Merge d4e96937657f2fc156d0233e8d8c30668e15e3d4 into 3e44fdc4d1636a2b1599c6688a76e13216a413dd

Bumps the actions group with 1 update: [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action).


Updates `aquasecurity/trivy-action` from 0.34.1 to 0.34.2
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.34.1...0.34.2)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/trivy-scan.yml

@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Trivy vulnerability scanner (source code)
-        uses: aquasecurity/trivy-action@0.34.1
+        uses: aquasecurity/trivy-action@0.34.2
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -44,7 +44,7 @@ jobs:
           sarif_file: "trivy-results.sarif"
 
       - name: Run Trivy scanner (table output for logs)
-        uses: aquasecurity/trivy-action@0.34.1
+        uses: aquasecurity/trivy-action@0.34.2
         if: always()
         with:
           scan-type: "fs"

binding/form_test.go

@@ -0,0 +1,64 @@
+// Copyright 2025 Gin Core Team. All rights reserved.
+// Use of this source code is governed by a MIT style
+// license that can be found in the LICENSE file.
+
+package binding
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFormBindings_Names(t *testing.T) {
+	assert.Equal(t, "form", Form.Name())
+	assert.Equal(t, "form-urlencoded", FormPost.Name())
+	assert.Equal(t, "multipart/form-data", FormMultipart.Name())
+}
+
+func TestFormBinding_BasicPost(t *testing.T) {
+	b := Form
+	obj := FooBarStruct{}
+	req := requestWithBody(http.MethodPost, "/", "foo=bar&bar=foo")
+	req.Header.Add("Content-Type", MIMEPOSTForm)
+	err := b.Bind(req, &obj)
+	require.NoError(t, err)
+	assert.Equal(t, "bar", obj.Foo)
+	assert.Equal(t, "foo", obj.Bar)
+}
+
+func TestFormPostBinding_Basic(t *testing.T) {
+	b := FormPost
+	obj := FooBarStruct{}
+	req := requestWithBody(http.MethodPost, "/", "foo=bar&bar=foo")
+	req.Header.Add("Content-Type", MIMEPOSTForm)
+	err := b.Bind(req, &obj)
+	require.NoError(t, err)
+	assert.Equal(t, "bar", obj.Foo)
+	assert.Equal(t, "foo", obj.Bar)
+}
+
+func TestFormMultipartBinding_BasicMultipart(t *testing.T) {
+	// reuse helper that exists in binding_test.go
+	req := createFormMultipartRequest(t)
+	var obj FooBarStruct
+	err := FormMultipart.Bind(req, &obj)
+	require.NoError(t, err)
+	assert.Equal(t, "bar", obj.Foo)
+	assert.Equal(t, "foo", obj.Bar)
+}
+
+// ensure that a non-multipart POST with form content still binds with Form (ParseMultipartForm should be ignored)
+func TestFormBinding_NonMultipartPostIgnoresMultipartError(t *testing.T) {
+	b := Form
+	obj := FooBarStruct{}
+	req := requestWithBody(http.MethodPost, "/", "foo=bar&bar=foo")
+	// Intentionally do not set multipart content-type so ParseMultipartForm returns ErrNotMultipart and is ignored
+	req.Header.Add("Content-Type", MIMEPOSTForm)
+	err := b.Bind(req, &obj)
+	require.NoError(t, err)
+	assert.Equal(t, "bar", obj.Foo)
+	assert.Equal(t, "foo", obj.Bar)
+}