBuffer and Response.KeepBodyBuffer fields preserve body buffers across resets for reuse. Releasing a request or response to the pool clears the retention setting. #2451
• Adapted handlers can configure connection deadlines. RequestCtx.SetReadDeadline and SetWriteDeadline are also exposed through fasthttpadaptor, enabling http.ResponseController deadline calls. The adaptor still buffers the request body before invoking the handler, so a read deadline set inside an adapted handler cannot govern the preceding upload. #2452

HTTP compatibility and connection handling

• Weighted compression codings are recognized. Accept-Encoding entries such as gzip;q=0.8 now match, while q=0 makes a coding unacceptable. Matching remains case-insensitive and requires a complete coding token; quality-based preference ordering and wildcard matching are not added. #2491
• HTTP/1.0 clients no longer receive unsupported informational responses. Expect: 100-continue is ignored for HTTP/1.0 requests, and 103 Early Hints is not sent to HTTP/1.0 clients. #2492, #2496
• Hijacking works with server keep-alive limits. DisableKeepalive and reaching MaxRequestsPerConn no longer suppress a registered hijack handler or add an unwanted Connection: close to an upgrade response. Explicit connection-close requests and other existing close conditions still apply. #2494
• Pipe connection deadlines interrupt pending operations. Updating deadlines on fasthttputil.PipeConns now affects blocked reads and writes, and write-deadline updates no longer race with writes. #2471
• Cookie parsing tolerates invalid attributes and handles names consistently. Invalid Max-Age attributes are ignored, Secure, HttpOnly, and Partitioned are recognized even with a value, and surrounding tabs are trimmed. Set-Cookie values without = are stored under the same empty key returned by Cookie.ParseBytes, keeping lookup and deletion consistent. #2497, #2498, #2500, #2501

Proxy authentication now uses decoded credentials in Proxy-Authorization, and static-file 416 Range Not Satisfiable responses include Content-Range. #2499, #2502

What's Changed

Security and hardening

• fix(fs): resolve default FS paths with os.Root so they stay inside Root by @Thanatos9404 in https://github.com/valyala/fasthttp/pull/2490
• fix(fs): don't remove stale compressed files of a custom FS.FS from disk by @Thanatos9404 in https://github.com/valyala/fasthttp/pull/2489
• fix: detach kept hijacked connections from the request context's reader by @h2zi in https://github.com/valyala/fasthttp/pull/2495

Features

• Add an opt-in bounded stream reader by @CSXizhang in https://github.com/valyala/fasthttp/pull/2488
• Export KeepBodyBuffer on Request and Response by @AdamMagued in https://github.com/valyala/fasthttp/pull/2451
• fasthttpadaptor: add support for ResponseController SetReadDeadline and SetWriteDeadline by @AdamMagued in https://github.com/valyala/fasthttp/pull/2452

Fixes

• fix: accept Accept-Encoding codings that carry a quality value by @ybai08 in https://github.com/valyala/fasthttp/pull/2491
• fix: ignore Expect: 100-continue in HTTP/1.0 requests by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2492
• fix: don't send 103 Early Hints to HTTP/1.0 clients by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2496
• fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn by @h2zi in https://github.com/valyala/fasthttp/pull/2494
• make PipeConns deadlines interrupt pending reads and writes by @h2zi in https://github.com/valyala/fasthttp/pull/2471
• fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2497
• fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2499
• fix(cookie): recognize Secure, HttpOnly and Partitioned with a value by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2498
• fix(cookie): trim tabs around cookie names, values and attributes by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2500
• fix(cookie): store Set-Cookie without '=' under the key ParseBytes gives it by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2501
• fix(fs): send Content-Range with 416 responses by @wleeaf in https://github.com/valyala/fasthttp/pull/2502

New Contributors

• @ybai08 made their first contribution in https://github.com/valyala/fasthttp/pull/2491
• @Thanatos9404 made their first contribution in https://github.com/valyala/fasthttp/pull/2489
• @AdamMagued made their first contribution in https://github.com/valyala/fasthttp/pull/2452
• @nk-batman21 made their first contribution in https://github.com/valyala/fasthttp/pull/2497
• @wleeaf made their first contribution in https://github.com/valyala/fasthttp/pull/2502

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.76.0...v1.77.0