Bump github.com/gofiber/fiber/v3 from 3.4.0 to 3.5.0

[dependabot]

Bumps github.com/gofiber/fiber/v3 from 3.4.0 to 3.5.0.

Release notes

Sourced from github.com/gofiber/fiber/v3's releases.

v3.5.0

🚀 New

• Harden proxy middleware (#4405) New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })

  https://docs.gofiber.io/middleware/proxy#security
• Add support for custom binding precedence (#4544) New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }

  https://docs.gofiber.io/api/bind#custom-precedence
• Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486) New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

🧹 Updates

• Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
• Quick-reject routes on precomputed slash-count bounds (#4517)
• Restore Route inlining lost in the RFC 9110 changes (#4501)
• Skip the Accept join allocation in the Format emptiness check (#4503)
• Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
• Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
• Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
• Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
• adaptor: Cut allocations on the net/http bridge (#4559)
• cache: Optimize key generation and allocation (#4608)
• cors: Fold preflight Vary calls into one header scan (#4502)
• csrf: Optimize trusted subdomain matching (#4543)
• proxy: Optimize balancer round-robin (#4549)
• session: Use make() to preallocate relevantExtractors (#4562)
• De-flake the clock-sensitive tests (#4575)

🐛 Fixes

• Fix open redirects in composed route URLs and redirect rules (#4584)
• Preserve published route buckets during rebuilds (#4579)

... (truncated)

Commits

• 741d851 chore: bump version to v3.5.0
• 2f5830c Merge pull request #4589 from Rachit-Gandhi/fix/cache-only-if-cached-auth
• baab347 Merge pull request #4607 from gofiber/propose-fix-for-redirect-precedence-bug
• b5f6498 Merge pull request #4608 from gofiber/claude/cache-middleware-perf-w7a7xd
• 3b76214 fix(cache): keep parseVary's cap from reading past what it will reject
• 9e49594 fix(cache): prime the hit benchmarks, and size the Vary name slice
• caa6bc6 docs(cache): cite RFC 9110 for the cacheable status codes
• 2ff82d8 style(cache): drop the unused receiver on keyRecordingStorage.Close
• 5482edc perf(cache): assemble a cache key in one allocation
• c7679c5 Merge branch 'main' into propose-fix-for-redirect-precedence-bug
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)