Build(deps): Bump github.com/gofiber/fiber/v3 from 3.5.0 to 3.6.0

[dependabot]

Bumps github.com/gofiber/fiber/v3 from 3.5.0 to 3.6.0.

Release notes

Sourced from github.com/gofiber/fiber/v3's releases.

v3.6.0

⚡ Performance

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

Time per request vs. v2	v3.5.0 (fasthttp v1.73.0)	v3.6.0 (fasthttp v1.75.0)
fasthttp only	+18%	-5%
Static route	+16%	-14%
Route parameter	+15%	-13%
Middleware chain	+13%	-12%
Header lookup	+29%	+3%
Locals	+33%	+5%
JSON response	+6%	-3%
JSON bind	+14%	-2%
Median of all 22 scenarios	+10%	-5%

Negative is faster than v2. v3.6.0 was measured on main three days before the release. All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again. https://gofiber.github.io/benchmarks/

🚀 New

• Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596) New tokenless middleware that rejects unsafe cross-origin browser requests by their Sec-Fetch-Site and Origin headers; no cookie, token or storage needed.

  app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
      TrustedOrigins: []string{"https://admin.example.com"},
  }))

  https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
• Update fasthttp to v1.75.0 (#4667, #4740) fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing. https://github.com/valyala/fasthttp/releases/tag/v1.75.0
• Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715) ReadBufferSize and WriteBufferSize now default to 8192 bytes (was 4096), which also raises the default request header limit; explicitly configured values are kept.

  app := fiber.New(fiber.Config{
      ReadBufferSize:  4096, // previous default, now 8192
      WriteBufferSize: 4096, // previous default, now 8192
  })

  https://docs.gofiber.io/api/fiber#readbuffersize
• Expand context, response and request helpers (#4638) New helpers on Req, Res and Ctx such as Bearer, Origin, IsSafe, Del, StatusCode, GetCookies, Elapsed and RouteName; request helpers are now also reachable through c.Req().

  token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
  c.Del("X-Powered-By") // remove a response header
  took := c.Elapsed()   // time spent on this request so far

... (truncated)

Commits

• 9438d7e chore: bump version to v3.6.0
• cec4e4d Merge pull request #4590 from Rachit-Gandhi/fix/cache-uncacheable-revalidation
• 33abc3a Merge pull request #4596 from RubenPari/fix/3912-cross-origin-csrf
• 87a0b36 🐛 bug: keep cached entries when a non-cacheable status answers a revalidation
• 0be0655 test(csrf): pin the raw Host comparison, document same-site denial
• d67627e 📒 docs: explain cache cleanup failure consequences
• b85b584 docs(csrf): scope the security model to csrf.New
• 99b9b1e feat(csrf): replace CrossOriginProtectionOnly with NewCrossOriginProtection
• 9845caa Merge branch 'main' into fix/3912-cross-origin-csrf
• af21c74 🐛 bug: finish revalidation manifest cleanup and retry orphan bodies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)