[dependabot]

Bumps the go-modules group with 2 updates in the / directory: github.com/rennf93/guard-core-go/v4 and github.com/valyala/fasthttp.

Updates github.com/rennf93/guard-core-go/v4 from 4.4.0 to 4.4.1

Release notes

Sourced from github.com/rennf93/guard-core-go/v4's releases.

v4.4.1 (2026-10-19)

The quiet spec DEBUG logs release (v4.4.1)

Fixed

• The spec-DEBUG logs no longer print by default (#110, #111). The no-rules, no-geolocation and loopback-exempt country verdicts (spec 02), the short-circuit Request blocked by <check> line (spec 03, still silenced per check by muted_check_logs) and the untrusted-proxy spoof line for private and loopback peers were written unconditionally on every request. They are now emitted with log/slog at debug level, matching the reference's DEBUG semantics, so they are hidden at the default level. Call slog.SetLogLoggerLevel(slog.LevelDebug) to see them. The blocked-by line now carries check, path and method as slog attributes.

Changelog

Sourced from github.com/rennf93/guard-core-go/v4's changelog.

v4.4.1 (2026-10-19)

The quiet spec DEBUG logs release (v4.4.1)

Fixed

• The spec-DEBUG logs no longer print by default (#110, #111). The no-rules, no-geolocation and loopback-exempt country verdicts (spec 02), the short-circuit Request blocked by <check> line (spec 03, still silenced per check by muted_check_logs) and the untrusted-proxy spoof line for private and loopback peers were written unconditionally on every request. They are now emitted with log/slog at debug level, matching the reference's DEBUG semantics, so they are hidden at the default level. Call slog.SetLogLoggerLevel(slog.LevelDebug) to see them. The blocked-by line now carries check, path and method as slog attributes.

---

Commits

• 4709728 chore(release): prepare v4.4.1
• 24d452e fix(logging): emit the spec DEBUG logs through log/slog at debug level (#111)
• See full diff in compare view

Updates github.com/valyala/fasthttp from 1.75.0 to 1.76.0

Release notes

Sourced from github.com/valyala/fasthttp's releases.

v1.76.0

v1.76.0 strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to TCPDialer.

Security fixes and hardening

• Multipart parsing consumes the entire declared body. Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. #2336
• Outgoing messages preserve framing. Raw Content-Length headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. FS and SendFile also stop at the advertised Content-Length when a file grows during serving. #2470, #2462
• Requests with both Content-Length and Transfer-Encoding close the connection. The connection is no longer reused after a request containing both framing headers. #2476
• Virtual-host file serving preserves directory isolation. NewVHostPathRewriter avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under FS.Root. This affects FS handlers using NewVHostPathRewriter. #2487
• Rejected TLS connections no longer block the accept loop. Connections rejected by MaxConnsPerIP or Concurrency are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a ClientHello. IPv6 clients are now also counted against MaxConnsPerIP. #2486, #2468

Performance improvements

• Trailer parsing avoids quadratic work. Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted Trailer headers and chunked trailer sections while preserving trailer order. #2465

HTTP compatibility and features

• Static files handle range and conditional requests more accurately. Unsupported range units and multiple ranges are ignored instead of returning 416; invalid single byte ranges still return 416. Range is also ignored when If-Range does not match, and both Range and If-Modified-Since are ignored for methods other than GET and HEAD. #2467, #2473, #2474, #2475
• Pipeline clients handle HEAD responses without reading a body. PipelineClient skips the response body for HEAD requests. #2469
• HTTP parsing accepts valid legacy formats and matches tokens correctly. ParseHTTPDate accepts obsolete HTTP-date formats, cookies with an invalid Expires attribute remain parseable, Expect: 100-continue is matched case-insensitively, and Accept-Encoding matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. #2466, #2481, #2482, #2479, #2463
• TCP keep-alives are configurable. The new TCPDialer.KeepAlive field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. #2484

What's Changed

Security and hardening

• consume the rest of the declared body in readMultipartForm by @​alhudz in valyala/fasthttp#2336
• fix: validate outgoing request framing by @​erikdubbelboer in valyala/fasthttp#2470
• stop FS and SendFile at Content-Length when the file has grown by @​alhudz in valyala/fasthttp#2462
• fix: close the connection after a request with both Content-Length and Transfer-Encoding by @​LuisFigueroaG in valyala/fasthttp#2476
• fix(fs): preserve vhost isolation during path rewriting by @​koyokr in valyala/fasthttp#2487
• Fix TLS connection rejection blocking the accept loop by @​erikdubbelboer in valyala/fasthttp#2486
• count IPv6 clients against MaxConnsPerIP by @​alhudz in valyala/fasthttp#2468

Performance

• make addTrailerKey linear in the size of the trailer set by @​alhudz in valyala/fasthttp#2465

Features

• feat: add KeepAlive option to TCPDialer by @​littfed in valyala/fasthttp#2484

Fixes

• fix(header): reject asterisk-form request-target for non-OPTIONS methods by @​aadieng100 in valyala/fasthttp#2463
• fix: accept the obsolete HTTP-date formats in ParseHTTPDate by @​LuisFigueroaG in valyala/fasthttp#2466
• fix(fs): ignore Range headers FS can't serve instead of replying 416 by @​LuisFigueroaG in valyala/fasthttp#2467
• skip the response body for HEAD requests in PipelineClient by @​alhudz in valyala/fasthttp#2469
• fix(fs): ignore If-Modified-Since for methods other than GET and HEAD by @​LuisFigueroaG in valyala/fasthttp#2474
• fix(fs): ignore Range when the If-Range validator doesn't match by @​LuisFigueroaG in valyala/fasthttp#2473

... (truncated)

Commits

• 634ef44 fix(fs): preserve vhost isolation during path rewriting (#2487)
• 7aea379 feat: add KeepAlive option to TCPDialer (#2484)
• 89a91a8 fix: match complete Accept-Encoding tokens (#2479)
• 414aa59 Fix TLS connection rejection blocking the accept loop (#2486)
• 0880727 consume the rest of the declared body in readMultipartForm (#2336)
• 14a2406 fix flaky TestStreamBodyRequestContentLength
• 24922f6 chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#2485)
• 260b438 fix: match the Expect: 100-continue value case-insensitively (#2482)
• 95bdd1c chore(deps): bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 (#2483)
• 4e0f08c fix(cookie): ignore an invalid Expires attribute instead of failing to parse ...
• Additional commits viewable in compare view

[github-actions]

Thanks for opening your first pull request on fiber-guard!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• The PR body says Closes #N for an open issue (the issue-link check enforces it); chores take the no-issue label
• gofmt -l . reports no files
• go vet ./... is clean
• go test ./... passes (add -tags integration with Redis for the integration suite)
• go build ./... compiles the adapter and the example apps
• govulncheck ./... is clean
• No nolint / unchecked-error shortcuts; pre-existing violations in touched files are fixed
• If you changed adapter behavior, it stays aligned with gin-guard and nethttp-guard and the README reflects it

See README.md for the adapter contract and AGENTS.md for the boundary rules.

Welcome aboard - a maintainer will review shortly.