chore(deps): bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0

[dependabot]

Bumps github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0.

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.0

What's Changed

• Use strings.ReplaceAll where applicable by @​JRaspass in go-chi/chi#1046
• Propagate inline middlewares across mounted subrouters by @​LukasJenicek in go-chi/chi#1049
• add go 1.26 to ci by @​pkieltyka in go-chi/chi#1052
• Remove last uses of io/ioutil by @​JRaspass in go-chi/chi#1054
• Simplify chi.walk with slices.Concat by @​JRaspass in go-chi/chi#1053
• Apply the stringscutprefix modernizer by @​JRaspass in go-chi/chi#1051
• Bump minimum Go to 1.23, always use request.Pattern by @​JRaspass in go-chi/chi#1048
• middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @​alliasgher in go-chi/chi#1085
• Fix typo in Route doc comment by @​gouwazi in go-chi/chi#1073
• fix: set Request.Pattern from RoutePattern() by @​leno23 in go-chi/chi#1097
• feat: middleware.ClientIP, a replacement for middleware.RealIP by @​VojtechVitek in go-chi/chi#967

New Contributors

• @​LukasJenicek made their first contribution in go-chi/chi#1049
• @​alliasgher made their first contribution in go-chi/chi#1085
• @​gouwazi made their first contribution in go-chi/chi#1073
• @​leno23 made their first contribution in go-chi/chi#1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

• GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)
• GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)
• GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

• go-chi/chi#708
• https://adam-p.ca/blog/2022/03/x-forwarded-for/
• go-chi/chi#711
• go-chi/chi#453
• go-chi/chi#908

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
</tr></table> 

... (truncated)

Commits

• 3b17157 feat: middleware.ClientIP, a replacement for middleware.RealIP (#967)
• 818fdcf fix: set Request.Pattern from RoutePattern() (#1097)
• f975af0 Fix typo in Route doc comment (#1073)
• 4ef87ea middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee (#1085)
• a54874f Bump minimum Go to 1.23, always use request.Pattern (#1048)
• 3328d4d Apply the stringscutprefix modernizer (#1051)
• be60b2e Simplify chi.walk with slices.Concat (#1053)
• a36a925 Remove last uses of io/ioutil (#1054)
• 7d93ee3 add go 1.26 to ci (#1052)
• 903cff2 Propagate inline middlewares across mounted subrouters (#1049)
• Additional commits viewable in compare view

[greptile-apps]

Greptile Summary

This PR bumps github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0 and adopts the new middleware.ClientIP* API introduced in that release, replacing the deprecated (and security-advisory-bearing) middleware.RealIP with a configurable, explicitly-opted-in IP resolution strategy.

• Adds ClientIPMiddlewareConfig to ServerConfig, wired through the application graph, with a safe default of remote-address (socket peer — immune to header spoofing); operators who need XFF resolution must explicitly configure the new clientIPMiddleware block.
• Replaces all middleware.RealIP usage in both the v1 and v3 router groups with the new configurable middleware, and updates GetRequestAttributes to read the resolved client IP via middleware.GetClientIPAddr for telemetry.

Confidence Score: 4/5

Safe to merge; the chi bump and ClientIP wiring are well-validated and the default remote-address source eliminates the IP-spoofing surface from the old RealIP middleware.

The core change is a careful, well-tested migration away from middleware.RealIP. The only finding is that the r.RemoteAddr fallback in GetRequestAttributes carries a host:port string into a semconv attribute that expects a bare IP, causing inconsistent observability data when GetClientIPAddr is not set.

pkg/server/attributes.go — the r.RemoteAddr fallback should strip the port before storing it in the network.peer.address attribute.

Important Files Changed

Filename	Overview
pkg/server/attributes.go	GetRequestAttributes now prefers middleware.GetClientIPAddr (IP-only string) over r.RemoteAddr for network.peer.address; fallback still stores host:port string, inconsistent with semconv expectation.
app/config/server.go	Adds ClientIPMiddlewareConfig with validation that guards against chi panics (invalid CIDR prefixes via netip, TrustedProxies < 1); defaults to remote-address source.
app/common/server.go	NewClientIPMiddleware wires the config to chi's new ClientIP* functions; named type wrapper prevents wire ambiguity.
openmeter/server/server.go	Replaces middleware.RealIP with config.ClientIPMiddleware in both v1 and v3 router groups; adds Config.Validate() with nil-check guard.
app/config/server_test.go	Comprehensive table-driven tests for ClientIPMiddlewareConfig.Validate() covering all sources, edge cases (leading-zero CIDR, X-Forwarded-For rejection, zero proxies).
app/common/server_test.go	Integration tests driving requests through NewClientIPMiddleware for all sources; pins the TrustedIPPrefixes-over-TrustedProxies precedence behavior.
go.mod	Version bump of go-chi/chi/v5 from 5.2.5 to 5.3.0.
collector/go.mod	Version bump of go-chi/chi/v5 from 5.2.5 to 5.3.0 in the collector module.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[HTTP Request arrives] --> B[ClientIPMiddleware]
    B --> C{cfg.Source}

    C -->|remote-address| D[ClientIPFromRemoteAddr\nsocket peer only]
    C -->|header| E[ClientIPFromHeader\ncfg.Header]
    C -->|x-forwarded-for| F{TrustedIPPrefixes set?}

    F -->|yes| G[ClientIPFromXFF\ntrusted CIDR list]
    F -->|no| H[ClientIPFromXFFTrustedProxies\ncount = TrustedProxies]

    D --> I[IP stored in ctx via middleware.GetClientIPAddr]
    E --> I
    G --> I
    H --> I

    I --> J[middleware.RequestID]
    J --> K[GetRequestAttributes]
    K --> L{GetClientIPAddr valid?}
    L -->|yes| M[network.peer.address = IP only]
    L -->|no| N[network.peer.address = r.RemoteAddr\nhost:port fallback]

    M --> O[Handler]
    N --> O

Loading

_{Reviews (1): Last reviewed commit: "chore: review" | Re-trigger Greptile}

[greptile-apps]

The fallback peerAddr = r.RemoteAddr stores a host:port string (Go's http.Request.RemoteAddr is always "IP:port"), while the OTel network.peer.address semconv expects a bare IP address. The happy-path value from clientIP.String() is already port-free, so the two branches are inconsistent and the fallback will produce malformed telemetry whenever the client-IP middleware is not in context.

Suggested change

	// Prefer the resolved client IP, falling back to the socket peer so telemetry
	// never loses source attribution when client IP resolution fails closed.
	peerAddr := r.RemoteAddr
	if clientIP := middleware.GetClientIPAddr(ctx); clientIP.IsValid() {
	peerAddr = clientIP.String()
	}
	// Prefer the resolved client IP, falling back to the socket peer so telemetry
	// never loses source attribution when client IP resolution fails closed.
	peerAddr := r.RemoteAddr
	if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
	peerAddr = host
	}
	if clientIP := middleware.GetClientIPAddr(ctx); clientIP.IsValid() {
	peerAddr = clientIP.String()
	}