v3.5.0

## 🚀 New

- Harden proxy middleware (#4405)
  New `proxy.SecurityPolicy` with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.
  ```go
  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })
  ```
  https://docs.gofiber.io/middleware/proxy#security
- Add support for custom binding precedence (#4544)
  New `binding_source` struct tag overrides the `Bind().All()` source order per struct; the resolved order is cached per `reflect.Type`.
  ```go
  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }
  ```
  https://docs.gofiber.io/api/bind#custom-precedence
- Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486)
  New `fiber.Config` option that answers unregistered paths with `404`/`405` before the middleware chain runs (CORS preflight exempt, off by default).
  ```go
  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })
  ```
  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

## 🧹 Updates

- Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
- Quick-reject routes on precomputed slash-count bounds (#4517)
- Restore Route inlining lost in the RFC 9110 changes (#4501)
- Skip the Accept join allocation in the Format emptiness check (#4503)
- Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
- Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
- Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
- Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
- adaptor: Cut allocations on the net/http bridge (#4559)
- cache: Optimize key generation and allocation (#4608)
- cors: Fold preflight Vary calls into one header scan (#4502)
- csrf: Optimize trusted subdomain matching (#4543)
- proxy: Optimize balancer round-robin (#4549)
- session: Use make() to preallocate relevantExtractors (#4562)
- De-flake the clock-sensitive tests (#4575)

## 🐛 Fixes

- Fix open redirects in composed route URLs and redirect rules (#4584)
- Preserve published route buckets during rebuilds (#4579)
- URL-encode query values in `Redirect.Route` (#4529)
- Accept the full float64 range in the `float` route constraint (#4528)
- Match HTTP field names the way a recipient must (#4585)
- Honor Accept weights followed by whitespace before the comma (#4550)
- Compare Accept media types case-insensitively (#4493)
- Honor q=0 rejections in content negotiation (#4508)
- Honor duplicate Content-Encoding after empty values (#4514)
- Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)
- Avoid reading omitted request bodies in Bind.All (#4565)
- Combine repeated proxy headers for client IP extraction (#4568)
- Close the listener on Listen error paths to avoid FD leaks (#4532)
- Fire OnPostShutdown once with the real shutdown error (#4531)
- Keep all `NewErrorf` args when the first isn't a format string (#4530)
- adaptor: Preserve Connection tokens (#4606)
- cache: Honor only-if-cached for non-shareable entries (#4589)
- cache: Stop charging its own latency as response age (#4578)
- healthcheck: Answer HEAD probes with the GET status (#4577)
- limiter: Floor sub-second expiration in the sliding window (#4564)
- proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)
- proxy: Guard runtime helpers against DNS rebinding (#4518)
- proxy: Preserve empty-query URL semantics (#4513)
- redirect: Rank wildcards behind character classes in rule ordering (#4607)
- static: Fix leading-slash normalization for fs.FS root paths (#4507)
- Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)
- Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

## 🛠️ Maintenance

<details>
<summary>22 changes</summary>

- bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#4602)
- bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 (#4583)
- bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#4566)
- bump github.com/gofiber/utils/v2 from 2.4.0 to 2.4.1 (#4567)
- bump github.com/valyala/fasthttp from 1.72.0 to 1.73.0 in the fasthttp-modules group (#4561)
- bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#4556)
- bump actions/checkout from 7.0.0 to 7.0.1 (#4551)
- bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#4548)
- bump github.com/gofiber/schema from 1.8.2 to 1.8.3 (#4547)
- bump release-drafter/release-drafter from 7.5.1 to 7.6.0 (#4546)
- bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 (#4545)
- bump actions/setup-go from 6.5.0 to 7.0.0 (#4541)
- bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#4540)
- bump github.com/shamaton/msgpack/v3 from 3.1.2 to 3.2.0 (#4538)
- bump actions/setup-node from 6.4.0 to 7.0.0 (#4537)
- bump github.com/gofiber/schema from 1.8.1 to 1.8.2 (#4535)
- bump github.com/gofiber/utils/v2 from 2.1.1 to 2.1.2 (#4520)
- bump the golang-modules group with 3 updates (#4515)
- bump DavidAnson/markdownlint-cli2-action from 23.2.0 to 24.0.0 (#4506)
- bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-modules group (#4511)
- bump golang.org/x/text from 0.38.0 to 0.39.0 in the golang-modules group (#4509)
- bump github.com/gofiber/schema from 1.8.0 to 1.8.1 (#4510)
</details>

## 📚 Documentation

- Explain adjacent multi-param capture rules (#4597)
- Document Ctx as a never-cancelable context (#4560)
- Move README.md to the repo root so pkg.go.dev renders it (#4505)
- logger: Explain when the error tag is populated (#4592)

**📒 Documentation**: https://docs.gofiber.io/

**💬 Discord**: https://gofiber.io/discord

**Full Changelog**: https://github.com/gofiber/fiber/compare/v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.