build(deps): update module github.com/valyala/fasthttp to v1.76.0 (#13526)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/valyala/fasthttp](https://redirect.github.com/valyala/fasthttp)
| `v1.75.0` → `v1.76.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fvalyala%2ffasthttp/v1.76.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fvalyala%2ffasthttp/v1.75.0/v1.76.0?slim=true)
|

---

### Release Notes

<details>
<summary>valyala/fasthttp (github.com/valyala/fasthttp)</summary>

###
[`v1.76.0`](https://redirect.github.com/valyala/fasthttp/releases/tag/v1.76.0)

[Compare
Source](https://redirect.github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0)

`v1.76.0` strengthens HTTP message framing, static-file isolation, and
server connection handling. It also improves HTTP compatibility, avoids
quadratic work when parsing large trailer sets, and adds configurable
TCP keep-alives to `TCPDialer`.

#### Security fixes and hardening

- **Multipart parsing consumes the entire declared body.** Bytes after
the closing multipart boundary are drained before the connection is
reused, preventing a multipart epilogue from being interpreted as
another request.
[#&#8203;2336](https://redirect.github.com/valyala/fasthttp/pull/2336)
- **Outgoing messages preserve framing.** Raw `Content-Length` headers
are synchronized with the outgoing body, duplicate or conflicting
framing headers are rejected, and fixed-length request and response
streams cannot write beyond their declared size. `FS` and `SendFile`
also stop at the advertised `Content-Length` when a file grows during
serving.
[#&#8203;2470](https://redirect.github.com/valyala/fasthttp/pull/2470),
[#&#8203;2462](https://redirect.github.com/valyala/fasthttp/pull/2462)
- **Requests with both `Content-Length` and `Transfer-Encoding` close
the connection.** The connection is no longer reused after a request
containing both framing headers.
[#&#8203;2476](https://redirect.github.com/valyala/fasthttp/pull/2476)
- **Virtual-host file serving preserves directory isolation.**
`NewVHostPathRewriter` avoids decoding the host and path twice and
handles invalid hosts safely, preventing crafted requests from escaping
the virtual-host directory and accessing files directly under `FS.Root`.
This affects `FS` handlers using `NewVHostPathRewriter`.
[#&#8203;2487](https://redirect.github.com/valyala/fasthttp/pull/2487)
- **Rejected TLS connections no longer block the accept loop.**
Connections rejected by `MaxConnsPerIP` or `Concurrency` are closed
without attempting an HTTP error response, which could otherwise trigger
a TLS handshake and stall while waiting for a `ClientHello`. IPv6
clients are now also counted against `MaxConnsPerIP`.
[#&#8203;2486](https://redirect.github.com/valyala/fasthttp/pull/2486),
[#&#8203;2468](https://redirect.github.com/valyala/fasthttp/pull/2468)

#### Performance improvements

- **Trailer parsing avoids quadratic work.** Large sets of trailer names
use indexed membership checks instead of repeatedly scanning all
previously recorded names. This reduces CPU amplification from crafted
`Trailer` headers and chunked trailer sections while preserving trailer
order.
[#&#8203;2465](https://redirect.github.com/valyala/fasthttp/pull/2465)

#### HTTP compatibility and features

- **Static files handle range and conditional requests more
accurately.** Unsupported range units and multiple ranges are ignored
instead of returning `416`; invalid single byte ranges still return
`416`. `Range` is also ignored when `If-Range` does not match, and both
`Range` and `If-Modified-Since` are ignored for methods other than GET
and HEAD.
[#&#8203;2467](https://redirect.github.com/valyala/fasthttp/pull/2467),
[#&#8203;2473](https://redirect.github.com/valyala/fasthttp/pull/2473),
[#&#8203;2474](https://redirect.github.com/valyala/fasthttp/pull/2474),
[#&#8203;2475](https://redirect.github.com/valyala/fasthttp/pull/2475)
- **Pipeline clients handle HEAD responses without reading a body.**
`PipelineClient` skips the response body for HEAD requests.
[#&#8203;2469](https://redirect.github.com/valyala/fasthttp/pull/2469)
- **HTTP parsing accepts valid legacy formats and matches tokens
correctly.** `ParseHTTPDate` accepts obsolete HTTP-date formats, cookies
with an invalid `Expires` attribute remain parseable, `Expect:
100-continue` is matched case-insensitively, and `Accept-Encoding`
matches complete tokens. Asterisk-form request targets are rejected for
methods other than OPTIONS.
[#&#8203;2466](https://redirect.github.com/valyala/fasthttp/pull/2466),
[#&#8203;2481](https://redirect.github.com/valyala/fasthttp/pull/2481),
[#&#8203;2482](https://redirect.github.com/valyala/fasthttp/pull/2482),
[#&#8203;2479](https://redirect.github.com/valyala/fasthttp/pull/2479),
[#&#8203;2463](https://redirect.github.com/valyala/fasthttp/pull/2463)
- **TCP keep-alives are configurable.** The new `TCPDialer.KeepAlive`
field sets the keep-alive period for connections created by the dialer;
a negative value disables keep-alives.
[#&#8203;2484](https://redirect.github.com/valyala/fasthttp/pull/2484)

#### What's Changed

##### Security and hardening

- consume the rest of the declared body in readMultipartForm by
[@&#8203;alhudz](https://redirect.github.com/alhudz) in
[#&#8203;2336](https://redirect.github.com/valyala/fasthttp/pull/2336)
- fix: validate outgoing request framing by
[@&#8203;erikdubbelboer](https://redirect.github.com/erikdubbelboer) in
[#&#8203;2470](https://redirect.github.com/valyala/fasthttp/pull/2470)
- stop FS and SendFile at Content-Length when the file has grown by
[@&#8203;alhudz](https://redirect.github.com/alhudz) in
[#&#8203;2462](https://redirect.github.com/valyala/fasthttp/pull/2462)
- fix: close the connection after a request with both Content-Length and
Transfer-Encoding by
[@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2476](https://redirect.github.com/valyala/fasthttp/pull/2476)
- fix(fs): preserve vhost isolation during path rewriting by
[@&#8203;koyokr](https://redirect.github.com/koyokr) in
[#&#8203;2487](https://redirect.github.com/valyala/fasthttp/pull/2487)
- Fix TLS connection rejection blocking the accept loop by
[@&#8203;erikdubbelboer](https://redirect.github.com/erikdubbelboer) in
[#&#8203;2486](https://redirect.github.com/valyala/fasthttp/pull/2486)
- count IPv6 clients against MaxConnsPerIP by
[@&#8203;alhudz](https://redirect.github.com/alhudz) in
[#&#8203;2468](https://redirect.github.com/valyala/fasthttp/pull/2468)

##### Performance

- make addTrailerKey linear in the size of the trailer set by
[@&#8203;alhudz](https://redirect.github.com/alhudz) in
[#&#8203;2465](https://redirect.github.com/valyala/fasthttp/pull/2465)

##### Features

- feat: add KeepAlive option to TCPDialer by
[@&#8203;littfed](https://redirect.github.com/littfed) in
[#&#8203;2484](https://redirect.github.com/valyala/fasthttp/pull/2484)

##### Fixes

- fix(header): reject asterisk-form request-target for non-OPTIONS
methods by [@&#8203;aadieng100](https://redirect.github.com/aadieng100)
in
[#&#8203;2463](https://redirect.github.com/valyala/fasthttp/pull/2463)
- fix: accept the obsolete HTTP-date formats in ParseHTTPDate by
[@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2466](https://redirect.github.com/valyala/fasthttp/pull/2466)
- fix(fs): ignore Range headers FS can't serve instead of replying 416
by [@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2467](https://redirect.github.com/valyala/fasthttp/pull/2467)
- skip the response body for HEAD requests in PipelineClient by
[@&#8203;alhudz](https://redirect.github.com/alhudz) in
[#&#8203;2469](https://redirect.github.com/valyala/fasthttp/pull/2469)
- fix(fs): ignore If-Modified-Since for methods other than GET and HEAD
by [@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2474](https://redirect.github.com/valyala/fasthttp/pull/2474)
- fix(fs): ignore Range when the If-Range validator doesn't match by
[@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2473](https://redirect.github.com/valyala/fasthttp/pull/2473)
- fix(fs): ignore Range for methods other than GET and HEAD by
[@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2475](https://redirect.github.com/valyala/fasthttp/pull/2475)
- fix(cookie): ignore an invalid Expires attribute instead of failing to
parse by
[@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2481](https://redirect.github.com/valyala/fasthttp/pull/2481)
- fix: match the Expect: 100-continue value case-insensitively by
[@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in
[#&#8203;2482](https://redirect.github.com/valyala/fasthttp/pull/2482)
- fix: match complete Accept-Encoding tokens by
[@&#8203;jabrailkhalil](https://redirect.github.com/jabrailkhalil) in
[#&#8203;2479](https://redirect.github.com/valyala/fasthttp/pull/2479)

##### Documentation

- docs: clarify RequestURI host behavior by
[@&#8203;oozan](https://redirect.github.com/oozan) in
[#&#8203;2355](https://redirect.github.com/valyala/fasthttp/pull/2355)

##### Dependency updates

- chore(deps): bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2464](https://redirect.github.com/valyala/fasthttp/pull/2464)
- chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2483](https://redirect.github.com/valyala/fasthttp/pull/2483)
- chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2477](https://redirect.github.com/valyala/fasthttp/pull/2477)
- chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2478](https://redirect.github.com/valyala/fasthttp/pull/2478)
- chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3
by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;2485](https://redirect.github.com/valyala/fasthttp/pull/2485)

#### New Contributors

- [@&#8203;aadieng100](https://redirect.github.com/aadieng100) made
their first contribution in
[#&#8203;2463](https://redirect.github.com/valyala/fasthttp/pull/2463)
- [@&#8203;LuisFigueroaG](https://redirect.github.com/LuisFigueroaG)
made their first contribution in
[#&#8203;2466](https://redirect.github.com/valyala/fasthttp/pull/2466)
- [@&#8203;oozan](https://redirect.github.com/oozan) made their first
contribution in
[#&#8203;2355](https://redirect.github.com/valyala/fasthttp/pull/2355)
- [@&#8203;jabrailkhalil](https://redirect.github.com/jabrailkhalil)
made their first contribution in
[#&#8203;2479](https://redirect.github.com/valyala/fasthttp/pull/2479)
- [@&#8203;koyokr](https://redirect.github.com/koyokr) made their first
contribution in
[#&#8203;2487](https://redirect.github.com/valyala/fasthttp/pull/2487)

**Full Changelog**:
<https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/authelia/authelia).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

go.mod

@@ -48,7 +48,7 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.12.1
 	github.com/trustelem/zxcvbn v1.0.1
-	github.com/valyala/fasthttp v1.75.0
+	github.com/valyala/fasthttp v1.76.0
 	github.com/weppos/publicsuffix-go v0.50.3
 	github.com/wneessen/go-mail v0.8.1
 	github.com/ysmood/gson v0.7.3
@@ -86,11 +86,11 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/klauspost/compress v1.20.1 // indirect
+	github.com/klauspost/compress v1.20.3 // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/molecule-man/go-brrr v1.1.1 // indirect
+	github.com/molecule-man/go-brrr v1.3.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/onsi/gomega v1.39.1 // indirect
 	github.com/otiai10/mint v1.6.3 // indirect

go.sum

@@ -118,8 +118,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
-github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
@@ -152,8 +152,8 @@ github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa1
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/molecule-man/go-brrr v1.1.1 h1:KYwusQhjtV3smALnhmafZf4OBrh7vP4p8O47DyUmmuY=
+github.com/molecule-man/go-brrr v1.3.0 h1:KEGPkUk9PYFw5+Sv/evCOSU5OmMDXCGFqQ9YjRB7GeU=
-github.com/molecule-man/go-brrr v1.1.1/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4=
+github.com/molecule-man/go-brrr v1.3.0/go.mod h1:7ybW6/7gA3oKY45jOfVNjSJDtrr6ea4tzbsTkjmQDC4=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
@@ -210,8 +210,8 @@ github.com/trustelem/zxcvbn v1.0.1 h1:mp4JFtzdDYGj9WYSD3KQSkwwUumWNFzXaAjckaTYps
 github.com/trustelem/zxcvbn v1.0.1/go.mod h1:zonUyKeh7sw6psPf/e3DtRqkRyZvAbOfjNz/aO7YQ5s=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.75.0 h1:W3xrvNJHG60j2ZCjxpP8kkB+oPG8kh9/g1n4+3xUwNA=
+github.com/valyala/fasthttp v1.76.0 h1:QitrT4foDQuqvUnr/hzmQUDbYzV12Zz4vkLOlipU4Cw=
-github.com/valyala/fasthttp v1.75.0/go.mod h1:JiVkPRZU124PuPsreV/s9dZRgG2lRK7wNEikdQ0Rk4s=
+github.com/valyala/fasthttp v1.76.0/go.mod h1:m8oTPC8riDDky07invpl+Gz3RixnAN5BbwyUuVB5H2o=
 github.com/weppos/publicsuffix-go v0.50.3 h1:eT5dcjHQcVDNc0igpFEsGHKIip30feuB2zuuI9eJxiE=
 github.com/weppos/publicsuffix-go v0.50.3/go.mod h1:/rOa781xBykZhHK/I3QeHo92qdDKVmKZKF7s8qAEM/4=
 github.com/wneessen/go-mail v0.8.1 h1:tVcncj02/QySVFw3zr/kXOzZcuFQqBNT6K+Rbgm/pcM=