Fiber 3.5.0

Verdict: update now. I spent the morning wiring Fiber 3.5.0 into a production API, and the new proxy security defaults alone are worth the upgrade — they close a class of SSRF-ish holes you might not even know you had.

Security First: Proxy Hardening Out of the Box

The big one. Fiber's proxy middleware now ships with a proxy.SecurityPolicy that has secure defaults: private and loopback upstreams are rejected, non-HTTP(S) schemes are refused, and HTTPS-to-HTTP redirect downgrades are blocked. Hop-by-hop headers get stripped too. If you proxy to internal services, you opt back in explicitly:

proxy.WithSecurityPolicy(proxy.SecurityPolicy{
    AllowPrivateIPs: true, // internal upstreams are blocked by default
})

That's a real behavioral change — if your app proxies to 127.0.0.1 or 10.x addresses, read the proxy docs before deploying, or you'll see requests start failing by design.

Binding Precedence, Your Way

New binding_source struct tag lets you override the order Bind().All() resolves sources, per struct. Query, header, cookie, body, URI — you pick the priority, and the resolved order is cached per reflect.Type, so no reflection tax on every request:

type SearchReq struct {
    Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
}

Performance: Route Matching Got a Flat Tree

Routing was the star of the perf section. A flat tree index plus leading-byte candidate rejection makes unmatched routes fail fast, and a specialized /const/:param matcher speeds up the common case. Hot-path scanners got SWAR-accelerated utils helpers, and adaptor/proxy paths adopted gofiber/utils v2.4.0. In my benchmarks, a mixed workload with ~200 routes saw single-digit-percent gains — nothing magical, but free.

Fixes Worth Knowing

• Open redirects fixed in composed route URLs and redirect rules (#4584)
• Redirect.Route now URL-encodes query values (#4529)
• Float route constraints accept the full float64 range now (#4528)
• Route buckets stay intact during rebuilds — no more stale-route surprises (#4579)

How I'd Upgrade

go get github.com/gofiber/fiber/[email protected], then run your test suite twice: once for the binding changes, once with SkipUnmatchedRoutes: true flipped on to see if you were relying on middleware running for unknown paths. The 404/405 fast path is off by default, so it's a safe experiment.