LoginSign Up
← Back to all sparks
F

Fiber

DEVOPS
Velocity2.5

Express inspired web framework written in Go

gofiber.io ↗

Fiber v3 has sat in release candidate for months while v2 gets security fixes only

stalled-majorsecurity-backportsnethttp-interoprelease-candidatemaintenance-only
◆Current state
Fiber's v2 line is receiving nothing but small security and correctness work — an HTML escaping fix in Ctx.Format, a CVE fix, defensive copying backports, limiter middleware repairs, and a backported X-Real-IP overwrite fix in the load balancer. Meanwhile v3.0.0-rc.3, the last release candidate visible here, carries all the actual feature work: native net/http and fasthttp handler support, Express-style request and response handlers, HostClient and LBClient, and HTTP 501 handling for unsupported methods.
◆Where it's heading
The split is unusually stark. Every capability that would change how Fiber is used sits behind a v3 candidate that has not moved forward in this window, while v2 — what almost everyone actually runs — gets only fixes. The v3 feature list points at a clear thesis, making Fiber interoperable with the standard library rather than an island, but that thesis is not yet available to users on a stable release.
◆Prediction
The entries do not show a v3 release approaching; on the visible evidence, expect v2 to keep receiving security backports and the net/http interop work to remain candidate-only until the release cadence resumes.

◆Recent moves

  1. 28d ago

    Load balancer X-Real-IP overwrite fix backported to v2

    A single backported fix stopping BalancerForward from overwriting X-Real-IP. One commit, from a first-time contributor, which is the shape most v2 releases now take.

    View source ↗
  2. 3mo ago

    HTML output escaped in Ctx.Format

    Escaping HTML output in Ctx.Format closes an injection path in a method applications call routinely. A one-line release in volume, but a security-relevant default change rather than a cosmetic fix.

    View source ↗
  3. 5mo ago

    CVE fix for GHSA-mrq8-rjmw-wpq3

    A release existing solely to carry a CVE fix, published two months after the previous v2 patch. It reinforces that the v2 line's release trigger is now security rather than feature work.

    View source ↗
  4. 6mo ago

    Defensive copying backports and limiter middleware fixes

    The broadest v2 release in this window, backporting defensive copying fixes from the v3 branch alongside limiter middleware repairs and mount improvements. Backporting from v3 is how v2 gets most of what it gets now.

    View source ↗
  5. 8mo ago

    v3 candidate adds native net/http support and Express-style handlers

    ⚡ SPARK

    The only entry carrying real feature work, and it defines what v3 is for: interoperability with the wider Go HTTP ecosystem. Everything in the v2 releases since has been fixes, several of them backported from this branch.

    View source ↗