feat(go): update github.com/go-chi/chi/v5 (v5.2.5 → v5.3.1)

[lrstanley-x]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-chi/chi/v5	v5.2.5 → v5.3.1

---

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.1

Compare Source

What's Changed

• Honor Discard() in httpFancyWriter.ReadFrom by @​DucMinhNe in #​1110
• Tidy build directives by @​JRaspass in #​1113
• feat(middleware): add text/xml and application/xml to default compressible types by @​VojtechVitek in #​1127
• Fix defaultLogEntry.Panic not respecting NoColor setting by @​doganarif in #​1050
• middleware: document printPrettyStack and harden NoColor panic test by @​VojtechVitek in #​1131
• feat(mux): support http QUERY method ietf rfc10008 by @​VojtechVitek in #​1132
• ci: pin GitHub Actions to full commit SHAs by @​XananasX7 in #​1116

New Contributors

• @​DucMinhNe made their first contribution in #​1110
• @​doganarif made their first contribution in #​1050
• @​XananasX7 made their first contribution in #​1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed

• Use strings.ReplaceAll where applicable by @​JRaspass in #​1046
• Propagate inline middlewares across mounted subrouters by @​LukasJenicek in #​1049
• add go 1.26 to ci by @​pkieltyka in #​1052
• Remove last uses of io/ioutil by @​JRaspass in #​1054
• Simplify chi.walk with slices.Concat by @​JRaspass in #​1053
• Apply the stringscutprefix modernizer by @​JRaspass in #​1051
• Bump minimum Go to 1.23, always use request.Pattern by @​JRaspass in #​1048
• middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @​alliasgher in #​1085
• Fix typo in Route doc comment by @​gouwazi in #​1073
• fix: set Request.Pattern from RoutePattern() by @​leno23 in #​1097
• feat: middleware.ClientIP, a replacement for middleware.RealIP by @​VojtechVitek in #​967

New Contributors

• @​LukasJenicek made their first contribution in #​1049
• @​alliasgher made their first contribution in #​1085
• @​gouwazi made their first contribution in #​1073
• @​leno23 made their first contribution in #​1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #​967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

• GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)
• GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)
• GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

• #​708
• https://adam-p.ca/blog/2022/03/x-forwarded-for/
• #​711
• #​453
• #​908

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

---

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

---

Configuration

📅 Schedule: (in timezone America/Denver)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

PR generated using automation.

[lrstanley-x]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: _examples/go.sum

Command failed: go get -t ./...
go: downloading github.com/lrstanley/entrest v1.0.2
go: downloading entgo.io/ent v0.14.6
go: downloading github.com/ogen-go/ogen v1.20.2
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/brianvoe/gofakeit/v7 v7.14.1
go: downloading github.com/go-chi/chi/v5 v5.3.1
go: downloading modernc.org/sqlite v1.48.0
go: downloading github.com/stretchr/testify v1.11.1
go: downloading github.com/google/go-github/v81 v81.0.0
go: downloading github.com/go-playground/form/v4 v4.3.0
go: downloading github.com/go-openapi/inflect v0.21.5
go: downloading github.com/stoewer/go-strcase v1.3.1
go: downloading ariga.io/atlas v1.1.0
go: downloading golang.org/x/sync v0.20.0
go: downloading golang.org/x/tools v0.43.0
go: downloading github.com/davecgh/go-spew v1.1.1
go: downloading github.com/pmezard/go-difflib v1.0.0
go: downloading github.com/google/go-querystring v1.2.0
go: downloading github.com/go-faster/errors v0.7.1
go: downloading github.com/go-faster/jx v1.2.0
go: downloading github.com/go-faster/yaml v0.4.6
go: downloading github.com/ghodss/yaml v1.0.0
go: downloading go.uber.org/zap v1.27.1
go: downloading github.com/hashicorp/hcl/v2 v2.24.0
go: downloading github.com/zclconf/go-cty v1.18.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/fatih/color v1.19.0
go: downloading go.uber.org/multierr v1.11.0
go: downloading golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
go: downloading github.com/segmentio/asm v1.2.1
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/dlclark/regexp2 v1.11.5
go: downloading golang.org/x/text v0.35.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/bmatcuk/doublestar v1.3.4
go: downloading github.com/zclconf/go-cty-yaml v1.2.0
go: downloading golang.org/x/mod v0.34.0
go: downloading github.com/mattn/go-colorable v0.1.14
go: downloading github.com/mattn/go-isatty v0.0.20
go: downloading golang.org/x/sys v0.42.0
go: downloading github.com/agext/levenshtein v1.2.3
go: downloading github.com/apparentlymart/go-textseg/v15 v15.0.0
go: downloading github.com/mitchellh/go-wordwrap v1.0.1
go: downloading github.com/google/go-cmp v0.7.0
go: downloading modernc.org/libc v1.70.0
go: downloading github.com/dustin/go-humanize v1.0.1
go: downloading modernc.org/mathutil v1.7.1
go: downloading modernc.org/memory v1.11.0
go: downloading github.com/ncruces/go-strftime v1.0.0
go: downloading github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
go: downloading github.com/lrstanley/entrest v1.0.3
go: github.com/lrstanley/entrest/_examples/simple imports
	github.com/lrstanley/entrest/_examples/simple/internal/database/ent: cannot find module providing package github.com/lrstanley/entrest/_examples/simple/internal/database/ent
go: github.com/lrstanley/entrest/_examples/simple imports
	github.com/lrstanley/entrest/_examples/simple/internal/database/ent/rest: cannot find module providing package github.com/lrstanley/entrest/_examples/simple/internal/database/ent/rest
go: github.com/lrstanley/entrest/_examples/simple imports
	github.com/lrstanley/entrest/_examples/simple/internal/database/ent/runtime: cannot find module providing package github.com/lrstanley/entrest/_examples/simple/internal/database/ent/runtime

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.23%. Comparing base (14b4ba1) to head (77afd21).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #156   +/-   ##
=======================================
  Coverage   69.23%   69.23%           
=======================================
  Files          10       10           
  Lines        2022     2022           
=======================================
  Hits         1400     1400           
  Misses        508      508           
  Partials      114      114           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.