[dependabot]

Bumps github.com/gofiber/fiber/v3 from 3.6.1 to 3.7.0.

Release notes

Sourced from github.com/gofiber/fiber/v3's releases.

v3.7.0

🚀 New

• Update fasthttp to v1.78.0 (#4779, #4803, #4862) fasthttp v1.78.0 (from v1.75.0) hardens request framing, multipart parsing, redirects and file serving, and speeds up path normalization, query parsing, header setters and Client.Do. https://github.com/valyala/fasthttp/releases/tag/v1.78.0
• Support map fields in query and form binding (#4788) Struct fields of type map[string]T now bind from query strings and form bodies; attributes[color] and attributes.color both give the key color.

  type Filter struct {
      Attributes map[string]string   `query:"attributes"` // ?attributes[color]=red&attributes.size=m
      Tags       map[string][]string `query:"tags"`       // ?tags[sale]=yes&tags[sale]=new
      Limits     map[string]int      `query:"limits"`     // ?limits[max]=5
  }

  https://docs.gofiber.io/api/bind#map-fields
• Add AllowSymlinksOutsideRoot to the static middleware (#4803) A root on disk is now confined: symbolic links that leave it, and absolute ones, are handled like missing files unless AllowSymlinksOutsideRoot is set.

  app.Use("/assets", static.New("./public", static.Config{
      AllowSymlinksOutsideRoot: true, // default: false
  }))

  https://docs.gofiber.io/middleware/static#config
• Let proxy.DoRedirects and the Fiber client drop extra sensitive headers on a redirect (#4800) New opt-in RedirectSensitiveHeaders on proxy.SecurityPolicy and the client (Client, Request, Config) names headers such as X-Api-Key that a redirect to another origin (proxy) or host (client) drops; empty by default.

  policy := proxy.DefaultSecurityPolicy()
  policy.RedirectSensitiveHeaders = []string{"X-Api-Key", "X-Auth-Token"}
  proxy.WithSecurityPolicy(policy)
  cli := client.New().SetRedirectSensitiveHeaders("X-Api-Key")

  https://docs.gofiber.io/middleware/proxy#headers-on-a-cross-origin-redirect

🧹 Updates

• Share host splitting and IDNA folding (#4851)
• Align forwarded header list parsing (#4847)
• Share forwarded IP scanning and ignore empty elements (#4820)
• Share redirect URL normalization (#4824)
• Speed up media type parameter parsing (#4807)
• Avoid allocations for empty typed lookups (#4852)
• Consolidate control-character scanning (#4783)
• cache/limiter: Walk Cache-Control lists with headerlist and write Retry-After without a string (#4833)
• cors/csrf: Share origin allow-list parsing (#4836)
• encryptcookie: Build the AEAD once per middleware instead of per cookie (#4838)
• etag: Checksum bodies with slicing-by-8 (#4794)
• limiter: Format rate-limit header values without allocating (#4822)
• proxy: Copy the forwarder name before storing it in the refused-request test (#4819)

... (truncated)

Commits

• fc09465 chore: bump version to v3.7.0
• 84c0804 Merge pull request #4862 from gofiber/dependabot/go_modules/fasthttp-modules-...
• 7677932 🐛 bug: follow fasthttp 1.78's case-insensitive form detection
• 107d238 Merge pull request #4863 from gofiber/dependabot/go_modules/github.com/shamat...
• 8e03fa6 build(deps): bump github.com/shamaton/msgpack/v3 from 3.2.6 to 3.2.7
• 0305ec7 build(deps): bump github.com/valyala/fasthttp
• 8cb9f5d 🧹 chore: align community health files with the org defaults
• 16cdbd2 🧹 chore: stabilize the flaky tests of recent CI runs
• b446c2a 🧹 chore: raise the benchmark threshold of the GenericParseType invalid cases
• 2b66a24 Merge pull request #4837 from fadiroot/fix/keyauth-challenge-without-credentials
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)