From 77043d4222b7211f9a101c68b23139cfc7333a9f Mon Sep 17 00:00:00 2001 From: Adib Hanna Date: Fri, 30 Oct 2026 16:51:24 -0500 Subject: [PATCH 1/2] Deps(go): chi 5.4.0 for the X-Forwarded-For client IP advisory Dependabot alert #1 (GHSA, medium) reports that chi up to 5.3.2 lets a client spoof its IP through X-Forwarded-For in ClientIPFromXFF. This server never calls ClientIPFromXFF or middleware.RealIP: server.go deliberately skips RealIP, and security.go honours X-Forwarded-For only when the immediate peer is a configured trusted proxy. So the advisory cannot be reached here, but the vulnerable code still ships in the binary and the alert stays open, so chi moves to its first fixed version, 5.4.0, and nothing else moves. go vet and go test pass unchanged. The Nix vendorHash follows in the next commit, from the nix check's reported hash. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 757c09b..b9fa57b 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.25 require ( github.com/coder/websocket v1.8.12 github.com/fsnotify/fsnotify v1.8.0 - github.com/go-chi/chi/v5 v5.2.5 + github.com/go-chi/chi/v5 v5.4.0 ) require golang.org/x/sys v0.21.0 // indirect diff --git a/go.sum b/go.sum index 0d3d416..36258fd 100644 --- a/go.sum +++ b/go.sum @@ -2,7 +2,7 @@ github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NA github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs= github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M= github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= -github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug= -github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0= +github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= +github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws= golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= From 7405dea4911ea8e3231979b32ca7faafbc43912d Mon Sep 17 00:00:00 2001 From: Adib Hanna Date: Fri, 30 Oct 2026 16:52:28 -0500 Subject: [PATCH 2/2] Release(nix): the Go vendor hash for chi 5.4.0 The nix check reported the vendored modules' hash after the chi bump (got sha256-3ZvpQhiC...); release.json carries it so the Nix package builds again. --- release.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release.json b/release.json index 171fd7a..b030c05 100644 --- a/release.json +++ b/release.json @@ -1,4 +1,4 @@ { "version": "2.80.0", - "vendorHash": "sha256-ZdOHC2JldvnKSDUFnBUJrKD4F1IWfvYJBksgeDnU9cw=" + "vendorHash": "sha256-3ZvpQhiCxD/tiF61H9095ygkQIsQiMWDCb5rJFmj80s=" }