LoginSign Up
← Back to all sparks
F

Fiber

DEVOPS
Velocity2.5

Express inspired web framework written in Go

gofiber.io ↗

Fiber v3 has sat in release candidate for months while v2 gets one-line patches

goweb-frameworknet-http-compatrelease-candidatebackports
◆Current state
The feed carries two lines that barely touch. Fiber v2 receives narrow maintenance releases — a lock cleanup, an X-Real-IP backport, an HTML escaping fix, a CVE patch — most containing a single merged PR. The v3 line, last visible here at rc.3, is where the actual work is: native net/http and fasthttp handler support, Express-style request and response handlers, HostClient and LBClient in the client package.
◆Where it's heading
v3 is the answer to Fiber's longest-standing objection, that building on fasthttp cuts a project off from the net/http middleware ecosystem. Making both handler styles native reframes Fiber as compatible rather than separate. But rc.3 dates to late 2025 and nothing newer has landed in this feed, while v2 patches keep arriving through August — a long release candidate stretch that leaves users choosing between a stable branch in pure maintenance and a v3 that has not been declared final.
◆Prediction
The next meaningful entry is either a v3.0.0 final or a further RC; until one lands, expect the v2 line to continue receiving single-PR backports and security patches.

◆Recent moves

  1. 6d ago

    Idempotency middleware releases MemoryLock keys on unlock

    A single bugfix releasing MemoryLock keys on unlock in the idempotency middleware. The kind of one-PR patch that now characterizes the v2 branch.

    View source ↗
  2. 1mo ago

    X-Real-IP overwrite fix backported to v2

    A BalancerForward X-Real-IP overwrite fix backported from the v3 line, plus a first-time contributor. Maintenance work flowing backward from where development actually happens.

    View source ↗
  3. 3mo ago

    Ctx.Format now escapes HTML output

    HTML output in Ctx.Format is now escaped, closing an injection path for anything rendering user-controlled content through it. A behavior change worth knowing about despite the one-line release note.

    View source ↗
  4. 5mo ago

    Security patch for GHSA-mrq8-rjmw-wpq3

    A CVE fix shipped with no detail beyond the advisory identifier. Thin as a release note, but a patch worth taking for anyone running the v2 branch in production.

    View source ↗
  5. 6mo ago

    Mount improvements and limiter middleware fixes

    Improved mount functionality, defensive copying backports, and limiter middleware fixes — the most substantive v2 release in this window, and still entirely backported hardening rather than new capability.

    View source ↗
  6. 9mo ago

    v3 RC adds native net/http and Express-style handlers

    ⚡ SPARK

    The v3 release candidate adds native support for net/http and fasthttp handlers, Express-style request and response handlers, and HostClient and LBClient support. It is the release that defines the v3 line, and every v2 entry since has been a backport from it.

    View source ↗