JavaGolangJavaScriptSwiftAndroidRustMiddleware
7 hours ago
iris
kataras

v14.0.0

Iris v14 is the first new major version since v12. The module path is github.com/kataras/iris/v14 and it requires Go 1.27 or later.

go get github.com/kataras/iris/v14@v14.0.0
package main

import "github.com/kataras/iris/v14"

type Book struct {
	Title string `json:"title"`
}

func main() {
	app := iris.New()

	app.Get("/books/{id:uuid}", func(ctx iris.Context) {
		ctx.JSON(iris.Map{"id": ctx.Params().GetString("id")})
	})

	app.Post("/books", func(ctx iris.Context) {
		book, ok := ctx.BindJSON[Book]()
		if !ok {
			return
		}

		ctx.StatusCode(iris.StatusCreated)
		ctx.JSON(book)
	})

	app.Listen(":8080")
}

ctx.BindJSON[Book]() is a generic method, which is why v14 needs Go 1.27. It decodes the body, runs Validate() error when the type has one, and answers the client itself when either step fails.

What is new

  • iris.NewBuilder assembles an application in one compile-checked chain: CORS, compression, access logging, a health endpoint, error mapping, services and API groups.
  • Typed request binding on generic methods (ctx.BindJSON[T](), ctx.BindUpdate[T]()) replaces hand-written decode blocks.
  • rest/errors: handlers report errors and one central map turns them into canonical, machine-readable responses. Internal details go to the server log and never to the client.
  • A dependency injection container is built in and replaces hero. Constructors declare what they need, Initializer hooks run at startup and closers run at shutdown.
  • JSON runs on encoding/json/v2.
  • Thirty-one built-in middleware, API keys being the newest. Sessions, cache, i18n, versioning and websocket now live under middleware/.
  • Authentication at every scale: Basic Auth typed by your own user type, API keys, a generic JWT SDK, an identity server and an OAuth2 provider.
  • ai: renders and relays streamed model output over HTTP (text deltas, reasoning traces, tool-call fragments, usage). It is provider-agnostic and ships no vendor SDK.
  • client: an HTTP client for calling other services under the same JSON rules the server side uses.
  • Views are a middleware. middleware/view holds a one-method Engine interface. The HTML, Django, Handlebars, Jet, Pug and Ace engines moved to iris-contrib/views, and kataras/blocks works as it is.
  • Server options: app.Run(iris.ServerOptions{...}) replaces iris.Addr, iris.TLS and iris.AutoTLS. ngrok tunneling is opt-in through a blank import of core/server/ngrok.
  • MVC controllers on Go generics, in controller/mvc.

Upgrading from v12

Every removed v12 name fails at compile time, so the compiler's error list is your to-do list. MIGRATION.md maps each name to its replacement. It opens with a prompt that you can paste into a coding agent, which then does the mechanical part.

The replacements most applications meet first:

v12 v14
github.com/kataras/iris/v12 github.com/kataras/iris/v14
iris.Party, app.Party(prefix) iris.Router, app.Router(prefix)
iris.Configuration, iris.With... iris.Options
iris.Addr, iris.TLS, iris.AutoTLS app.Run(iris.ServerOptions{...})
ctx.URLParam("q") ctx.Query().Get("q")
ctx.Params().Get("id") ctx.Params().GetString("id")
ctx.Header(k, v) to set, ctx.GetHeader(k) to read ctx.SetHeader(k, v) to set, ctx.Header(k) to read
app.RegisterView(engine), ctx.View(...) app.Use(view.Handler(engine)), view.Render(ctx, ...)
hero the built-in DI container
middleware/logger middleware/accesslog
middleware/recover middleware/recovery
sessions, cache, websocket, i18n, view, versioning the same names under middleware/
mvc controller/mvc
x/errors, x/client, x/jsonx rest/errors, client, rest/types

Defaults that changed

The compiler does not flag these, so read them before you deploy:

  • Session cookies are Secure and SameSite=Lax.
  • JWT tokens are read from the Authorization header only.
  • CORS no longer advertises credentials together with a wildcard origin.
  • ctx.SetCookie replaces a cookie with the same name, path and domain, and ctx.AddCookie defaults to SameSite=Lax.
  • JSON is encoded and decoded by encoding/json/v2.

MIGRATION.md explains each one, and lists the v12 bugs whose fixes change what you observe.

v12

Nothing changes for an application that imports github.com/kataras/iris/v12. That code stays on the v12 branch, and v12.2.12 is its latest release.

Documentation

Related repositories

Found a problem? Open an issue.

8 hours ago
iris
kataras

v12.2.12

This release tags everything that landed on main since v12.2.11. From now on the v12 code lives on the v12 branch, and main moves on to v14, which has its own import path. Nothing changes for your imports: v12 is still github.com/kataras/iris/v12.

Upgrade with go get github.com/kataras/iris/v12@latest.

What's new

  • The module now requires Go 1.26 (v12.2.11 required 1.22).
  • Dependencies are at their newest versions. golang.org/x/crypto goes from v0.31.0 to v0.59.0 and golang.org/x/net from v0.26.0 to v0.62.0, which brings in their security fixes.
  • sessions/sessiondb/badger moves from badger v2 to v4. Its import is now github.com/dgraph-io/badger/v4.
  • x/jsonx: ISO8601 parses timestamps with an unconventional offset, such as 2024-05-21T18:06:07.000000-04:01:19.
  • x/jsonx: new Season bitmask type and a GetSeasonByDate(SimpleDate) helper.
  • x/errors: when a response body cannot be encoded because of a NaN value, the error reports which field holds it.
  • macro/interpreter/token: Type has a String() method. A token type prints as its name (LBRACE) instead of a number.
  • New Arabic translation of the README: README_AR.md (#2539).
  • Documentation and example links point to the v12 branch, and CI runs on it.

Known issue

Keep github.com/kataras/golog at v0.1.12 and github.com/kataras/pio at v0.0.13 (#2587). Running go get -u in your app pulls golog v0.2.0 and pio v0.0.14, and Iris v12 does not compile against them. If your build breaks after an upgrade, run go get github.com/kataras/golog@v0.1.12 github.com/kataras/pio@v0.0.13.

Full changelog: https://github.com/kataras/iris/compare/v12.2.11...v12.2.12

14 hours ago
echo
labstack

v5.4.5

Security

  • Redirect middleware: HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect, WWWRedirect and NonWWWRedirect now return 400 Bad Request instead of redirecting when the host is empty, starts with : or ., contains %, or is empty after removing www.. Before this change, such hosts could produce an open redirect. The middleware no longer redirects OPTIONS * requests, maps ws and wss to http and https in redirect targets, and matches the www. prefix case-insensitively. Fixes GHSA-3f6j-cw5h-qw9c (#3217) in #3220.

Fixes

  • Trailing slash middleware: AddTrailingSlash and RemoveTrailingSlash keep escaped path segments such as %2F in redirect and forward targets, so the request still matches its original route. Fixes #3206 in #3221.
  • IPv6 zones: ExtractIPFromXFFHeader and ExtractIPFromRealIPHeader trust zoned link-local proxy peers such as [fe80::1%eth0]:8080, with or without a port. Fixes #3179 in #3222.
  • Header binding: BindHeaders no longer panics on nil or empty header value slices. Fixes #3169 in #3223.

Behavior change

Context.RealIP() and ExtractIPDirect() now return a zoned link-local peer without its zone: fe80::1, not fe80::1%eth0. Update logs, allowlists or rate-limit keys that store the zoned form.

No public API, dependency or minimum Go-version changes.

14 hours ago
echo
labstack

v4.16.4

Security

  • Redirect middleware: HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect, WWWRedirect and NonWWWRedirect now return 400 Bad Request instead of redirecting when the host is empty, starts with : or ., contains %, or is empty after removing www.. Before this change, such hosts could produce an open redirect. The middleware no longer redirects OPTIONS * requests, maps ws and wss to http and https in redirect targets, and matches the www. prefix case-insensitively. Fixes GHSA-3f6j-cw5h-qw9c (#3217) in #3224.

Fixes

  • Trailing slash middleware: AddTrailingSlash and RemoveTrailingSlash keep escaped path segments such as %2F in redirect and forward targets, so the request still matches its original route. Fixes #3206 in #3225.
  • IPv6 zones: ExtractIPFromXFFHeader and ExtractIPFromRealIPHeader trust zoned link-local proxy peers such as [fe80::1%eth0]:8080, with or without a port. Fixes #3179 in #3226.
  • Header binding: BindHeaders no longer panics on nil or empty header value slices. Fixes #3169 in #3227.

Behavior changes

  • Context.RealIP() and ExtractIPDirect() now return a zoned link-local peer without its zone: fe80::1, not fe80::1%eth0. Update logs, allowlists or rate-limit keys that store the zoned form.
  • HTTPSWWWRedirect keeps its v4 behavior: it does not redirect plain HTTP requests for hosts that already start with www.. v5 redirects these requests.

No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required.

1 days ago
ini
go-ini

v2.0.0-beta.4

1 days ago
ini
go-ini

v1.68.0

What's Changed

New Contributors

Full Changelog: https://github.com/go-ini/ini/compare/v1.67.3...v1.68.0

1 days ago
ini
go-ini

v2.0.0-beta.3

1 days ago
ini
go-ini

v2.0.0-beta.2

1 days ago
ini
go-ini

v2.0.0-beta.1

3 days ago
fiber
gofiber

v3.7.0

🚀 New

  • Update fasthttp to v1.78.0 (#4779, #4803, #4862) fasthttp v1.78.0 (from v1.75.0) hardens request framing, multipart parsing, redirects and file serving, and speeds up path normalization, query parsing, header setters and Client.Do. https://github.com/valyala/fasthttp/releases/tag/v1.78.0
  • Support map fields in query and form binding (#4788) Struct fields of type map[string]T now bind from query strings and form bodies; attributes[color] and attributes.color both give the key color. 
    type Filter struct {
    Attributes map[string]string   `query:"attributes"` // ?attributes[color]=red&attributes.size=m
    Tags       map[string][]string `query:"tags"`       // ?tags[sale]=yes&tags[sale]=new
    Limits     map[string]int      `query:"limits"`     // ?limits[max]=5
}
    https://docs.gofiber.io/api/bind#map-fields
  • Add AllowSymlinksOutsideRoot to the static middleware (#4803) A root on disk is now confined: symbolic links that leave it, and absolute ones, are handled like missing files unless AllowSymlinksOutsideRoot is set. 
    app.Use("/assets", static.New("./public", static.Config{
    AllowSymlinksOutsideRoot: true, // default: false
}))
    https://docs.gofiber.io/middleware/static#config
  • Let proxy.DoRedirects and the Fiber client drop extra sensitive headers on a redirect (#4800) New opt-in RedirectSensitiveHeaders on proxy.SecurityPolicy and the client (Client, Request, Config) names headers such as X-Api-Key that a redirect to another origin (proxy) or host (client) drops; empty by default. 
    policy := proxy.DefaultSecurityPolicy()
policy.RedirectSensitiveHeaders = []string{"X-Api-Key", "X-Auth-Token"}
proxy.WithSecurityPolicy(policy)

cli := client.New().SetRedirectSensitiveHeaders("X-Api-Key")
    https://docs.gofiber.io/middleware/proxy#headers-on-a-cross-origin-redirect

🧹 Updates

  • Share host splitting and IDNA folding (#4851)
  • Align forwarded header list parsing (#4847)
  • Share forwarded IP scanning and ignore empty elements (#4820)
  • Share redirect URL normalization (#4824)
  • Speed up media type parameter parsing (#4807)
  • Avoid allocations for empty typed lookups (#4852)
  • Consolidate control-character scanning (#4783)
  • cache/limiter: Walk Cache-Control lists with headerlist and write Retry-After without a string (#4833)
  • cors/csrf: Share origin allow-list parsing (#4836)
  • encryptcookie: Build the AEAD once per middleware instead of per cookie (#4838)
  • etag: Checksum bodies with slicing-by-8 (#4794)
  • limiter: Format rate-limit header values without allocating (#4822)
  • proxy: Copy the forwarder name before storing it in the refused-request test (#4819)
  • redirect/rewrite: Share pattern compilation (#4846)
  • Share the client cookie jar host normalization (#4844)
  • Share the value-redaction helper across middleware (#4821)
  • Deduplicate the unit tests with shared helpers (#4825)
  • Use a nolint:revive directive on App.Handler (#4831)

🐛 Fixes

  • Stop optional path parameters from swallowing a slash (#4778)
  • Stat the index for directory SendFile ranges and move the path guards into internal/fspath (#4769)
  • Skip empty forwarded host and proto elements and restore the Next loop (#4856)
  • Preserve nil first field lines when joining headers (#4840)
  • Return an empty charset when its value is not a token (#4781)
  • Preserve redirects and errors in Fresh checks (#4811)
  • Trim the whitespace around comma-split header values in Bind (#4793)
  • Reject out-of-range int and uint in generic parsers on 32-bit (#4832)
  • Make Links add to the Link header instead of replacing it (#4829)
  • Serve a request with a TLS state over TLS in app.Test (#4839)
  • Send the measured Content-Length of an unsized body in app.Test (#4830)
  • Make Listen return when GracefulContext is done during startup (#4770)
  • cache: End cached entries when a revalidation is refused with 401, 403 or 407 (#4785)
  • cache: Release the lock when CacheInvalidator panics and simplify the lock flow (#4765)
  • cache/proxy/session: Close the gaps found auditing the recent merges (#4855)
  • compress: Honor repeated and quoted response Cache-Control lines (#4802)
  • encryptcookie: Handle duplicate cookie names (#4774)
  • hostauthorization: Compare IPv6 hosts by address, not by spelling (#4798)
  • hostauthorization: Bound the port value, not its digit count (#4796)
  • idempotency: Exclude unchanged upstream headers from storage (#4834)
  • idempotency/proxy: Stop cookie replay and refuse path parameters (#4791)
  • keyauth: Omit the Bearer error parameters from the challenge when no credentials are sent (#4837)
  • limiter: Fix spec mismatches and consolidate its code and tests (#4762)
  • limiter/proxy: Fix key aliasing and the redirect, SSRF and Balancer issues (#4784)
  • static: Refuse a path with an empty first segment on a root mount (#4772)
  • Synchronize client cookie jar reads during initialization (#4843)
  • Return each key once from the client's QueryParam.Keys and FormData.Keys (#4776)
  • Copy client response header keys before reading their values (#4771)
  • Fix header, body, routing and session handling defects (#4850)

🛠️ Maintenance

19 changes
  • bump github.com/valyala/fasthttp from 1.77.0 to 1.78.0 in the fasthttp-modules group (#4862)
  • bump github.com/shamaton/msgpack/v3 from 3.2.6 to 3.2.7 (#4863)
  • bump github.com/gofiber/schema from 1.9.2 to 1.9.3 (#4853)
  • bump github.com/gofiber/utils/v2 from 2.6.3 to 2.6.4 (#4845)
  • bump go.yaml.in/yaml/v3 from 3.0.5 to 3.0.6 (#4835)
  • bump github.com/gofiber/schema from 1.9.1 to 1.9.2 (#4823)
  • bump github.com/fxamacker/cbor/v2 from 2.9.6 to 2.10.0 (#4816)
  • bump golang.org/x/net from 0.61.0 to 0.62.0 in the golang-modules group across 1 directory (#4812)
  • bump DavidAnson/markdownlint-cli2-action from 24.2.0 to 25.0.0 (#4813)
  • bump github.com/gofiber/schema from 1.9.0 to 1.9.1 (#4810)
  • bump github.com/gofiber/utils/v2 from 2.6.2 to 2.6.3 (#4808)
  • bump github.com/valyala/fasthttp from 1.76.0 to 1.77.0 in the fasthttp-modules group (#4803)
  • bump github.com/molecule-man/go-brrr from 1.3.0 to 1.3.1 (#4805)
  • bump github.com/shamaton/msgpack/v3 from 3.2.5 to 3.2.6 (#4804)
  • bump github.com/gofiber/schema from 1.8.8 to 1.9.0 (#4787)
  • bump github.com/shamaton/msgpack/v3 from 3.2.4 to 3.2.5 (#4786)
  • bump streetsidesoftware/cspell-action from 9.1.0 to 9.2.0 (#4782)
  • bump github.com/valyala/fasthttp from 1.75.0 to 1.76.0 in the fasthttp-modules group (#4779)
  • bump github.com/philhofer/fwd from 1.2.0 to 1.2.1 (#4780)
  • bump github.com/shamaton/msgpack/v3 from 3.2.3 to 3.2.4 (#4766)

📚 Documentation

  • Add a Migrate section to the README (#4790)
  • Update ctx and intro examples (#4806)
  • Explain bounding proxy-derived storage keys (#4841)
  • Explain client and server redirect control-byte policies (#4842)
  • logger: Explain the ignored SendStatus error in the fallback handler (#4826)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.1...v3.7.0

Thank you @10kartik, @Alifarid0011, @anqorithm, @appdever01, @arditxhuveli1, @b84330808, @Dev-next-gen, @ElsiPotka, @fadiromdhan3, @fadiroot, @gaby, @helmipradita, @IslamElsayed, @kaankucukx, @ninadsutrave, @nk-batman21, @PerryLink, @Rachit-Gandhi, @ReneWerner87, @RS-ITACHI, @via2004, @YOGESH256 and @yxshee for making this release possible.