github.com/gobuffalo/buffalo

Security

• Added automated vulnerability scanning with govulncheck CI job running on every push and PR
• Fixed multiple HIGH severity vulnerabilities in golang.org/x/net by upgrading to v0.45.0:
  • CVE-2023-39325: HTTP/2 rapid reset attack
  • CVE-2022-41721: Request smuggling in h2c
  • CVE-2022-41723: Uncontrolled resource consumption
  • CVE-2025-65637: DoS via large payloads without newlines
• Fixed multiple MEDIUM severity vulnerabilities in golang.org/x/net:
  • CVE-2025-22872: XSS via HTML tokenizer
  • CVE-2025-22870: HTTP Proxy bypass via IPv6 Zone IDs
  • CVE-2022-41717: Excessive memory growth in HTTP/2
  • CVE-2023-45288: HPACK continuation flood
  • CVE-2023-44487: HTTP/2 Stream Cancellation Attack
  • CVE-2023-3978: XSS in HTML parsing
• Added SECURITY.md with vulnerability reporting guidelines

Features

• Support for multiple file uploads — c.File() now supports uploading multiple files in a single form field (#2389)
• Template metadata injection — Templates can now access file metadata (path, base name, extension, modification time) via configurable keys. Added TemplateMetadataKeys and TemplateBaseDir to render options.
• Assert middleware — New testing middleware to assert handler behavior in unit tests (#2339)
• Better error context — Errors now display stack traces in development mode when the original error supports it

Code Modernization

• Modernized Go syntax — Replaced all interface{} with any (Go 1.18+)
• Updated error handling — Replaced deprecated os.IsNotExist with errors.Is(err, os.ErrNotExist) (Go 1.13+)
• Updated error messages to reference map[string]any

Performance Improvements

• Reduced memory allocations — Optimized Render() to avoid unnecessary memory allocations
• Improved DefaultContext performance — Replaced sync.Map with sync.Mutex for better concurrent performance

Refactoring

• Moved error templates to internal/templates/ directory and co-located embed directives in errors.go for better code organization
• Removed 4 direct dependencies by replacing with internal implementations:
  • github.com/dustin/go-humanize → internal formatBytes()
  • github.com/gobuffalo/grift → removed (was unused)
  • github.com/psanford/memfs → testing/fstest.MapFS
  • github.com/gobuffalo/nulls → internal/nulls package

Maintenance & Cleanup

• Updated to Go 1.25 — Minimum Go version raised to 1.25.0; CI tests with Go 1.25 and 1.26
• Removed unused dotfiles — Cleaned up legacy ESLint, CSSLint, Codecov, CodeClimate, and golangci configurations from pre-frontend-tooling era
• Organized go.mod — Separated direct and indirect dependencies for clarity
• Updated all gobuffalo dependencies to latest stable versions

Bug Fixes

• Fixed nulls.Time decoding — Empty values now correctly decode as NULL instead of "0001-01-01" (#2395)
• Fixed DefaultContext data loading — Resolved issue where DefaultContext wasn't properly loading newRequestData
• Improved test isolation — Added ResetContentType() method to Buffalo for better test isolation; fixed test pollution in template helper tests

CI/CD Improvements

• Updated CI workflow to test with Go 1.25 and 1.26
• Added govulncheck vulnerability scanning on all builds
• Updated GitHub Actions to latest versions

Note: This release contains important security fixes. All users are encouraged to upgrade promptly.
Migration: No breaking changes. Update your go.mod:

go get github.com/gobuffalo/buffalo@latest

What's Changed

• updating supported Go versions in the README by @paganotoni in #2404
• feature: Support the upload of multiple files #2389 by @karlhaas in #2405
• Inject file metadata to render by @Mido-sys in #2407

New Contributors

• @karlhaas made their first contribution in #2405

Full Changelog: v1.1.2...v1.1.3

What's Changed

• Avoid memory allocation when calling Render by @Mido-sys in #2400
• Upgrade plush & gobuffalo/helpers by @Mido-sys in #2403

Full Changelog: v1.1.1...v1.1.2

What's Changed

• Upgrade Plush to V5 and improve request data handling by @Mido-sys in #2398
• Task upgrade x net by @paganotoni in #2399

New Contributors

• @Mido-sys made their first contribution in #2398

Full Changelog: v1.1.0...v1.1.1

What's Changed

• removed pop logger setting that is not required to do by buffalo by @sio4 in #2346
• added assert middleware to assert handler's behavior. (fix #2339) by @sio4 in #2345
• made panic event to use the same standard payload type by @sio4 in #2352
• For nulls.Time, decode empty value as NULL by @travisturner in #2359
• enabled stack trace when the original error support it (in dev and event) by @sio4 in #2361
• process: version bump and module update by @sio4 in #2363

New Contributors

• @travisturner made their first contribution in #2359

Full Changelog: v1.0.1...v1.1.0

What's Changed

• safer error handling by @schparky in #2322
• update module dependencies, dependabot configuration, and stale action by @sio4 in #2331
• added detailed comment for render.Download() by @sio4 in #2333
• made request logger the last middleware by @sio4 in #2334
• upgrade module dependencies and version bump by @sio4 in #2336

See also milestone issue for this release: #2332

Full Changelog: v1.0.0...v1.0.1

Congratulations 🎉 Buffalo core v1!

(No code changes since v0.18.9, just a few module dependency updates)

Full Changelog: v0.18.9...v1.0.0

What's Changed

• updated genny version one more time to fix a warning message.

Full Changelog: v0.18.8...v0.18.9

What's Changed

• fix template based i18n support issues by @sio4 in #2259
• Reduce dependencies on external libraries by @fasmat in #2260
• using path rather than filepath for URL-ish internal expressions by @sio4 in #2262
• fixed racing condition of the simple worker by @sio4 in #2266
• replace the package refresh with the forked gobuffalo version by @sio4 in #2271
• replaced grift with gobuffalo mirror and dependency update by @sio4 in #2293

Full Changelog: v0.18.7...v0.18.8

What's Changed

• Bump github.com/gobuffalo/plush/v4 from 4.1.9 to 4.1.10 by @dependabot in #2228
• Fixed multi-homing feature and related bugs. (#2222) by @sio4 in #2226
• Bump github.com/gobuffalo/flect from 0.2.4 to 0.2.5 by @dependabot in #2229
• Bump github.com/BurntSushi/toml from 1.0.0 to 1.1.0 by @dependabot in #2230
• Bump actions/setup-go from 2 to 3 by @dependabot in #2237
• Bump actions/stale from 4 to 5 by @dependabot in #2236
• HTTPError Error() avoid nil pointer dereference on nil Cause by @saurori in #2238
• Bump github.com/gobuffalo/pop/v6 from 6.0.1 to 6.0.2 by @dependabot in #2244
• hardening DefaultContext to make it panic-free by @sio4 in #2246
• added input/status checks, testcases, and comments for road-to-v1 by @sio4 in #2243
• Remove ioutil package by @fasmat in #2252
• Fix logging of where application is bound by @hut8 in #2249
• v0.18.7 by @paganotoni in #2255

Full Changelog: v0.18.6...v0.18.7