[dependabot]

Bumps github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2.

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

• feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
• docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
• fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
• Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
• fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
  • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

Commits

• 3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
• 9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
• 29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
• bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
• 60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

📋 API Contract Changes Summary

✅ No breaking changes detected - only additions and non-breaking modifications

Changed Components:

Core Framework

Contract diff saved to artifacts/diffs/core.json

Module: auth

Contract diff saved to artifacts/diffs/auth.json

Module: cache

Contract diff saved to artifacts/diffs/cache.json

Module: database

Contract diff saved to artifacts/diffs/database.json

Module: eventbus

Contract diff saved to artifacts/diffs/eventbus.json

Module: jsonschema

Contract diff saved to artifacts/diffs/jsonschema.json

Module: letsencrypt

Contract diff saved to artifacts/diffs/letsencrypt.json

Module: reverseproxy

Contract diff saved to artifacts/diffs/reverseproxy.json

Artifacts

📁 Full contract diffs and JSON artifacts are available in the workflow artifacts.

[intel352]

Reviewed the dependency-only source update at exact commit 381561f. Independent security and quality source review checked official action/module provenance and hashes, manifest/lock consistency, toolchain/API compatibility, unintended source or permission changes, and the full adversarial bug checklist; no blocking source findings. The dependency change is meaningful and currently integrates without conflict. This source approval does not replace missing required CodeQL configurations, Code Quality analyses, or current-base integration CI; all applicable checks and review rules must be satisfied before normal merge. No bypass or auto-merge is requested.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[intel352]

Renewed security and quality approval for bf9e3e6. Empty refresh preserves the reviewed dependency-only tree. The meaningful change is chi/v5 v5.3.1 to v5.3.2 and its matching checksums; official module metadata was verified and the project toolchain satisfies upstream requirements. No routing/authentication source, permissions, tests or scanner gates changed. Current-main integration is clean. All 43 fresh exact-head checks passed, including consumer tests and genuine Go/Actions CodeQL analyses. No material findings.