chore: update module github.com/valyala/fasthttp to v1.34.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/valyala/fasthttp	v1.27.0 → v1.34.0

GitHub Vulnerability Alerts

CVE-2022-21221

The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only.

---

Release Notes

valyala/fasthttp (github.com/valyala/fasthttp)

v1.34.0

Compare Source

• 59f94a3 Update github.com/klauspost/compress (#​1237) (Mikhail Faraponov)
• 62c15a5 Don't reset RequestCtx.s (#​1234) (Erik Dubbelboer)
• 7670c6e Fix windows tests (#​1235) (Erik Dubbelboer)
• f54ffa1 feature: Keep the memory usage of the service at a stable level (#​1216) (Rennbon)
• 15262ec Warn about unsafe ServeFile usage (#​1228) (Erik Dubbelboer)
• 1116d03 Fix panic while reading invalid trailers (Erik Dubbelboer)
• 856ca8e Update dependencies (#​1230) (Mikhail Faraponov)
• 6b5bc7b Add windows support to normalizePath (Erik Dubbelboer)
• f0b0cfe Don't log ErrBadTrailer by default (Erik Dubbelboer)
• 6937fee fix: (useless check), skip Response body if http method HEAD (#​1224) (Pavel Burak)
• b85d2a2 Fix http proxy behavior (#​1221) (Aoang)
• ad8a07a RequestHeader support set no default ContentType (#​1218) (Jack.Ju)
• c94581c support configure HostClient (#​1214) (lin longhjui)
• 632e222 Client examples (#​1208) (Sergey Ponomarev)
• 6a3cc23 uri_test.go use example.com for clearness (#​1212) (Sergey Ponomarev)
• 9d665e0 Update dependencies (#​1204) (Mikhail Faraponov)
• 8d7953e Fix scheme check for not yet parsed requests (#​1203) (ArminBTVS)

v1.33.0

Compare Source

• 61aa8b1 remove redundant code (#​1202) (tyltr)
• 4369776 fix(hijack): reuse RequestCtx (#​1201) (Sergio VS)
• 2aca3e8 fix(hijack): reset userValues after hijack handler execution (#​1199) (Sergio VS)
• 9123060 Updated dependencies (#​1194) (Mikhail Faraponov)

v1.32.0

Compare Source

• 7eeb00e Make tests less flaky (#​1189) (Erik Dubbelboer)
• d19b872 Update tcpdialer.go (#​1188) (Mikhail Faraponov)
• c727b99 Release UseHostHeader in ReleaseRequest() (#​1185) (Tolyar)
• 6c0518b Fix UseHostHeader for DoTimeout + tests (#​1184) (Tolyar)
• 6b55811 Add MaxIdleWorkerDuration to Server. (#​1183) (Kilos Liu)
• 4517204 Allow to set Host header for Client (#​1169) (Tolyar)
• 258a4c1 fix: reset response after reset user values on keep-alive connections (#​1176) (Sergio VS)
• e9db537 Use %w to wrap errors (#​1175) (Erik Dubbelboer)
• 7db0597 Fix bad request trailer panic (Erik Dubbelboer)
• 4aadf9a Fix parseTrailer panic (Erik Dubbelboer)
• da7ff7a Add trailer support (#​1165) (ichx)
• 017f0aa fix: reset request after reset user values on keep-alive connections (#​1162) (Sergio VS)
• 3b117f8 feat: close idle connections when server shutdown (#​1155) (ichx)
• a94a2c3 Remove redundant code (#​1154) (ichx)
• f7c354c Fix race condition in Client.mCleaner (Erik Dubbelboer)
• c078a9d Add string and bytes buffer convert trick in README (#​1151) (ichx)
• 3ff6aaa uri: isHttps() and isHttp() (#​1150) (Sergey Ponomarev)
• 8febad0 http.go: Request.SetURI() (Fix #​1141) (#​1148) (Sergey Ponomarev)
• 2ca01c7 fix: Status Line parsing and writing (#​1135) (Shivansh Vij)
• 931d0a4 Fix lint (Erik Dubbelboer)
• d613502 use sync.map is better (#​1145) (halst)
• c15e642 Don't run all race tests on windows (#​1143) (Erik Dubbelboer)
• 6006c87 chore (#​1137) (tyltr)
• 6d4db9b Fix race condition in getTCPAddrs (Erik Dubbelboer)
• 528dd62 feat: ability to read body separate from header (#​1130) (Shivansh Vij)
• 556aa81 feat: ability to edit status messages (#​1126) (Valentin Paz Marcolla)
• 4cfec1a feat: make public Server.TLSConfig (#​1128) (Sergio VS)
• fe7d90e remove redundant code (#​1127) (tyltr)

v1.31.0

Compare Source

• 81fc968 Add warning to readme (Erik Dubbelboer)
• 7fdd526 feat: a new userData API Remove (#​1117) (tyltr)
• f307299 feat:no need to store nil (#​1116) (tyltr)
• ad6d128 URI.Parse should never change it's input (Erik Dubbelboer)
• ffab77a Improve return value reusability documentation (Erik Dubbelboer)
• 542a203 Properly parse URI (Erik Dubbelboer)
• 711e421 feat: improve TCPDialer by sync.map instead of map+mutex (#​1106) (tyltr)
• adc0e57 Remove useless runtime.KeepAlive (#​1107) (Oleg Kovalov)
• 44d0333 fix: typo (#​1105) (tyltr)
• 06b464f fix typo in deadline (#​1099) (Evgenii)
• 46d9235 Check go fmt during lint (#​1097) (Erik Dubbelboer)

v1.30.0

Compare Source

• 713da4e Adding new compressible prefixes (#​1092) (Kyle Unverferth)
• 1647255 remove unnecessary op (#​1095) (tyltr)
• f0a2189 feat: improve IsMethod (#​1088) (tyltr)
• 5d73da3 Update status.go (#​1093) (Mikhail Faraponov)
• 3f70d78 Some FS tests can't run in parallel (Erik Dubbelboer)
• ba40107 compatible with new build tag (#​1087) (tyltr)
• d9c7573 improve invalidStatusLine by appending a []byte directly (#​1086) (tyltr)
• cad867a Remove the redundant badage (#​1085) (Andy Pan)
• 38992da Fix []byte reuse bug (Erik Dubbelboer)
• 6321103 Various deadline fixes (#​1081) (Erik Dubbelboer)
• 51508d7 Fix various Windows Github Action errors (#​1082) (Erik Dubbelboer)
• c7ce95f Fix s2b (#​1079) (YenForYang)
• a50f59b Increase various test timeouts (Erik Dubbelboer)
• 0fe8cdd Optimize size of Server by moving bool fields (#​1077) (Lanco)
• a6f9c8a Fix Client doc and mCleaner (#​1076) (Erik Dubbelboer)
• 5a6e6e1 Add Go 1.17 support (#​1074) (Erik Dubbelboer)

v1.29.0

Compare Source

• 97e1319 Update compress (#​1069) (Mikhail Faraponov)
• 0263cae Fix FasthttpSocksDialer example (Erik Dubbelboer)
• d31e6db Handle perIPConn in RequestCtx.IsTLS() specially (#​1064) (Tianyi Song)
• 9466cd7 fix typo: occured -> occurred (#​1061) (Kazumasa Takenaka (Bamboo))
• b3ece39 Update README.md (#​1058) (Darío)
• d0df1e1 Add ResetUserValues() and test (#​1056) (Sujit Baniya)

v1.28.0

Compare Source

• 1504a84 Increase TestHostClientMaxConnWaitTimeoutSuccess timeout (Erik Dubbelboer)
• f6560be Flush buffered responses if we have to wait for the next request (#​1050) (Erik Dubbelboer)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/andybalholm/brotli	v1.0.2 -> v1.0.4
github.com/klauspost/compress	v1.13.6 -> v1.15.0

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[netlify]

✅ Deploy Preview for reearth-classic canceled.

Name	Link
🔨 Latest commit	444b73d
🔍 Latest deploy log	https://app.netlify.com/projects/reearth-classic/deploys/682d7b2e72821d000838f940

[renovate]

ℹ️ Artifact update notice

File name: server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/andybalholm/brotli	v1.0.2 -> v1.0.4
github.com/klauspost/compress	v1.13.6 -> v1.15.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 23.79%. Comparing base (703e022) to head (81c556c).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #72      +/-   ##
==========================================
- Coverage   23.80%   23.79%   -0.01%     
==========================================
  Files        1587     1588       +1     
  Lines      170092   170141      +49     
  Branches     2801     2801              
==========================================
  Hits        40486    40486              
- Misses     128439   128488      +49     
  Partials     1167     1167              

Flag	Coverage Δ
server	32.02% <ø> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.