mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
renovate[bot]
7f005fcd90
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/valyala/fasthttp](https://redirect.github.com/valyala/fasthttp) | `v1.75.0` → `v1.76.0` |  |  | --- ### Release Notes <details> <summary>valyala/fasthttp (github.com/valyala/fasthttp)</summary> ### [`v1.76.0`](https://redirect.github.com/valyala/fasthttp/releases/tag/v1.76.0) [Compare Source](https://redirect.github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0) `v1.76.0` strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to `TCPDialer`. #### Security fixes and hardening - **Multipart parsing consumes the entire declared body.** Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. [#​2336](https://redirect.github.com/valyala/fasthttp/pull/2336) - **Outgoing messages preserve framing.** Raw `Content-Length` headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. `FS` and `SendFile` also stop at the advertised `Content-Length` when a file grows during serving. [#​2470](https://redirect.github.com/valyala/fasthttp/pull/2470), [#​2462](https://redirect.github.com/valyala/fasthttp/pull/2462) - **Requests with both `Content-Length` and `Transfer-Encoding` close the connection.** The connection is no longer reused after a request containing both framing headers. [#​2476](https://redirect.github.com/valyala/fasthttp/pull/2476) - **Virtual-host file serving preserves directory isolation.** `NewVHostPathRewriter` avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under `FS.Root`. This affects `FS` handlers using `NewVHostPathRewriter`. [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) - **Rejected TLS connections no longer block the accept loop.** Connections rejected by `MaxConnsPerIP` or `Concurrency` are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a `ClientHello`. IPv6 clients are now also counted against `MaxConnsPerIP`. [#​2486](https://redirect.github.com/valyala/fasthttp/pull/2486), [#​2468](https://redirect.github.com/valyala/fasthttp/pull/2468) #### Performance improvements - **Trailer parsing avoids quadratic work.** Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted `Trailer` headers and chunked trailer sections while preserving trailer order. [#​2465](https://redirect.github.com/valyala/fasthttp/pull/2465) #### HTTP compatibility and features - **Static files handle range and conditional requests more accurately.** Unsupported range units and multiple ranges are ignored instead of returning `416`; invalid single byte ranges still return `416`. `Range` is also ignored when `If-Range` does not match, and both `Range` and `If-Modified-Since` are ignored for methods other than GET and HEAD. [#​2467](https://redirect.github.com/valyala/fasthttp/pull/2467), [#​2473](https://redirect.github.com/valyala/fasthttp/pull/2473), [#​2474](https://redirect.github.com/valyala/fasthttp/pull/2474), [#​2475](https://redirect.github.com/valyala/fasthttp/pull/2475) - **Pipeline clients handle HEAD responses without reading a body.** `PipelineClient` skips the response body for HEAD requests. [#​2469](https://redirect.github.com/valyala/fasthttp/pull/2469) - **HTTP parsing accepts valid legacy formats and matches tokens correctly.** `ParseHTTPDate` accepts obsolete HTTP-date formats, cookies with an invalid `Expires` attribute remain parseable, `Expect: 100-continue` is matched case-insensitively, and `Accept-Encoding` matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466), [#​2481](https://redirect.github.com/valyala/fasthttp/pull/2481), [#​2482](https://redirect.github.com/valyala/fasthttp/pull/2482), [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479), [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - **TCP keep-alives are configurable.** The new `TCPDialer.KeepAlive` field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. [#​2484](https://redirect.github.com/valyala/fasthttp/pull/2484) #### What's Changed ##### Security and hardening - consume the rest of the declared body in readMultipartForm by [@​alhudz](https://redirect.github.com/alhudz) in [#​2336](https://redirect.github.com/valyala/fasthttp/pull/2336) - fix: validate outgoing request framing by [@​erikdubbelboer](https://redirect.github.com/erikdubbelboer) in [#​2470](https://redirect.github.com/valyala/fasthttp/pull/2470) - stop FS and SendFile at Content-Length when the file has grown by [@​alhudz](https://redirect.github.com/alhudz) in [#​2462](https://redirect.github.com/valyala/fasthttp/pull/2462) - fix: close the connection after a request with both Content-Length and Transfer-Encoding by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2476](https://redirect.github.com/valyala/fasthttp/pull/2476) - fix(fs): preserve vhost isolation during path rewriting by [@​koyokr](https://redirect.github.com/koyokr) in [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) - Fix TLS connection rejection blocking the accept loop by [@​erikdubbelboer](https://redirect.github.com/erikdubbelboer) in [#​2486](https://redirect.github.com/valyala/fasthttp/pull/2486) - count IPv6 clients against MaxConnsPerIP by [@​alhudz](https://redirect.github.com/alhudz) in [#​2468](https://redirect.github.com/valyala/fasthttp/pull/2468) ##### Performance - make addTrailerKey linear in the size of the trailer set by [@​alhudz](https://redirect.github.com/alhudz) in [#​2465](https://redirect.github.com/valyala/fasthttp/pull/2465) ##### Features - feat: add KeepAlive option to TCPDialer by [@​littfed](https://redirect.github.com/littfed) in [#​2484](https://redirect.github.com/valyala/fasthttp/pull/2484) ##### Fixes - fix(header): reject asterisk-form request-target for non-OPTIONS methods by [@​aadieng100](https://redirect.github.com/aadieng100) in [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - fix: accept the obsolete HTTP-date formats in ParseHTTPDate by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466) - fix(fs): ignore Range headers FS can't serve instead of replying 416 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2467](https://redirect.github.com/valyala/fasthttp/pull/2467) - skip the response body for HEAD requests in PipelineClient by [@​alhudz](https://redirect.github.com/alhudz) in [#​2469](https://redirect.github.com/valyala/fasthttp/pull/2469) - fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2474](https://redirect.github.com/valyala/fasthttp/pull/2474) - fix(fs): ignore Range when the If-Range validator doesn't match by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2473](https://redirect.github.com/valyala/fasthttp/pull/2473) - fix(fs): ignore Range for methods other than GET and HEAD by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2475](https://redirect.github.com/valyala/fasthttp/pull/2475) - fix(cookie): ignore an invalid Expires attribute instead of failing to parse by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2481](https://redirect.github.com/valyala/fasthttp/pull/2481) - fix: match the Expect: 100-continue value case-insensitively by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​2482](https://redirect.github.com/valyala/fasthttp/pull/2482) - fix: match complete Accept-Encoding tokens by [@​jabrailkhalil](https://redirect.github.com/jabrailkhalil) in [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479) ##### Documentation - docs: clarify RequestURI host behavior by [@​oozan](https://redirect.github.com/oozan) in [#​2355](https://redirect.github.com/valyala/fasthttp/pull/2355) ##### Dependency updates - chore(deps): bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2464](https://redirect.github.com/valyala/fasthttp/pull/2464) - chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2483](https://redirect.github.com/valyala/fasthttp/pull/2483) - chore(deps): bump golang.org/x/sys from 0.48.0 to 0.49.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/valyala/fasthttp/pull/2477) - chore(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/valyala/fasthttp/pull/2478) - chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2485](https://redirect.github.com/valyala/fasthttp/pull/2485) #### New Contributors - [@​aadieng100](https://redirect.github.com/aadieng100) made their first contribution in [#​2463](https://redirect.github.com/valyala/fasthttp/pull/2463) - [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) made their first contribution in [#​2466](https://redirect.github.com/valyala/fasthttp/pull/2466) - [@​oozan](https://redirect.github.com/oozan) made their first contribution in [#​2355](https://redirect.github.com/valyala/fasthttp/pull/2355) - [@​jabrailkhalil](https://redirect.github.com/jabrailkhalil) made their first contribution in [#​2479](https://redirect.github.com/valyala/fasthttp/pull/2479) - [@​koyokr](https://redirect.github.com/koyokr) made their first contribution in [#​2487](https://redirect.github.com/valyala/fasthttp/pull/2487) **Full Changelog**: <https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/authelia/authelia). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
125 lines
4.9 KiB
AMPL
125 lines
4.9 KiB
AMPL
// SPDX-FileCopyrightText: 2026 Authelia
|
|
//
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
module github.com/authelia/authelia/v4
|
|
|
|
go 1.27.0
|
|
|
|
toolchain go1.27.2
|
|
|
|
require (
|
|
authelia.com/provider/oauth2 v0.3.3
|
|
cel.dev/cel-go v0.32.0
|
|
github.com/asaskevich/govalidator/v12 v12.0.0
|
|
github.com/authelia/jsonschema v0.1.7
|
|
github.com/authelia/otp v1.0.4
|
|
github.com/duosecurity/duo_api_golang v0.3.0
|
|
github.com/fasthttp/router v1.5.4
|
|
github.com/fasthttp/session/v2 v2.5.9
|
|
github.com/fsnotify/fsnotify v1.10.1
|
|
github.com/go-asn1-ber/asn1-ber v1.5.8
|
|
github.com/go-crypt/crypt v0.14.15
|
|
github.com/go-ldap/ldap/v3 v3.4.15
|
|
github.com/go-rod/rod v0.116.2
|
|
github.com/go-sql-driver/mysql v1.10.1
|
|
github.com/go-viper/mapstructure/v2 v2.5.0
|
|
github.com/go-webauthn/webauthn v0.18.2
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/hashicorp/go-retryablehttp v0.7.8
|
|
github.com/jackc/pgx/v5 v5.11.0
|
|
github.com/knadh/koanf/parsers/json v1.0.1
|
|
github.com/knadh/koanf/parsers/toml/v2 v2.2.2
|
|
github.com/knadh/koanf/parsers/yaml v1.1.1
|
|
github.com/knadh/koanf/providers/confmap v1.0.1
|
|
github.com/knadh/koanf/providers/env/v2 v2.0.2
|
|
github.com/knadh/koanf/providers/posflag v1.0.2
|
|
github.com/knadh/koanf/providers/rawbytes v1.0.1
|
|
github.com/knadh/koanf/v2 v2.4.1
|
|
github.com/mattn/go-sqlite3 v1.14.52
|
|
github.com/otiai10/copy v1.14.1
|
|
github.com/pelletier/go-toml/v2 v2.4.3
|
|
github.com/prometheus/client_golang v1.25.0
|
|
github.com/rpadovani/sqlx-v2 v0.1.2
|
|
github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761
|
|
github.com/sirupsen/logrus v1.10.2
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/stretchr/testify v1.12.1
|
|
github.com/trustelem/zxcvbn v1.0.1
|
|
github.com/valyala/fasthttp v1.76.0
|
|
github.com/weppos/publicsuffix-go v0.50.3
|
|
github.com/wneessen/go-mail v0.8.1
|
|
github.com/ysmood/gson v0.7.3
|
|
go.uber.org/mock v0.6.0
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.6
|
|
golang.org/x/crypto v0.58.0
|
|
golang.org/x/net v0.61.0
|
|
golang.org/x/sync v0.24.0
|
|
golang.org/x/term v0.47.0
|
|
golang.org/x/text v0.43.0
|
|
golang.org/x/time v0.16.0
|
|
)
|
|
|
|
require (
|
|
cel.dev/expr v0.25.1 // indirect
|
|
filippo.io/edwards25519 v1.2.0 // indirect
|
|
github.com/Azure/go-ntlmssp v0.1.1 // indirect
|
|
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boombuler/barcode v1.1.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/dgraph-io/ristretto v0.2.0 // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/dlclark/regexp2 v1.12.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.4 // indirect
|
|
github.com/go-crypt/x v0.4.16 // indirect
|
|
github.com/go-redis/redis/v8 v8.11.5 // indirect
|
|
github.com/go-webauthn/x v0.3.1 // indirect
|
|
github.com/google/go-tpm v0.9.8 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/iancoleman/orderedmap v0.3.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/klauspost/compress v1.20.3 // indirect
|
|
github.com/knadh/koanf/maps v0.1.2 // indirect
|
|
github.com/mitchellh/copystructure v1.2.0 // indirect
|
|
github.com/mitchellh/reflectwalk v1.0.2 // indirect
|
|
github.com/molecule-man/go-brrr v1.3.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/onsi/gomega v1.39.1 // indirect
|
|
github.com/otiai10/mint v1.6.3 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/client_model v0.6.3 // indirect
|
|
github.com/prometheus/common v0.72.0 // indirect
|
|
github.com/prometheus/procfs v0.22.0 // indirect
|
|
github.com/redis/go-redis/v9 v9.18.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/test-go/testify v1.1.4 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
github.com/ysmood/fetchup v0.3.0 // indirect
|
|
github.com/ysmood/goob v0.4.0 // indirect
|
|
github.com/ysmood/got v0.42.3 // indirect
|
|
github.com/ysmood/leakless v0.9.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
|
|
golang.org/x/oauth2 v0.37.0 // indirect
|
|
golang.org/x/sys v0.49.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
)
|
|
|
|
replace filippo.io/edwards25519 v1.1.0 => filippo.io/edwards25519 v1.2.0
|
|
|
|
exclude github.com/mattn/go-sqlite3 v2.0.3+incompatible
|