From 681d77154b5f2a010ddc2650438afe86bcf4ca3f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 30 Jun 2026 11:18:33 +0000
Subject: [PATCH] chore: bump github.com/valyala/fasthttp from 1.71.0 to 1.72.0
 (#26859)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp)
from 1.71.0 to 1.72.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.72.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update to go1.25 as minimal version by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2205">valyala/fasthttp#2205</a></li>
<li>client: add aggregate connection count metrics by <a
href="https://github.com/z9z"><code>@​z9z</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2201">valyala/fasthttp#2201</a></li>
<li>fix(server): return ErrMissingFile when MultipartForm.File is nil by
<a href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2260">valyala/fasthttp#2260</a></li>
<li>bug: FS cache cleaner goroutine leaks when CleanStop is nil
(default) (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2218">#2218</a>),
<a
href="https://redirect.github.com/valyala/fasthttp/issues/2247">#2247</a>
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2271">valyala/fasthttp#2271</a></li>
<li>bug: data race on pipeline client c.chR during worker drain (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2220">#2220</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2272">valyala/fasthttp#2272</a></li>
<li>bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown
mechanism (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2222">#2222</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2273">valyala/fasthttp#2273</a></li>
<li>bug: double concurrency counter increment in ServeConn causes
counter leak (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2238">#2238</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2275">valyala/fasthttp#2275</a></li>
<li>bug: body stream leak in compression methods when response is
discarded (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2244">#2244</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2276">valyala/fasthttp#2276</a></li>
<li>bug: InMemoryListener deadlock under high concurrency (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2245">#2245</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2277">valyala/fasthttp#2277</a></li>
<li>bug: fasthttpadaptor writer leak, data race, and crash on handler
panic (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2246">#2246</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2278">valyala/fasthttp#2278</a></li>
<li>bug: fasthttpproxy dialers return nil DialFunc on error, causing
panic (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2248">#2248</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2279">valyala/fasthttp#2279</a></li>
<li>bug: closeIdleConns TOCTOU race with serveConn idle timestamp (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2250">#2250</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2280">valyala/fasthttp#2280</a></li>
<li>bug: AppendCert/AppendCertEmbed not thread-safe (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2251">#2251</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2281">valyala/fasthttp#2281</a></li>
<li>bug: SetBodySizePoolLimit data race — plain int written without
synchronization (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2252">#2252</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2282">valyala/fasthttp#2282</a></li>
<li>bug: file descriptor leak in prefork parent process (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2253">#2253</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2283">valyala/fasthttp#2283</a></li>
<li>security: SO_REUSEADDR on Windows enables port hijacking (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2254">#2254</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2284">valyala/fasthttp#2284</a></li>
<li>bug: file descriptor leak on z/OS s390x when FcntlInt fails (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2255">#2255</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2285">valyala/fasthttp#2285</a></li>
<li>bug: filesLockMap grows unboundedly, leaking memory (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2256">#2256</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2286">valyala/fasthttp#2286</a></li>
<li>security: TLS verification silently disabled for malformed addresses
(<a
href="https://redirect.github.com/valyala/fasthttp/issues/2236">#2236</a>)
by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2274">valyala/fasthttp#2274</a></li>
<li>fix(fs): remove temporary file when compression fails by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2264">valyala/fasthttp#2264</a></li>
<li>fix double release of streamed client response body by <a
href="https://github.com/Mereng"><code>@​Mereng</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2211">valyala/fasthttp#2211</a></li>
<li>fix(client): switch to GET on 303 redirect per RFC 9110 by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2265">valyala/fasthttp#2265</a></li>
<li>ci: re-enable gocritic deferInLoop check for non-test code by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2288">valyala/fasthttp#2288</a></li>
<li>Fix flaky race tests by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2292">valyala/fasthttp#2292</a></li>
<li>fix(lbclient): prevent deadlock when all clients are removed by <a
href="https://github.com/u5surf"><code>@​u5surf</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2287">valyala/fasthttp#2287</a></li>
<li>reject duplicate Content-Length in response header parser by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2294">valyala/fasthttp#2294</a></li>
<li>strip cr/lf from header keys in normalizeHeaderKey by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2295">valyala/fasthttp#2295</a></li>
<li>fix(client): guard nil waiter in decConnsCount by <a
href="https://github.com/SAY-5"><code>@​SAY-5</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2266">valyala/fasthttp#2266</a></li>
<li>strip semicolons from cookie setters to block attribute injection by
<a href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2298">valyala/fasthttp#2298</a></li>
<li>feat(prefork): graceful shutdown, leak fixes, hook robustness
(re-open of <a
href="https://redirect.github.com/valyala/fasthttp/issues/2180">#2180</a>
follow-up) by <a
href="https://github.com/ReneWerner87"><code>@​ReneWerner87</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2199">valyala/fasthttp#2199</a></li>
<li>fix: prevent data race on FSCompressedFileSuffixes map by <a
href="https://github.com/xbrxr03"><code>@​xbrxr03</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2300">valyala/fasthttp#2300</a></li>
<li>reject duplicate Transfer-Encoding in request header parser by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2303">valyala/fasthttp#2303</a></li>
<li>preserve duplicate request headers in ConvertRequest by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2305">valyala/fasthttp#2305</a></li>
<li>fix(server): close listener on serve error in ListenAndServe helpers
by <a href="https://github.com/fereidani"><code>@​fereidani</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2304">valyala/fasthttp#2304</a></li>
<li>validate trailer values in parseTrailer by <a
href="https://github.com/alhudz"><code>@​alhudz</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2301">valyala/fasthttp#2301</a></li>
<li>Avoid default content type for empty requests by <a
href="https://github.com/nkgotcode"><code>@​nkgotcode</code></a> in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2296">valyala/fasthttp#2296</a></li>
<li>chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2210">valyala/fasthttp#2210</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2209">valyala/fasthttp#2209</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2208">valyala/fasthttp#2208</a></li>
<li>chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2207">valyala/fasthttp#2207</a></li>
<li>chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2261">valyala/fasthttp#2261</a></li>
<li>chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2267">valyala/fasthttp#2267</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2289">valyala/fasthttp#2289</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2290">valyala/fasthttp#2290</a></li>
<li>chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2291">valyala/fasthttp#2291</a></li>
<li>chore(deps): bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2297">valyala/fasthttp#2297</a></li>
</ul>
<h2>New Contributors</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/valyala/fasthttp/commit/37a31d78c5d221b24b9cb6652481b5acd4dd674f"><code>37a31d7</code></a>
Avoid default content type for empty requests (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2296">#2296</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/d93cb94af2c31641d00025140785609ddd746eb3"><code>d93cb94</code></a>
validate trailer values in parseTrailer (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2301">#2301</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9d21d3546ab1d8422b0b5b2801e46aef568619ce"><code>9d21d35</code></a>
Remove unused uint322ip, inline ip2uint32</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/eb82c9a13addbe488f69cbf530444bb2561fd083"><code>eb82c9a</code></a>
Reject invalid cookie values during parsing</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/598e2e06218dbcaf4da6b3723477effd9d7b6233"><code>598e2e0</code></a>
fix(server): close listener on serve error in ListenAndServe helpers (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2304">#2304</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/134a8fedab6eb02fda4b8d96c48d2a72082d2e0c"><code>134a8fe</code></a>
preserve duplicate request headers in ConvertRequest (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2305">#2305</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/7bca504536636cf77726f3018365626a8b975b5f"><code>7bca504</code></a>
reject duplicate Transfer-Encoding in request header parser (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2303">#2303</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9ee3c15997f8ab21519c2728017e9fbff03fe142"><code>9ee3c15</code></a>
docs: document FSCompressedFileSuffixes is not safe for concurrent
modificati...</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/2c1590038fa5d0e04896c8b0aafc138ce286bfa7"><code>2c15900</code></a>
feat(prefork): graceful shutdown, leak fixes, hook robustness (re-open
of <a
href="https://redirect.github.com/valyala/fasthttp/issues/21">#21</a>...</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/ec58c6e67ee8f608a673cc01f07f045d04fa17b5"><code>ec58c6e</code></a>
strip semicolons from cookie setters to block attribute injection (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2298">#2298</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/valyala/fasthttp/compare/v1.71.0...v1.72.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.71.0&new-version=1.72.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index fa6c046c80..d48fc0534b 100644
--- a/go.mod
+++ b/go.mod
@@ -229,7 +229,7 @@ require (
 	github.com/tidwall/gjson v1.18.0
 	github.com/u-root/u-root v0.14.0
 	github.com/unrolled/secure v1.17.0
-	github.com/valyala/fasthttp v1.71.0
+	github.com/valyala/fasthttp v1.72.0
 	github.com/wagslane/go-password-validator v0.3.0
 	github.com/zclconf/go-cty-yaml v1.2.0
 	go.nhat.io/otelsql v0.16.0
diff --git a/go.sum b/go.sum
index 489928ef98..bc1e2f90a9 100644
--- a/go.sum
+++ b/go.sum
@@ -1204,8 +1204,8 @@ github.com/urfave/cli/v2 v2.27.5 h1:WoHEJLdsXr6dDWoJgMq/CboDmyY/8HMMH1fTECbih+w=
 github.com/urfave/cli/v2 v2.27.5/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.71.0 h1:tepR7H+Guh9VUqxxcPggYi8R3lGUu2Rsdh+z7/FCY3k=
-github.com/valyala/fasthttp v1.71.0/go.mod h1:z1sDUvOShhXq/C9mwH/fSm1Vb71tUJwmQdgkBrBNwnA=
+github.com/valyala/fasthttp v1.72.0 h1:R7kYdoWhn1ye1fVpP+cDHDJwYm3NkwLliwgzJ/Abg7M=
+github.com/valyala/fasthttp v1.72.0/go.mod h1:zsbLTYqcpIktdQytlVBwIjY9La5d6bs990nBxWg8efk=
 github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=
 github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
 github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=