[jkyberneees]

Summary

Dependency upgrades plus the fixes from a four-expert review panel (security, concurrency, HTTP semantics, SRE). The full plan and its status are in docs/HARDENING_PLAN_2026-10.md. Each bug fix started with a regression test that failed by assertion.

Dependencies

• fasthttp 1.70.0 → 1.77.0, klauspost/compress 1.18.5 → 1.20.3. Brotli now comes from the pure-Go go-brrr library; builds with CGO disabled and on Windows were checked. govulncheck reports nothing.

Security and data integrity

• Multi-range amplification: a request with about 1300 0- ranges used to build a 133 MB response for a 100 KB file. Ranges are now capped at 16, a request whose ranges add up to more than the file is ignored (200), and an unsatisfiable range returns 416 with Content-Range: bytes */N.
• A symlinked index.html could expose files outside the root, or dotfiles. Index paths now go through PathSafe.
• PathCache cached results for paths that did not exist yet, so a later symlink could escape the root. Only paths that were verified to exist are cached now.
• 206 responses were gzipped on the fly. Compression now applies to 200 responses only, never to streamed bodies.
• Large files are streamed from disk and get ETag, Cache-Control and 304 support. HEAD no longer reads the body. Sidecar files larger than their source are ignored.
• A listen failure or a bad TLS cert now exits with code 1. Before, the process kept running and served nothing, or panicked.

HTTP correctness

• Vary tokens are merged into one header, so Vary: Origin is no longer dropped.
• 304 responses carry Cache-Control, ETag and Vary.
• HEAD reports the same Content-Length as GET when content is compressed.
• If-Range is supported, and ETags are compared weakly.
• OPTIONS returns 204 with Allow, and 405 responses include Allow.
• Accept-Encoding names are matched case-insensitively and q-values are parsed as numbers.
• Embedded default assets now return 304 when appropriate.

Robustness and operations

• Preload stats the symlink target instead of the link. Expired cache entries are removed only if they are still the same entry, which closes a race.
• New Config.Validate(). Invalid env values cause an error instead of being ignored, and an explicit --config path must exist.
• SIGHUP reload keeps the CLI flags and the positional root.
• IPv6 and hostname listeners work. tcp4 is still used for IPv4, to keep the documented throughput.
• Added STATIC_SECURITY_HSTS_MAX_AGE, STATIC_SECURITY_DIRECTORY_LISTING and STATIC_SECURITY_HSTS_INCLUDE_SUBDOMAINS.
• CI pins govulncheck and staticcheck, and adds gofmt, go mod tidy -diff and a config-example diff check. Added Dependabot. Release permissions are now scoped to the release job.

Behaviour changes

• Invalid env or config values, and a missing explicit --config, now stop startup.
• Unsatisfiable ranges return 416. A plain OPTIONS request returns 204.

Test plan

• gofmt, go vet, go test -race ./..., staticcheck v0.8.2, go mod tidy -diff
• Smoke test of the built binary:
  • range flood returns 200 at file size
  • 416 for an unsatisfiable range
  • a 206 has no Content-Encoding
  • 304 for a matching ETag
  • OPTIONS returns 204 with Allow
  • 405 includes Allow
  • a single Vary header
  • busy port and missing --config both exit 1
• CI green

🤖 Generated with Claude Code