[dependabot]

Bumps the go-minor-and-patch group with 3 updates in the /apps/file-gateway-api directory: github.com/aws/aws-sdk-go-v2, github.com/aws/aws-sdk-go-v2/credentials and github.com/aws/aws-sdk-go-v2/service/s3.
Bumps the go-minor-and-patch group with 2 updates in the /apps/platform-api directory: github.com/gofiber/contrib/v3/websocket and github.com/valyala/fasthttp.

Updates github.com/aws/aws-sdk-go-v2 from 1.47.4 to 1.47.5

Commits

• c350990 Release 2026-10-27
• 4d2d256 Regenerated Clients
• d2bd6cc Update API model
• da4b3cc update to smithy-go v1.28.7 (#3608)
• c86b81b schema-serde: release final restjson services (#3605)
• 7393955 Fix login cred update token panic (#3558)
• 9626aa3 fix nil in stscreds (#3604)
• 0d657c0 Release 2026-10-26
• 77b7742 Regenerated Clients
• 54f1f5e Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.10 to 1.20.13

Commits

• 407b01f Release 2026-10-30
• e122e2b Regenerated Clients
• 1ebc631 Update endpoints model
• 4163a6f Update API model
• 3d19df3 Fix malformed JSON when serializing nil lists or maps in union members, map v...
• 0074b63 Release 2026-10-29
• 4fd860a Regenerated Clients
• b88cbda Update API model
• 47ec4b4 Release 2026-10-28
• 10aadc8 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.5 to 1.114.6

Commits

• c350990 Release 2026-10-27
• 4d2d256 Regenerated Clients
• d2bd6cc Update API model
• da4b3cc update to smithy-go v1.28.7 (#3608)
• c86b81b schema-serde: release final restjson services (#3605)
• 7393955 Fix login cred update token panic (#3558)
• 9626aa3 fix nil in stscreds (#3604)
• 0d657c0 Release 2026-10-26
• 77b7742 Regenerated Clients
• 54f1f5e Update endpoints model
• Additional commits viewable in compare view

Updates github.com/gofiber/contrib/v3/websocket from 1.2.9 to 1.2.10

Commits

• 75c28a2 docs(readme): sync GitHub Sponsors
• 4b091fc Merge pull request #2600 from gofiber/dependabot/go_modules/v3/prometheus/git...
• 7b00f4b Merge pull request #2599 from gofiber/dependabot/go_modules/v3/i18n/github.co...
• d11e17c build(deps): bump github.com/prometheus/common in /v3/prometheus
• b154e7b build(deps): bump github.com/nicksnyder/go-i18n/v2 in /v3/i18n
• 0ceaa15 Merge pull request #2595 from gofiber/dependabot/go_modules/v3/newrelic/googl...
• 206a9f6 Merge pull request #2598 from gofiber/dependabot/go_modules/v3/uptime/github....
• 8ebc16e Merge pull request #2593 from gofiber/dependabot/go_modules/v3/sentry/fiber-s...
• 552c270 Merge pull request #2597 from gofiber/dependabot/go_modules/v3/testcontainers...
• acea120 Merge pull request #2596 from gofiber/dependabot/go_modules/v3/sentry/golang-...
• Additional commits viewable in compare view

Updates github.com/valyala/fasthttp from 1.76.0 to 1.77.0

Release notes

Sourced from github.com/valyala/fasthttp's releases.

v1.77.0

v1.77.0 strengthens static-file confinement, fixes hijacked connection handling, and improves HTTP and cookie compatibility. It also adds an opt-in bounded stream reader, configurable body-buffer retention, and deadline support for adapted net/http handlers.

Static-file symlink behavior changes by default. The default OS-backed FS now rejects symlinks that leave Root or CompressRoot, as well as absolute symlinks even when their targets are inside the root. Relative symlinks that stay inside the root continue to work. Set FS.AllowSymlinksOutsideRoot to restore the previous behavior when external symlinks are intentional. Custom FS.FS implementations are unaffected. #2490

Security fixes and hardening

• Default static-file operations stay within their configured roots. File reads and compressed-cache operations use os.Root to prevent symlink traversal outside Root and CompressRoot. Each root is confined independently; empty roots with AllowEmptyRoot and whole-volume roots retain their existing behavior. #2490
• Custom filesystems no longer trigger unrelated disk deletions. A stale compressed file in a custom FS.FS previously caused an os.Remove call using its filesystem-relative name, potentially deleting a matching file in the process working directory. Custom filesystems now regenerate stale compressed content in memory without removing a disk file. #2489
• Kept hijacked connections no longer depend on a recycled request context. With both KeepHijackedConns and ReduceMemoryUsage enabled, the hijacked reader is detached from the context before the hijack handler runs. This prevents later reads from panicking or accessing another client's connection after context reuse. #2495

Features and resource management

• An opt-in stream reader bounds copied payload buffering. NewBoundedStreamReader works with SetBodyStream and applies backpressure when consumers fall behind. Active copied payload is limited to 160 KiB per bridge, or 320 KiB across the two bridges used by its bounded compression path. These limits exclude caller buffers, codecs, sockets, and other overhead; wrapping the reader loses the combined compression bound. Existing NewStreamReader and SetBodyStreamWriter behavior is unchanged. #2488
• Request and response body buffers can be retained explicitly. The exported Request.KeepBodyBuffer and Response.KeepBodyBuffer fields preserve body buffers across resets for reuse. Releasing a request or response to the pool clears the retention setting. #2451
• Adapted handlers can configure connection deadlines. RequestCtx.SetReadDeadline and SetWriteDeadline are also exposed through fasthttpadaptor, enabling http.ResponseController deadline calls. The adaptor still buffers the request body before invoking the handler, so a read deadline set inside an adapted handler cannot govern the preceding upload. #2452

HTTP compatibility and connection handling

• Weighted compression codings are recognized. Accept-Encoding entries such as gzip;q=0.8 now match, while q=0 makes a coding unacceptable. Matching remains case-insensitive and requires a complete coding token; quality-based preference ordering and wildcard matching are not added. #2491
• HTTP/1.0 clients no longer receive unsupported informational responses. Expect: 100-continue is ignored for HTTP/1.0 requests, and 103 Early Hints is not sent to HTTP/1.0 clients. #2492, #2496
• Hijacking works with server keep-alive limits. DisableKeepalive and reaching MaxRequestsPerConn no longer suppress a registered hijack handler or add an unwanted Connection: close to an upgrade response. Explicit connection-close requests and other existing close conditions still apply. #2494
• Pipe connection deadlines interrupt pending operations. Updating deadlines on fasthttputil.PipeConns now affects blocked reads and writes, and write-deadline updates no longer race with writes. #2471
• Cookie parsing tolerates invalid attributes and handles names consistently. Invalid Max-Age attributes are ignored, Secure, HttpOnly, and Partitioned are recognized even with a value, and surrounding tabs are trimmed. Set-Cookie values without = are stored under the same empty key returned by Cookie.ParseBytes, keeping lookup and deletion consistent. #2497, #2498, #2500, #2501

Proxy authentication now uses decoded credentials in Proxy-Authorization, and static-file 416 Range Not Satisfiable responses include Content-Range. #2499, #2502

What's Changed

Security and hardening

• fix(fs): resolve default FS paths with os.Root so they stay inside Root by @​Thanatos9404 in valyala/fasthttp#2490
• fix(fs): don't remove stale compressed files of a custom FS.FS from disk by @​Thanatos9404 in valyala/fasthttp#2489
• fix: detach kept hijacked connections from the request context's reader by @​h2zi in valyala/fasthttp#2495

Features

• Add an opt-in bounded stream reader by @​CSXizhang in valyala/fasthttp#2488
• Export KeepBodyBuffer on Request and Response by @​AdamMagued in valyala/fasthttp#2451
• fasthttpadaptor: add support for ResponseController SetReadDeadline and SetWriteDeadline by @​AdamMagued in valyala/fasthttp#2452

Fixes

• fix: accept Accept-Encoding codings that carry a quality value by @​ybai08 in valyala/fasthttp#2491
• fix: ignore Expect: 100-continue in HTTP/1.0 requests by @​LuisFigueroaG in valyala/fasthttp#2492
• fix: don't send 103 Early Hints to HTTP/1.0 clients by @​LuisFigueroaG in valyala/fasthttp#2496
• fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn by @​h2zi in valyala/fasthttp#2494
• make PipeConns deadlines interrupt pending reads and writes by @​h2zi in valyala/fasthttp#2471
• fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse by @​nk-batman21 in valyala/fasthttp#2497
• fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization by @​nk-batman21 in valyala/fasthttp#2499

... (truncated)

Commits

• 61bdcc3 fix(fs): send Content-Range with 416 responses (#2502)
• 020e4ed fix(cookie): store Set-Cookie without '=' under the key ParseBytes gives it (...
• 33b5261 fix(cookie): trim tabs around cookie names, values and attributes (#2500)
• 7e7f8ec fix(cookie): recognize Secure, HttpOnly and Partitioned with a value (#2498)
• 720d20e fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization (#2...
• 91b4512 fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse ...
• e0f6199 Export KeepBodyBuffer on Request and Response (#2451)
• d9bf5c5 fix: detach kept hijacked connections from the request context's reader (#2495)
• ad21d1b make PipeConns deadlines interrupt pending reads and writes (#2471)
• 09cba73 fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn (#2494)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions