v3.1.0

Manisso/fsocietyv3.1.0Feb 24, 2026by github-actions[bot]

AI Summary

Introduces a configuration option to pass middleware locals to the context, expanding helper capabilities, alongside performance optimizations and security hardening.

Key Highlights

New PassLocalsToContext config option for middleware helpers
Performance optimizations for helpers
Hardening of constraint parsing and proxy handling
Updated dependencies (golang-modules, msgpack, etc.)

Breaking Changes

PassLocalsToContext defaults to false; middleware helpers may not work as expected without enabling this flag

New Features

PassLocalsToContext feature
Expanded route tests
Msgpack update

Full Release Notes

## 🚀 New

- expand middleware context helpers (#4079)
```go
app := fiber.New(fiber.Config{
    PassLocalsToContext: true, // default: false
})

// Works for requestid, csrf, session, basicauth, keyauth middlewares
app.Use(requestid.New())

app.Get("/", func(ctx fiber.Ctx) error {
    // Value helpers from middlewares works now with 3 different context items
    id := requestid.FromContext(ctx)              // works always
    id := requestid.FromContext(ctx.RequestCtx()) // works always
    id := requestid.FromContext(ctx.Context())    // works only when `PassLocalsToContext` is true
    
    return c.SendString(id)
})
```
https://docs.gofiber.io/api/fiber/#passlocalstocontext


## 🧹 Updates

- update utils and add go 1.26 for test workflow (#4087)
- optimize helpers performance (#4049)
- harden numeric constraint parsing and expand route tests (#4054)

## 🐛 Fixes

- harden DefaultRes.Format against nil handler panics (#4105)
- guard nil request in adaptor LocalContextFromHTTPRequest (#4097)
- fix Unix-socket support in IsProxyTrusted (#4088)
- harden proxy nil client handling in Do/Forward paths (#4083)
- add nil-safety to response decode helpers (#4081)
- sanitize attachment/download filenames (#4070)
- harden flash cookie detection (#4078)
- fix bind struct validation only for struct targets (#4082)
- enforce Range header limit configuration (#4071)
- apply limits to msgp serialization (#4065)
- fix sanitizePath validation logic (#4064)
- fix Test method returning empty response on timeout (#4063)
- fix nil pointer dereference in context methods when accessed after release (#4062)
- retry addon: remove unnecessary sleep after last failed attempt (#4060)
- make TLS listener config discovery safer (#4055)
- validate nil services early and during lifecycle (#4050)
- skip non-string state keys during iteration (#4048)
- harden Port() handling (#4051)
- prevent panics on non-string log keys (#4046)

## 🛠️ Maintenance

- bump streetsidesoftware/cspell-action from 8.2.0 to 8.3.0 (#4111)
- bump the golang-modules group with 3 updates (#4080)
- bump github.com/shamaton/msgpack/v3 from 3.0.0 to 3.1.0 (#4075)
- bump github.com/klauspost/compress from 1.18.3 to 1.18.4 (#4076)
- bump github.com/gofiber/schema from 1.6.0 to 1.7.0 (#4074)
- bump golang.org/x/sys from 0.40.0 to 0.41.0 in the golang-modules group (#4073)
- bump github/codeql-action from 4.32.3 to 4.32.4 (#4104)
- bump github/codeql-action from 4.32.1 to 4.32.2 (#4058)
- bump github/codeql-action from 4.32.0 to 4.32.1 (#4047)

## 📚 Documentation

- update versioned storage imports in middleware docs (#4102)
- update documentation for parser configuration and request handling (#4096)
- fix invalid Go slice literal in middleware registration example (#4095)
- document `uri` struct tag for `ctx.Bind().URI()` in migration guide (#4092)
- document logger Stream rename (#4057)

**📒 Documentation**: https://docs.gofiber.io/next/

**💬 Discord**: https://gofiber.io/discord

**Full Changelog**: https://github.com/gofiber/fiber/compare/v3.0.0...v3.1.0

Thank you @ReneWerner87, @SadikSunbul, @gaby and @sixcolors for making this release possible.