Ovumcy

Security

• Web framework upgraded to Fiber v3. gofiber/fiber moves from v2.52.13 to v3.4.0, removing GHSA-gcfq-8gqf-4876 / CVE-2026-45045 (X-Real-IP spoofing in fiber’s proxy middleware) from the dependency graph entirely — the vulnerable module was never compiled into Ovumcy, and govulncheck now reports no known vulnerabilities. Routes, JSON shapes, cookie attributes, security headers, and rate limiting are preserved; the CSRF token lifetime is pinned explicitly to the previous 1-hour value (Fiber v3’s new default would otherwise shorten it to 30 minutes).
• Upgrade note (HTTPS reverse proxies): Fiber v3’s CSRF layer validates the browser Origin against the app-observed scheme/host on every mutating request. The documented deployment posture already satisfies this — the bundled Caddy/nginx examples send X-Forwarded-Proto and set TRUST_PROXY_ENABLED=true. An HTTPS-terminating proxy in front of an instance still running TRUST_PROXY_ENABLED=false (previously only a rate-limit-keying warning) will now see browser form submissions rejected with 403 until trust is enabled.