[dependabot]

Bumps the go_modules group with 2 updates in the / directory: github.com/go-chi/chi/v5 and github.com/go-jose/go-jose/v4.

Updates github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.4.0

What's Changed

• Improve godoc: add links and titles by @​dolmen in go-chi/chi#1027
• Add Clone method to Context by @​VojtechVitek in go-chi/chi#1157
• middleware: ContentCharset should skip requests without a body by @​VojtechVitek in go-chi/chi#1158
• Update compress middleware support Brotli support documentation by @​sm3142 in go-chi/chi#1007
• fix: panic on Mount() when a router is mounted onto itself by @​sk-sanjay01 in go-chi/chi#1159
• test(middleware): Improves test coverage by @​nszilard in go-chi/chi#700
• Remove superfluous import aliases by @​JRaspass in go-chi/chi#1166
• Bump minimum Go to 1.24, use b.Loop() by @​JRaspass in go-chi/chi#1164
• Use slices.Backward where appropriate by @​JRaspass in go-chi/chi#1165
• Replace "interface{}" with "any" by @​JRaspass in go-chi/chi#1167
• Simplify chi.URLParam, call chi.URLParamFromCtx by @​JRaspass in go-chi/chi#1168
• middleware: record response status when flushing by @​jakezwang in go-chi/chi#1174
• middleware: honor Discard when flushing by @​LeulTew in go-chi/chi#1185
• README: point middleware doc links to chi/v5 by @​VojtechVitek in go-chi/chi#1196
• middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @​VojtechVitek in go-chi/chi#1214
  • Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

• @​dolmen made their first contribution in go-chi/chi#1027
• @​sm3142 made their first contribution in go-chi/chi#1007
• @​sk-sanjay01 made their first contribution in go-chi/chi#1159
• @​nszilard made their first contribution in go-chi/chi#700
• @​jakezwang made their first contribution in go-chi/chi#1174
• @​LeulTew made their first contribution in go-chi/chi#1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

Commits

• 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
• 167e1e3 README: point middleware doc links to chi/v5 (#1196)
• 3d1777a middleware: honor Discard when flushing (#1185)
• b1c9ab4 middleware: record response status when flushing (#1174)
• ae6be74 Simplify chi.URLParam, call chi.URLParamFromCtx (#1168)
• 50ef4e4 Replace "interface{}" with "any" (#1167)
• 77074b3 Use slices.Backward where appropriate (#1165)
• 756fcb8 Bump minimum Go to 1.24, use b.Loop() (#1164)
• 5ac7a82 Remove superfluous import aliases (#1166)
• 36611d2 test(middleware): Improves test coverage (#700)
• Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.6

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

• Reject mismatched JWE CEK lengths by @​akshithg in go-jose/go-jose#266
• Add a tests containerfile and threat model by @​mcpherrinm in go-jose/go-jose#300
• Fix error message for future issued tokens by @​inahga in go-jose/go-jose#303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

v4.1.5

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• cipher/cbc_hmac: don't panic on invalid key (#291)
• json: limit stack depth (#290)
• jwt: reject out-of-range NumericDate values (#278)
• Check alg against pubkey curve during verify. (#293)
• Reject malformed Ed25519 JWKs (#250)
• jws: choose verification key per-signature (#243)

Breaking Changes

In #226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

• Verify OpaqueSigner's Public() return is public (#260)
• jws: skip signature on ErrJWKSKidNotFound (#248)
• Handle JWE JSON without protected header (#240)
• jws: don't strip internal whitespace before parsing JSON (#239)
• jws: fewer calls to OpaqueSigner.Public() (#224)
• Return a specific error when parsing empty string (#216)
• Reject typed nil at Verify time (#285)

Commits

• a0111f8 Merge commit from fork
• dd39a41 Fix error message for future issued tokens (#303)
• 13b7118 Add a tests containerfile and threat model (#300)
• 25b55fe Reject mismatched JWE CEK lengths (#266)
• b10771e Reject typed nil at Verify time
• 56f3866 Check alg against pubkey curve during verify. (#293)
• 74114c2 cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• 6b364f3 cipher/cbc_hmac: don't panic on invalid key (#291)
• a31af25 json: limit stack depth (#290)
• 7f5beb3 jwt: reject out-of-range NumericDate values (#278)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2db28f9f-45db-463d-9fd6-8d6949237fad

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}