v3.6.0

## ⚡ Performance

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

| Time per request vs. v2 | v3.5.0 (fasthttp v1.73.0) | v3.6.0 (fasthttp v1.75.0) |
|:--|--:|--:|
| fasthttp only | +18% | -5% |
| Static route | +16% | -14% |
| Route parameter | +15% | -13% |
| Middleware chain | +13% | -12% |
| Header lookup | +29% | +3% |
| Locals | +33% | +5% |
| JSON response | +6% | -3% |
| JSON bind | +14% | -2% |
| **Median of all 22 scenarios** | **+10%** | **-5%** |

Negative is faster than v2. v3.6.0 was measured on `main` three days before the release.
All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again.
https://gofiber.github.io/benchmarks/

## 🚀 New

- Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596)
  New tokenless middleware that rejects unsafe cross-origin browser requests by their `Sec-Fetch-Site` and `Origin` headers; no cookie, token or storage needed.
  ```go
  app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
      TrustedOrigins: []string{"https://admin.example.com"},
  }))
  ```
  https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
- Update fasthttp to v1.75.0 (#4667, #4740)
  fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing.
  https://github.com/valyala/fasthttp/releases/tag/v1.75.0
- Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715)
  `ReadBufferSize` and `WriteBufferSize` now default to `8192` bytes (was `4096`), which also raises the default request header limit; explicitly configured values are kept.
  ```go
  app := fiber.New(fiber.Config{
      ReadBufferSize:  4096, // previous default, now 8192
      WriteBufferSize: 4096, // previous default, now 8192
  })
  ```
  https://docs.gofiber.io/api/fiber#readbuffersize
- Expand context, response and request helpers (#4638)
  New helpers on `Req`, `Res` and `Ctx` such as `Bearer`, `Origin`, `IsSafe`, `Del`, `StatusCode`, `GetCookies`, `Elapsed` and `RouteName`; request helpers are now also reachable through `c.Req()`.
  ```go
  token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
  c.Del("X-Powered-By") // remove a response header
  took := c.Elapsed()   // time spent on this request so far
  ```
  https://docs.gofiber.io/api/ctx
- Add Endpoint() for middleware look-ahead (#4601)
  New `c.Endpoint()` returns the route that will handle the request without advancing the handler chain (`nil` on `404`/`405`).
  ```go
  app.Use(func(c fiber.Ctx) error {
      if route := c.Endpoint(); route != nil {
          // enforce access control using route.Path or route.Name
      }
      return c.Next()
  })
  ```
  https://docs.gofiber.io/api/ctx#endpoint
- Add ordered RuleList to the redirect and rewrite middleware (#4621, #4633)
  New `RuleList []Rule` in `redirect` and `rewrite` is tried in the order written, first match wins; the `Rules` map is deprecated and setting both panics.
  ```go
  app.Use(redirect.New(redirect.Config{
      RuleList: []redirect.Rule{
          {From: "/old", To: "/new"},      // checked first
          {From: "/old/*", To: "/new/$1"}, // takes everything else
      },
  }))
  ```
  https://docs.gofiber.io/middleware/redirect#rule-order
- Render configured templates to a writer (#4594)
  New `app.Render` writes a template through the configured view engine to any `io.Writer` without creating an HTTP response, e.g. for SSE or HTMX partials.
  ```go
  var buf bytes.Buffer
  if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil {
      return err
  }
  ```
  https://docs.gofiber.io/api/app#render
- Add final request hooks to the HTTP client (#4595)
  New `AddFinalRequestHook` runs after the built-in hooks, immediately before the request is sent, when `RawRequest` holds the resolved URL, merged headers and serialized body.
  ```go
  cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error {
      raw := req.RawRequest
      raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body()))
      return nil
  })
  ```
  https://docs.gofiber.io/client/hooks#final-request-hooks
- Add SetLocal, a request-local store without the variadic's heap slice (#4687)
  New `c.SetLocal(key, value)` stores a request-local value exactly like `c.Locals(key, value)`, without the one-element slice that call allocates.
  https://docs.gofiber.io/api/ctx#setlocal
- Add DisableFlashMessages and filter route candidates with a probe constant (#4655)
  New `fiber.Config` option `DisableFlashMessages` turns off redirect flash messages and the per-request `fiber_flash` cookie scan (off by default); the router gains a precomputed probe-constant filter.
  ```go
  app := fiber.New(fiber.Config{
      DisableFlashMessages: true, // default: false
  })
  ```
  https://docs.gofiber.io/api/fiber#disableflashmessages
- Add source-aware extraction to extractors without a new struct field (#4603)
  New `extractors.Resolve` returns the value together with the `Source` and `Key` of the chain child that produced it; the `Extractor` struct is unchanged.
  ```go
  ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key"))
  res, err := extractors.Resolve(ex, c)
  // res.Value, plus res.Source and res.Key of the child that won
  ```
  https://docs.gofiber.io/guide/extractors#source-aware-extraction

## 🧹 Updates

- Require Go 1.26 (#4654)
- Filter large route buckets before loading routes and bind without building a map (#4705)
- Filter a route bucket by static path before loading the route (#4688)
- Consolidate route pattern preprocessing (#4710)
- Share route and client :name path delimiters (#4636)
- Normalize header keys in one pass and match canonical media types directly (#4690)
- Share streaming header join logic (#4734)
- Consolidate comma-list header scanning into internal/headerlist (#4637)
- Consolidate entity-tag parsing into internal/etag (#4632)
- Adopt utils/v2 helpers and cut per-request allocations in the hot path (#4666)
- cors/csrf: Consolidate origin matching into internal/origin (#4653)
- limiter: Lock keys per shard instead of globally (#4702)
- redirect/rewrite: Share capture substitution (#4749)
- session: Skip the gob re-encode when a session was only read (#4703)
- Cut the per-request cost of the extractors (#4678)
- Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps (#4729)
- Close three test coverage gaps in logger, shutdown and docs (#4615)
- Add a regression test and docs example for CustomCtx overrides behind middleware (#4598)
- Add a regression test and docs note that Context() is not canceled on graceful shutdown (#4599)
- Trigger Dependabot in gofiber/benchmarks after releases (#4682)

## 🐛 Fixes

- Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware (#4695)
- Keep stray percents from forging escapes, root every request target and take the SendFile name literally (#4719)
- Let empty optional params yield to later required segments (#4722)
- Fix panic on route pattern with trailing escape character (#4717)
- Preserve names for merged multi-method routes (#4663)
- Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount (#4620)
- Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()[4:]) (#4674)
- Escape parameter values in generated route URLs (#4629)
- Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent (#4721)
- Accept tab OWS in X-Forwarded-For and share one OWS trim helper (#4735)
- Treat Vary field names as case-insensitive (#4642)
- Unify cookie SameSite handling (#4630)
- Prevent unbounded handler growth when SendFile serves a function-backed fs.FS (#4656)
- Prevent typed-nil view engine panics (#4662)
- Report the real status for fasthttp-level request errors (#4614)
- Drain in-flight requests before Listen returns (#4701)
- basicauth: Equalize verification time across mixed hash algorithms (#4726)
- basicauth: Refuse a repeated Authorization field (#4738)
- basicauth/keyauth: Use HTTP quoted strings in auth challenges (#4631)
- cache: Delete stale entries after uncacheable revalidation (#4590)
- cache: Key entries by request scheme and host (#4736)
- cache: Replay Vary on cache hits and mark credential-keyed entries private (#4744)
- compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper (#4708)
- idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers (#4693)
- limiter: Bound the rate-limit key before it reaches storage (#4677)
- proxy: Apply the client's Connection listing to the request as received (#4745)
- proxy: Fold DomainForward's configured hostname to Punycode (#4673)
- proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers (#4725)
- proxy: Preserve IPv6 brackets in domain forwarding (#4689)
- redirect/rewrite: Read "$10" as the tenth capture in targets (#4692)
- session: Honor chain-level extractors and close three write-back holes (#4679)
- static: Align file resolution with routed paths (#4712)
- static: Reject partial wildcard matches that cross a path segment boundary (#4728)
- Decode a path parameter exactly once in FromParam (#4626)
- Anchor and escape client path parameter substitution (#4625)
- Keep a stale client Response from releasing a reused Request on Close (#4659)
- Parse malformed Set-Cookie attributes in the client in linear time (#4658)
- Make static, proxy, adaptor and rewrite act on the path the router matched (#4720)
- Fix RFC 9110/9112 compliance gaps in core, static and timeout (#4747)
- Fix correctness issues across core, router, binder, client and middleware (#4652)

## 🛠️ Maintenance

<details>
<summary>41 changes</summary>

- bump the golang-modules group with 2 updates (#4748)
- bump github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6 (#4746)
- bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 (#4743)
- bump github.com/valyala/fasthttp from 1.74.0 to 1.75.0 in the fasthttp-modules group (#4740)
- bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 (#4741)
- bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#4739)
- bump github.com/tinylib/msgp from 1.6.4 to 1.6.5 (#4723)
- bump github.com/klauspost/compress from 1.20.0 to 1.20.1 (#4709)
- bump github.com/gofiber/schema from 1.8.7 to 1.8.8 (#4706)
- bump github.com/gofiber/utils/v2 from 2.6.0 to 2.6.1 (#4707)
- bump github.com/gofiber/utils/v2 from 2.5.3 to 2.6.0 (#4704)
- bump github.com/gofiber/utils/v2 from 2.5.2 to 2.5.3 (#4700)
- bump codecov/codecov-action from 7.1.0 to 7.1.1 (#4699)
- bump github.com/molecule-man/go-brrr from 1.1.0 to 1.1.1 (#4698)
- bump codecov/codecov-action from 7.0.0 to 7.1.0 (#4691)
- bump github.com/gofiber/schema from 1.8.6 to 1.8.7 (#4686)
- bump github.com/fxamacker/cbor/v2 from 2.9.3 to 2.9.4 (#4685)
- bump github.com/gofiber/utils/v2 from 2.5.1 to 2.5.2 (#4681)
- bump github.com/shamaton/msgpack/v3 from 3.2.2 to 3.2.3 (#4680)
- bump github.com/molecule-man/go-brrr from 1.0.1 to 1.1.0 (#4676)
- bump the golang-modules group with 3 updates (#4672)
- bump golang.org/x/sys from 0.47.0 to 0.48.0 in the golang-modules group (#4670)
- bump github.com/gofiber/schema from 1.8.5 to 1.8.6 (#4671)
- bump github.com/gofiber/utils/v2 from 2.5.0 to 2.5.1 (#4668)
- bump github.com/valyala/fasthttp from 1.73.0 to 1.74.0 in the fasthttp-modules group (#4667)
- bump streetsidesoftware/cspell-action from 9.0.1 to 9.1.0 (#4665)
- bump github.com/shamaton/msgpack/v3 from 3.2.1 to 3.2.2 (#4660)
- bump github.com/gofiber/utils/v2 from 2.4.3 to 2.5.0 (#4661)
- bump golang.org/x/crypto from 0.55.0 to 0.56.0 in the golang-modules group (#4651)
- bump github.com/gofiber/utils/v2 from 2.4.2 to 2.4.3 (#4650)
- bump github.com/klauspost/compress from 1.19.2 to 1.20.0 (#4649)
- bump github.com/gofiber/schema from 1.8.4 to 1.8.5 (#4647)
- bump github.com/shamaton/msgpack/v3 from 3.2.0 to 3.2.1 (#4645)
- bump github.com/andybalholm/brotli from 1.2.2 to 1.2.3 (#4639)
- bump github.com/gofiber/utils/v2 from 2.4.1 to 2.4.2 (#4634)
- bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#4627)
- bump streetsidesoftware/cspell-action from 8.4.0 to 9.0.1 (#4624)
- bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3 (#4623)
- bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#4622)
- bump the golang-modules group with 3 updates (#4611)
- bump github.com/gofiber/schema from 1.8.3 to 1.8.4 (#4609)
</details>

## 📚 Documentation

- Clarify that c.IP() walks the proxy chain only with EnableIPValidation (#4737)
- Explain what MIMETypes does to an existing format (#4664)
- Document the nested and array field notations in Bind (#4616)
- Add a minimal CRUD and healthcheck guide (#4696)
- Fix British to American English spellings across docs (#4697)
- Update README documentation links (#4711)

**📒 Documentation**: https://docs.gofiber.io/

**💬 Discord**: https://gofiber.io/discord

**Full Changelog**: https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0

Thank you @00200200, @Arvin-Lee, @AshSgDe29071999, @BitWeaverDev, @Dev-next-gen, @Rachit-Gandhi, @ReneWerner87, @Rohilalala, @RubenPari, @VedantMadane, @ZihxS, @aditya-rohilla, @drakeo338, @evgenyponomarev, @fadiromdhan3, @fadiroot, @gaby, @h2zi, @haimingZZ, @ibraah007, @jabrailkhalil, @lazerg, @official-burak and @truongbo17 for making this release possible.