LoginSign Up
← Back to all sparks
F

Fiber

DEVOPS
Velocity2.5

Express inspired web framework written in Go

gofiber.io ↗

Fiber marks its v2 module deprecated in favour of v3

goweb-frameworkdeprecationv3-migrationsecurity-fixes
◆Current state
Fiber's v2 line has been on narrow maintenance for months: lock cleanup, an X-Real-IP backport, HTML escaping, a CVE patch. v2.52.16 formally marks the fiber/v2 module as deprecated in favour of v3 and fixes CORS wildcard origins that accepted empty subdomain labels. The v3 line, last visible in this feed at rc.3, carries native net/http and fasthttp handler support and Express-style handlers.
◆Where it's heading
The deprecation notice tells v2 users to plan their move. With v2 patches shrinking to one or two pull requests, active development sits entirely on v3.
◆Prediction
Further v2 releases are likely to be security fixes only; the feed does not show v3's current state past rc.3.

◆Recent moves

  1. 22d ago

    Fiber v2.52.16 deprecates the v2 module and tightens CORS

    v2 is formally marked deprecated in favour of v3, and CORS wildcard origins no longer accept empty subdomain labels. The deprecation is the signal: v2 users should plan the move.

    View source ↗
  2. 3mo ago

    Idempotency middleware releases MemoryLock keys on unlock

    A single bugfix releasing MemoryLock keys on unlock in the idempotency middleware. The kind of one-PR patch that now characterizes the v2 branch.

    View source ↗
  3. 4mo ago

    X-Real-IP overwrite fix backported to v2

    A BalancerForward X-Real-IP overwrite fix backported from the v3 line, plus a first-time contributor. Maintenance work flowing backward from where development actually happens.

    View source ↗
  4. 6mo ago

    Ctx.Format now escapes HTML output

    HTML output in Ctx.Format is now escaped, closing an injection path for anything rendering user-controlled content through it. A behavior change worth knowing about despite the one-line release note.

    View source ↗
  5. 8mo ago

    Security patch for GHSA-mrq8-rjmw-wpq3

    A CVE fix shipped with no detail beyond the advisory identifier. Thin as a release note, but a patch worth taking for anyone running the v2 branch in production.

    View source ↗
  6. 9mo ago

    Mount improvements and limiter middleware fixes

    Improved mount functionality, defensive copying backports, and limiter middleware fixes — the most substantive v2 release in this window, and still entirely backported hardening rather than new capability.

    View source ↗