mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
build(deps): update module github.com/valyala/fasthttp to v1.76.0 (#13526)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/valyala/fasthttp](https://redirect.github.com/valyala/fasthttp) | `v1.75.0` → `v1.76.0` |  |  | --- ### Release Notes <details> <summary>valyala/fasthttp (github.com/valyala/fasthttp)</summary> ### [`v1.76.0`](https://redirect.github.com/valyala/fasthttp/releases/tag/v1.76.0) [Compare Source](https://redirect.github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0) `v1.76.0` strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to `TCPDialer`. #### Security fixes and hardening - **Multipart parsing consumes the entire declared body.** Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. [#​2336](https://redirect.github.com/valyala/fasthttp/pull/2336) - **Outgoing messages preserve framing.** Raw `Content-Length` headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. `FS` and `SendFile` also stop at the advertised `Content-Length` when a file grows during serving. [#​2470](https://redirect.github.com/valyala/fasthttp/pull/2470), [#​2462](https://redirect.github.com/valyala/fasthttp/pull/2462) - **Requests with both `Content-Length` and `Transfer-Encoding` close the connection.** The connection is no longer reused after a request containing both framing headers. [#​2476](https://redirect.github.com/valyala/fasthttp/pull/2476) - **Virtual-host file serving preserves directory isolation.** `NewVHostPathRewriter` avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under `FS.Root`. This affects `FS` handlers using `NewVHostPathRewriter`. [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) - **Rejected TLS connections no longer block the accept loop.** Connections rejected by `MaxConnsPerIP` or `Concurrency` are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a `ClientHello`. IPv6 clients are now also counted against `MaxConnsPerIP`. [#​2486](https://redirect.github.com/valyala/fasthttp/pull/2486), [#​2468](https://redirect.github.com/valyala/fasthttp/pull/2468) #### Performance improvements - **Trailer parsing avoids quadratic work.** Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted `Trailer` headers and chunked trailer sections while preserving trailer order. [#​2465](https://redirect.github.com/valyala/fasthttp/pull/2465) #### HTTP compatibility and features - **Static files handle range and conditional requests more accurately.** Unsupported range units and multiple ranges are ignored instead of returning `416`; invalid single byte ranges still return `416`. `Range` is also ignored when `If-Range` does not match, and both `Range` and `If-Modified-Since` are ignored for methods other than GET and HEAD. [#​2467](https://redirect.github.com/valyala/fasthttp/pull/2467), [#​2473](https://redirect.github.com/valyala/fasthttp/pull/2473), [#​2474](https://redirect.github.com/valyala/fasthttp/pull/2474), [#​2475](https://redirect.github.com/valyala/fasthttp/pull/2475) - **Pipeline clients handle HEAD responses without reading a body.** `PipelineClient` skips the response body for HEAD requests. [#​2469](https://redirect.github.com/valyala/fasthttp/pull/2469) - **HTTP parsing accepts valid legacy formats and matches tokens correctly.** `ParseHTTPDate` accepts obsolete HTTP-date formats, cookies with an invalid `Expires` attribute remain parseable, `Expect: 100-continue` is matched case-insensitively, and `Accept-Encoding` matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466), [#​2481](https://redirect.github.com/valyala/fasthttp/pull/2481), [#​2482](https://redirect.github.com/valyala/fasthttp/pull/2482), [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479), [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - **TCP keep-alives are configurable.** The new `TCPDialer.KeepAlive` field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. [#​2484](https://redirect.github.com/valyala/fasthttp/pull/2484) #### What's Changed ##### Security and hardening - consume the rest of the declared body in readMultipartForm by [@​alhudz](https://redirect.github.com/alhudz) in [#​2336](https://redirect.github.com/valyala/fasthttp/pull/2336) - fix: validate outgoing request framing by [@​erikdubbelboer](https://redirect.github.com/erikdubbelboer) in [#​2470](https://redirect.github.com/valyala/fasthttp/pull/2470) - stop FS and SendFile at Content-Length when the file has grown by [@​alhudz](https://redirect.github.com/alhudz) in [#​2462](https://redirect.github.com/valyala/fasthttp/pull/2462) - fix: close the connection after a request with both Content-Length and Transfer-Encoding by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2476](https://redirect.github.com/valyala/fasthttp/pull/2476) - fix(fs): preserve vhost isolation during path rewriting by [@​koyokr](https://redirect.github.com/koyokr) in [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) - Fix TLS connection rejection blocking the accept loop by [@​erikdubbelboer](https://redirect.github.com/erikdubbelboer) in [#​2486](https://redirect.github.com/valyala/fasthttp/pull/2486) - count IPv6 clients against MaxConnsPerIP by [@​alhudz](https://redirect.github.com/alhudz) in [#​2468](https://redirect.github.com/valyala/fasthttp/pull/2468) ##### Performance - make addTrailerKey linear in the size of the trailer set by [@​alhudz](https://redirect.github.com/alhudz) in [#​2465](https://redirect.github.com/valyala/fasthttp/pull/2465) ##### Features - feat: add KeepAlive option to TCPDialer by [@​littfed](https://redirect.github.com/littfed) in [#​2484](https://redirect.github.com/valyala/fasthttp/pull/2484) ##### Fixes - fix(header): reject asterisk-form request-target for non-OPTIONS methods by [@​aadieng100](https://redirect.github.com/aadieng100) in [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - fix: accept the obsolete HTTP-date formats in ParseHTTPDate by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466) - fix(fs): ignore Range headers FS can't serve instead of replying 416 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2467](https://redirect.github.com/valyala/fasthttp/pull/2467) - skip the response body for HEAD requests in PipelineClient by [@​alhudz](https://redirect.github.com/alhudz) in [#​2469](https://redirect.github.com/valyala/fasthttp/pull/2469) - fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2474](https://redirect.github.com/valyala/fasthttp/pull/2474) - fix(fs): ignore Range when the If-Range validator doesn't match by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2473](https://redirect.github.com/valyala/fasthttp/pull/2473) - fix(fs): ignore Range for methods other than GET and HEAD by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2475](https://redirect.github.com/valyala/fasthttp/pull/2475) - fix(cookie): ignore an invalid Expires attribute instead of failing to parse by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2481](https://redirect.github.com/valyala/fasthttp/pull/2481) - fix: match the Expect: 100-continue value case-insensitively by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2482](https://redirect.github.com/valyala/fasthttp/pull/2482) - fix: match complete Accept-Encoding tokens by [@​jabrailkhalil](https://redirect.github.com/jabrailkhalil) in [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479) ##### Documentation - docs: clarify RequestURI host behavior by [@​oozan](https://redirect.github.com/oozan) in [#​2355](https://redirect.github.com/valyala/fasthttp/pull/2355) ##### Dependency updates - chore(deps): bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2464](https://redirect.github.com/valyala/fasthttp/pull/2464) - chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2483](https://redirect.github.com/valyala/fasthttp/pull/2483) - chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/valyala/fasthttp/pull/2477) - chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/valyala/fasthttp/pull/2478) - chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2485](https://redirect.github.com/valyala/fasthttp/pull/2485) #### New Contributors - [@​aadieng100](https://redirect.github.com/aadieng100) made their first contribution in [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) made their first contribution in [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466) - [@​oozan](https://redirect.github.com/oozan) made their first contribution in [#​2355](https://redirect.github.com/valyala/fasthttp/pull/2355) - [@​jabrailkhalil](https://redirect.github.com/jabrailkhalil) made their first contribution in [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479) - [@​koyokr](https://redirect.github.com/koyokr) made their first contribution in [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) **Full Changelog**: <https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This commit is contained in:
renovate[bot] authored and GitHub committed
1 parent
cba3340141
commit
7f005fcd90
2 files changed
+9
-9
No files matched your search
@@ -48,7 +48,7 @@ require (
|
||||
github.com/spf13/pflag v1.0.10
|
||||
github.com/stretchr/testify v1.12.1
|
||||
github.com/trustelem/zxcvbn v1.0.1
|
||||
github.com/valyala/fasthttp v1.75.0
|
||||
github.com/valyala/fasthttp v1.76.0
|
||||
github.com/weppos/publicsuffix-go v0.50.3
|
||||
github.com/wneessen/go-mail v0.8.1
|
||||
github.com/ysmood/gson v0.7.3
|
||||
@@ -86,11 +86,11 @@ require (
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
||||
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
||||
github.com/klauspost/compress v1.20.1 // indirect
|
||||
github.com/klauspost/compress v1.20.3 // indirect
|
||||
github.com/knadh/koanf/maps v0.1.2 // indirect
|
||||
github.com/mitchellh/copystructure v1.2.0 // indirect
|
||||
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
||||
github.com/molecule-man/go-brrr v1.1.1 // indirect
|
||||
github.com/molecule-man/go-brrr v1.3.0 // indirect
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
||||
github.com/onsi/gomega v1.39.1 // indirect
|
||||
github.com/otiai10/mint v1.6.3 // indirect
|
||||
|
||||
@@ -118,8 +118,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
|
||||
github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
|
||||
github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
|
||||
github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
|
||||
github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
|
||||
github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
|
||||
github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
|
||||
github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
|
||||
github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=
|
||||
github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
|
||||
github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
|
||||
@@ -152,8 +152,8 @@ github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa1
|
||||
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
|
||||
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
|
||||
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
|
||||
github.com/molecule-man/go-brrr v1.1.1 h1:KYwusQhjtV3smALnhmafZf4OBrh7vP4p8O47DyUmmuY=
|
||||
github.com/molecule-man/go-brrr v1.1.1/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4=
|
||||
github.com/molecule-man/go-brrr v1.3.0 h1:KEGPkUk9PYFw5+Sv/evCOSU5OmMDXCGFqQ9YjRB7GeU=
|
||||
github.com/molecule-man/go-brrr v1.3.0/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
|
||||
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
|
||||
github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
|
||||
@@ -210,8 +210,8 @@ github.com/trustelem/zxcvbn v1.0.1 h1:mp4JFtzdDYGj9WYSD3KQSkwwUumWNFzXaAjckaTYps
|
||||
github.com/trustelem/zxcvbn v1.0.1/go.mod h1:zonUyKeh7sw6psPf/e3DtRqkRyZvAbOfjNz/aO7YQ5s=
|
||||
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
|
||||
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
|
||||
github.com/valyala/fasthttp v1.75.0 h1:W3xrvNJHG60j2ZCjxpP8kkB+oPG8kh9/g1n4+3xUwNA=
|
||||
github.com/valyala/fasthttp v1.75.0/go.mod h1:JiVkPRZU124PuPsreV/s9dZRgG2lRK7wNEikdQ0Rk4s=
|
||||
github.com/valyala/fasthttp v1.76.0 h1:QitrT4foDQuqvUnr/hzmQUDbYzV12Zz4vkLOlipU4Cw=
|
||||
github.com/valyala/fasthttp v1.76.0/go.mod h1:m8oTPC8riDDky07invpl+Gz3RixnAN5BbwyUuVB5H2o=
|
||||
github.com/weppos/publicsuffix-go v0.50.3 h1:eT5dcjHQcVDNc0igpFEsGHKIip30feuB2zuuI9eJxiE=
|
||||
github.com/weppos/publicsuffix-go v0.50.3/go.mod h1:/rOa781xBykZhHK/I3QeHo92qdDKVmKZKF7s8qAEM/4=
|
||||
github.com/wneessen/go-mail v0.8.1 h1:tVcncj02/QySVFw3zr/kXOzZcuFQqBNT6K+Rbgm/pcM=
|
||||
|
||||
Reference in new issue
Block a user