fix(deps): update module github.com/valyala/fasthttp to v1.73.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/valyala/fasthttp	v1.69.0 → v1.73.0

---

Release Notes

valyala/fasthttp (github.com/valyala/fasthttp)

v1.73.0: v1.73.0

Compare Source

What's Changed

• test: fix host comparison in FuzzURIParse by @​ReneWerner87 in #​2313
• perf: avoid redundant scans when parsing request headers by @​ReneWerner87 in #​2312
• Fix temp file leak in SaveMultipartFile on cross-device rename failure by @​itxaiohanglover in #​2311
• re-enable forcetypeassert by @​Harshal96 in #​2316
• test: normalize Go test names by @​Harshal96 in #​2317
• feat: prefix sentinel error strings by @​Harshal96 in #​2319
• fix(pprofhandler): use exact path matching to prevent debug data exposure by @​xbrxr03 in #​2302
• avoid following a symlink when writing the FS compressed cache by @​alhudz in #​2321
• refactor: improve internal interface names by @​Harshal96 in #​2318
• fix: lowercase error strings by @​Harshal96 in #​2320
• perf: reduce redundant scans and allocations in hot paths by @​ReneWerner87 in #​2322
• validate domain and path cookie attribute values on parse by @​alhudz in #​2315
• chore(deps): bump securego/gosec from 2.27.1 to 2.28.0 by @​dependabot[bot] in #​2328
• chore(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in #​2329
• fix: preserve pre-set status code in NewFastHTTPHandler by @​xbrxr03 in #​2323
• chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @​dependabot[bot] in #​2331
• reject backslash '..' traversal in fs handler on windows by @​alhudz in #​2327
• fix: reject Windows alternate data stream paths in FS by @​dev-willbird1936 in #​2335
• chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot[bot] in #​2307
• chore(deps): bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by @​dependabot[bot] in #​2308
• chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by @​dependabot[bot] in #​2309
• chore(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by @​dependabot[bot] in #​2314
• chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​2326
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2324
• chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @​dependabot[bot] in #​2325

New Contributors

• @​itxaiohanglover made their first contribution in #​2311
• @​Harshal96 made their first contribution in #​2316
• @​dev-willbird1936 made their first contribution in #​2335

Full Changelog: valyala/fasthttp@v1.72.0...v1.73.0

v1.72.0

Compare Source

What's Changed

• Update to go1.25 as minimal version by @​erikdubbelboer in #​2205
• client: add aggregate connection count metrics by @​z9z in #​2201
• fix(server): return ErrMissingFile when MultipartForm.File is nil by @​u5surf in #​2260
• bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (#​2218), #​2247 by @​erikdubbelboer in #​2271
• bug: data race on pipeline client c.chR during worker drain (#​2220) by @​erikdubbelboer in #​2272
• bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (#​2222) by @​erikdubbelboer in #​2273
• bug: double concurrency counter increment in ServeConn causes counter leak (#​2238) by @​erikdubbelboer in #​2275
• bug: body stream leak in compression methods when response is discarded (#​2244) by @​erikdubbelboer in #​2276
• bug: InMemoryListener deadlock under high concurrency (#​2245) by @​erikdubbelboer in #​2277
• bug: fasthttpadaptor writer leak, data race, and crash on handler panic (#​2246) by @​erikdubbelboer in #​2278
• bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (#​2248) by @​erikdubbelboer in #​2279
• bug: closeIdleConns TOCTOU race with serveConn idle timestamp (#​2250) by @​erikdubbelboer in #​2280
• bug: AppendCert/AppendCertEmbed not thread-safe (#​2251) by @​erikdubbelboer in #​2281
• bug: SetBodySizePoolLimit data race — plain int written without synchronization (#​2252) by @​erikdubbelboer in #​2282
• bug: file descriptor leak in prefork parent process (#​2253) by @​erikdubbelboer in #​2283
• security: SO_REUSEADDR on Windows enables port hijacking (#​2254) by @​erikdubbelboer in #​2284
• bug: file descriptor leak on z/OS s390x when FcntlInt fails (#​2255) by @​erikdubbelboer in #​2285
• bug: filesLockMap grows unboundedly, leaking memory (#​2256) by @​erikdubbelboer in #​2286
• security: TLS verification silently disabled for malformed addresses (#​2236) by @​erikdubbelboer in #​2274
• fix(fs): remove temporary file when compression fails by @​u5surf in #​2264
• fix double release of streamed client response body by @​Mereng in #​2211
• fix(client): switch to GET on 303 redirect per RFC 9110 by @​u5surf in #​2265
• ci: re-enable gocritic deferInLoop check for non-test code by @​u5surf in #​2288
• Fix flaky race tests by @​erikdubbelboer in #​2292
• fix(lbclient): prevent deadlock when all clients are removed by @​u5surf in #​2287
• reject duplicate Content-Length in response header parser by @​alhudz in #​2294
• strip cr/lf from header keys in normalizeHeaderKey by @​alhudz in #​2295
• fix(client): guard nil waiter in decConnsCount by @​SAY-5 in #​2266
• strip semicolons from cookie setters to block attribute injection by @​alhudz in #​2298
• feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open of #​2180 follow-up) by @​ReneWerner87 in #​2199
• fix: prevent data race on FSCompressedFileSuffixes map by @​xbrxr03 in #​2300
• reject duplicate Transfer-Encoding in request header parser by @​alhudz in #​2303
• preserve duplicate request headers in ConvertRequest by @​alhudz in #​2305
• fix(server): close listener on serve error in ListenAndServe helpers by @​fereidani in #​2304
• validate trailer values in parseTrailer by @​alhudz in #​2301
• Avoid default content type for empty requests by @​nkgotcode in #​2296
• chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2210
• chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2209
• chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by @​dependabot[bot] in #​2208
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2207
• chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by @​dependabot[bot] in #​2261
• chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by @​dependabot[bot] in #​2267
• chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @​dependabot[bot] in #​2289
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2290
• chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @​dependabot[bot] in #​2291
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2297

New Contributors

• @​z9z made their first contribution in #​2201
• @​Mereng made their first contribution in #​2211
• @​alhudz made their first contribution in #​2294
• @​SAY-5 made their first contribution in #​2266
• @​xbrxr03 made their first contribution in #​2300
• @​fereidani made their first contribution in #​2304
• @​nkgotcode made their first contribution in #​2296

Full Changelog: valyala/fasthttp@v1.71.0...v1.72.0

v1.71.0

Compare Source

What's Changed

• feat(client): add RetryIfErrUpstream function to handle upstream information by @​mdenushev in #​2176
• Match net/http sensitive header redirect policy by @​erikdubbelboer in #​2181
• Sanitize first-line header setters to prevent CRLF injection by @​erikdubbelboer in #​2182
• server: apply ReadTimeout before first byte with ReduceMemoryUsage by @​erikdubbelboer in #​2183
• header: reject invalid trailer names by @​erikdubbelboer in #​2188
• header: reject pre-colon whitespace in request headers by @​erikdubbelboer in #​2187
• Sanitize redirect Location header to prevent CRLF injection by @​erikdubbelboer in #​2186
• server: keep hijacked reader out of pool by @​erikdubbelboer in #​2184
• Sanitize cookie setters to prevent CRLF injection by @​erikdubbelboer in #​2185
• feat: add ExpectHandler for richer Expect: 100-continue handling by @​miretskiy in #​2175
• http: reject whitespace before chunk extensions by @​erikdubbelboer in #​2193
• header: reject unsupported response Transfer-Encoding by @​erikdubbelboer in #​2192
• header: match net/http CL+TE handling by @​erikdubbelboer in #​2190
• chore(deps): bump securego/gosec from 2.25.0 to 2.26.1 by @​dependabot[bot] in #​2195
• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @​dependabot[bot] in #​2196
• feat(prefork): Enhance prefork management with WatchMaster, CommandProducer, and Windows support by @​ReneWerner87 in #​2180

New Contributors

• @​miretskiy made their first contribution in #​2175

Full Changelog: valyala/fasthttp@v1.70.0...v1.71.0

v1.70.0

Compare Source

What's Changed

• Go 1.26 and golangci-lint updates by @​erikdubbelboer in #​2146
• Add WithLimit methods for uncompression by @​erikdubbelboer in #​2147
• Honor Root for fs.FS and normalize fs-style roots by @​erikdubbelboer in #​2145
• Sanitize header values in all setter paths to prevent CRLF injection by @​erikdubbelboer in #​2162
• Add ServeFileLiteral, ServeFSLiteral and SendFileLiteral by @​erikdubbelboer in #​2163
• Prevent chunk extension request smuggling by @​erikdubbelboer in #​2165
• Validate request URI format during header parsing to reject malformed requests by @​erikdubbelboer in #​2168
• HTTP1/1 requires exactly one Host header by @​erikdubbelboer in #​2164
• Strict HTTP version validation and simplified first line parsing by @​erikdubbelboer in #​2167
• Only normalize pre-colon whitespace for HTTP headers by @​erikdubbelboer in #​2172
• fs: reject '..' path segments in rewritten paths by @​erikdubbelboer in #​2173
• fasthttpproxy: reject CRLF in HTTP proxy CONNECT target by @​erikdubbelboer in #​2174
• fasthttpproxy: scope proxy auth cache to GetDialFunc by @​erikdubbelboer in #​2144
• feat: enhance performance by @​ReneWerner87 in #​2135
• export ErrConnectionClosed by @​pjebs in #​2152
• fix: detect master process death in prefork children by @​meruiden in #​2158
• return prev values by @​pjebs in #​2123
• docs: added httpgo to related projects by @​MUlt1mate in #​2169
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​2149
• chore(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 by @​dependabot[bot] in #​2170
• chore(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by @​dependabot[bot] in #​2129
• chore(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by @​dependabot[bot] in #​2140
• chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by @​dependabot[bot] in #​2166
• chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @​dependabot[bot] in #​2139
• chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 by @​dependabot[bot] in #​2128
• chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 by @​dependabot[bot] in #​2138
• chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by @​dependabot[bot] in #​2125
• chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @​dependabot[bot] in #​2137
• chore(deps): bump securego/gosec from 2.22.11 to 2.23.0 by @​dependabot[bot] in #​2142
• Update securego/gosec from 2.23.0 to 2.25.0 by @​erikdubbelboer in #​2161

New Contributors

• @​MUlt1mate made their first contribution in #​2169
• @​meruiden made their first contribution in #​2158

Full Changelog: valyala/fasthttp@v1.69.0...v1.70.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
github.com/andybalholm/brotli	v1.2.0 -> v1.2.2
github.com/klauspost/compress	v1.18.4 -> v1.19.1