unurled/cnampagnon-go
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 9 Packages 1 Wiki Activity Actions

Update module github.com/go-chi/chi/v5 to v5.3.0 #17

Open
renovate-bot wants to merge 1 commit from renovate/github.com-go-chi-chi-v5-5.x into main
pull from: renovate/github.com-go-chi-chi-v5-5.x
merge into: unurled:main
Conversation 1 Commits 1 Files changed 1 +1 -1
renovate-bot commented 2026-06-02 14:03:57 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change
github.com/go-chi/chi/v5 require minor v5.2.5 → v5.3.0

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #​967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | require | minor | `v5.2.5` → `v5.3.0` | --- ### Release Notes <details> <summary>go-chi/chi (github.com/go-chi/chi/v5)</summary> ### [`v5.3.0`](https://github.com/go-chi/chi/releases/tag/v5.3.0) [Compare Source](https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0) #### What's Changed - Use strings.ReplaceAll where applicable by [@&#8203;JRaspass](https://github.com/JRaspass) in [#&#8203;1046](https://github.com/go-chi/chi/pull/1046) - Propagate inline middlewares across mounted subrouters by [@&#8203;LukasJenicek](https://github.com/LukasJenicek) in [#&#8203;1049](https://github.com/go-chi/chi/pull/1049) - add go 1.26 to ci by [@&#8203;pkieltyka](https://github.com/pkieltyka) in [#&#8203;1052](https://github.com/go-chi/chi/pull/1052) - Remove last uses of io/ioutil by [@&#8203;JRaspass](https://github.com/JRaspass) in [#&#8203;1054](https://github.com/go-chi/chi/pull/1054) - Simplify chi.walk with slices.Concat by [@&#8203;JRaspass](https://github.com/JRaspass) in [#&#8203;1053](https://github.com/go-chi/chi/pull/1053) - Apply the stringscutprefix modernizer by [@&#8203;JRaspass](https://github.com/JRaspass) in [#&#8203;1051](https://github.com/go-chi/chi/pull/1051) - Bump minimum Go to 1.23, always use request.Pattern by [@&#8203;JRaspass](https://github.com/JRaspass) in [#&#8203;1048](https://github.com/go-chi/chi/pull/1048) - middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by [@&#8203;alliasgher](https://github.com/alliasgher) in [#&#8203;1085](https://github.com/go-chi/chi/pull/1085) - Fix typo in Route doc comment by [@&#8203;gouwazi](https://github.com/gouwazi) in [#&#8203;1073](https://github.com/go-chi/chi/pull/1073) - fix: set Request.Pattern from RoutePattern() by [@&#8203;leno23](https://github.com/leno23) in [#&#8203;1097](https://github.com/go-chi/chi/pull/1097) - feat: middleware.ClientIP, a replacement for middleware.RealIP by [@&#8203;VojtechVitek](https://github.com/VojtechVitek) in [#&#8203;967](https://github.com/go-chi/chi/pull/967) #### New Contributors - [@&#8203;LukasJenicek](https://github.com/LukasJenicek) made their first contribution in [#&#8203;1049](https://github.com/go-chi/chi/pull/1049) - [@&#8203;alliasgher](https://github.com/alliasgher) made their first contribution in [#&#8203;1085](https://github.com/go-chi/chi/pull/1085) - [@&#8203;gouwazi](https://github.com/gouwazi) made their first contribution in [#&#8203;1073](https://github.com/go-chi/chi/pull/1073) - [@&#8203;leno23](https://github.com/leno23) made their first contribution in [#&#8203;1097](https://github.com/go-chi/chi/pull/1097) #### SECURITY: middleware.ClientIP, a replacement for middleware.RealIP [@&#8203;VojtechVitek](https://github.com/VojtechVitek) submitted PR [#&#8203;967](https://github.com/go-chi/chi/issues/967), which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories: - [GHSA-9g5q-2w5x-hmxf](https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf) — IP spoofing via XFF in `RemoteAddr` resolution (convto) - [GHSA-rjr7-jggh-pgcp](https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp) — RealIP allows IP spoofing via unvalidated XFF (rezmoss) - [GHSA-3fxj-6jh8-hvhx](https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx) — IP spoofing in `middleware.RealIP` (Saku0512, Critical / 9.3) It also addresses issues outlined at: - [#&#8203;708](https://github.com/go-chi/chi/issues/708) - <https://adam-p.ca/blog/2022/03/x-forwarded-for/> - [#&#8203;711](https://github.com/go-chi/chi/issues/711) - [#&#8203;453](https://github.com/go-chi/chi/issues/453) - [#&#8203;908](https://github.com/go-chi/chi/pull/908) `middleware.RealIP` is deprecated in this PR with pointers to the new API. The deprecation only adds a `// Deprecated:` doc comment; the function keeps working for backward compatibility. ##### Why a new middleware (not "fix RealIP in place") `RealIP` has two unfixable design choices: it mutates `r.RemoteAddr`, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per [adam-p's "The perils of the 'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/) (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly. ##### The new API Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors: ```go // One of the four. There is no safe default — pick exactly one. func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler func ClientIPFromRemoteAddr(h http.Handler) http.Handler // Read the result. func GetClientIP(ctx context.Context) string // for logs, rate-limit keys func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work ``` #### Example usage: ```go // Pick a single ClientIP middleware based on your deployment // Cloudflare. r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP")) // Nginx with ngx_http_realip_module. r.Use(middleware.ClientIPFromHeader("X-Real-IP")) // Apache with mod_remoteip. r.Use(middleware.ClientIPFromHeader("X-Client-IP")) // AWS CloudFront, or any proxy fleet with known CIDRs. r.Use(middleware.ClientIPFromXFF( "13.32.0.0/15", // CloudFront IPv4 "52.46.0.0/18", // CloudFront IPv4 "2600:9000::/28", // CloudFront IPv6 )) // Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools, // ephemeral containers, dynamic CDN edges). r.Use(middleware.ClientIPFromXFFTrustedProxies(2)) // Server directly on the public internet, no proxy in front. r.Use(middleware.ClientIPFromRemoteAddr) ``` And in your handler or downstream middleware: ```go clientIP := middleware.GetClientIP(r.Context()) // log it, use it as a rate-limit key, etc. ``` *** Thanks to [@&#8203;adam-p](https://github.com/adam-p), [@&#8203;c2h5oh](https://github.com/c2h5oh), [@&#8203;rezmoss](https://github.com/rezmoss), [@&#8203;Saku0512](https://github.com/Saku0512), [@&#8203;convto](https://github.com/convto), [@&#8203;Dirbaio](https://github.com/Dirbaio), [@&#8203;jawnsy](https://github.com/jawnsy), [@&#8203;lrstanley](https://github.com/lrstanley), [@&#8203;mfridman](https://github.com/mfridman), [@&#8203;n33pm](https://github.com/n33pm), [@&#8203;pkieltyka](https://github.com/pkieltyka) for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR. **Full Changelog**: <https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDguMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwOC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Update module github.com/go-chi/chi/v5 to v5.3.0
Some checks failed
renovate/artifacts Artifact file update failure
9e5fc56d91
renovate-bot commented 2026-06-02 14:03:57 +02:00
Author
Collaborator
Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
spawn go ENOENT
### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: go.sum ``` spawn go ENOENT ```
renovate-bot force-pushed renovate/github.com-go-chi-chi-v5-5.x from 9e5fc56d91
Some checks failed
renovate/artifacts Artifact file update failure
to ab523f5ce5
Some checks failed
renovate/artifacts Artifact file update failure
2026-06-02 14:23:49 +02:00 Compare
renovate-bot force-pushed renovate/github.com-go-chi-chi-v5-5.x from ab523f5ce5
Some checks failed
renovate/artifacts Artifact file update failure
to 77bb6cf979
Some checks failed
renovate/artifacts Artifact file update failure
2026-06-02 14:33:58 +02:00 Compare
Some checks failed
renovate/artifacts Artifact file update failure
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/github.com-go-chi-chi-v5-5.x:renovate/github.com-go-chi-chi-v5-5.x
git switch renovate/github.com-go-chi-chi-v5-5.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/github.com-go-chi-chi-v5-5.x
git switch renovate/github.com-go-chi-chi-v5-5.x
git rebase main
git switch main
git merge --ff-only renovate/github.com-go-chi-chi-v5-5.x
git switch renovate/github.com-go-chi-chi-v5-5.x
git rebase main
git switch main
git merge --no-ff renovate/github.com-go-chi-chi-v5-5.x
git switch main
git merge --squash renovate/github.com-go-chi-chi-v5-5.x
git switch main
git merge --ff-only renovate/github.com-go-chi-chi-v5-5.x
git switch main
git merge renovate/github.com-go-chi-chi-v5-5.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
unurled/cnampagnon-go!17
No description provided.