Skip to content

fix(deps): update all (major) - #42

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-all
Open

fix(deps): update all (major)#42
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-all

Conversation

@renovate

@renovate renovate Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/go-chi/chi v1.5.1 → v5.3.2 age confidence
github.com/go-chi/httplog v0.1.8 → v3.5.0 age confidence
gopkg.in/yaml.v2 v2.4.0 → v3.0.1 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

go-chi/chi (github.com/go-chi/chi)

v5.3.2

Compare Source

What's Changed

  • feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in #​1151
  • docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in #​1111
  • fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in #​1148
  • Don't duplicate methods in Allow: header for 405 responses by @​flimzy in #​1029
  • fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in #​1156
    • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #​868 and #​1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

v5.3.1

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

PR #​967 introduced middleware.ClientIP, a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

v5.2.5

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.2.3...v5.2.5

v5.2.4

Compare Source

v5.2.3

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.2.2...v5.2.3

v5.2.2

Compare Source

What's Changed

Security fix

  • Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
    • a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
    • reported by Anuraag Baishya, @​anuraagbaishya. Thank you!

New Contributors

Full Changelog: go-chi/chi@v5.2.1...v5.2.2

v5.2.1

Compare Source

⚠️ Chi supports Go 1.20+

Starting this release, we will now support the four most recent major versions of Go. See #​963 for related discussion.

What's Changed

Full Changelog: go-chi/chi@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed

  • middleware: add Discard method to WrapResponseWriter by @​patrislav in #​926
    • Adds Discard() method to the middleware.WrapResponseWriter interface. This is technically an API breaking change. However after some discussion at #​926 (comment), we decided to move forward, and release as minor version, as we don't expect anyone to rely on this interface / implement it externally.

New Contributors

Full Changelog: go-chi/chi@v5.0.14...v5.1.0

v5.0.14

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.0.12...v5.0.14

v5.0.13

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.0.12...v5.0.13

v5.0.12

Compare Source

v5.0.11

Compare Source

v5.0.10

Compare Source

v5.0.9

Compare Source

v5.0.8

Compare Source

v5.0.7

Compare Source

v5.0.6

Compare Source

v5.0.5

Compare Source

v5.0.4

Compare Source

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

v4.1.3

Compare Source

v4.1.2

Compare Source

  • Performance improvement: removing 1 allocation by foregoing context.WithValue, thank you @​bouk for
    your contribution (#​555). Note: new benchmarks posted in README.
  • middleware.CleanPath: new middleware that clean's request path of double slashes
  • deprecate & remove chi.ServerBaseContext in favour of stdlib http.Server#BaseContext
  • plus other tiny improvements, see full commit history below
  • History of changes: see go-chi/chi@v4.1.2...v1.5.1

v4.1.1

Compare Source

v4.1.0

Compare Source

  • fix for issue #​411 which allows for overlapping regexp
    route to the correct handler through a recursive tree search, thanks to @​Jahaja for the PR/fix!
  • new middleware.RouteHeaders as a simple router for request headers with wildcard support
  • History of changes: see go-chi/chi@v4.1.0...v4.1.1

v4.0.4

Compare Source

v4.0.3

Compare Source

v4.0.2

Compare Source

  • core: fix regexp routing to include default value when param is not matched
  • middleware: rewrite of middleware.Compress
  • middleware: suppress http.ErrAbortHandler in middleware.Recoverer
  • History of changes: see go-chi/chi@v4.0.2...v4.0.3

v4.0.1

Compare Source

v4.0.0

Compare Source

v3.3.5

Compare Source

v3.3.4

Compare Source

  • chi v4 requires Go 1.10.3+ (or Go 1.9.7+) - we have deprecated support for Go 1.7 and 1.8
  • router: respond with 404 on router with no routes (#​362)
  • router: additional check to ensure wildcard is at the end of a url pattern (#​333)
  • middleware: deprecate use of http.CloseNotifier (#​347)
  • middleware: fix RedirectSlashes to include query params on redirect (#​334)
  • History of changes: see go-chi/chi@v3.3.4...v4.0.0

v3.3.3

Compare Source

  • Minor middleware improvements. No changes to core library/router. Moving v3 into its
  • own branch as a version of chi for Go 1.7, 1.8, 1.9, 1.10, 1.11
  • History of changes: see go-chi/chi@v3.3.3...v3.3.4

v3.3.2

Compare Source

v3.3.1

Compare Source

  • middleware: new AllowContentType handler for explicit whitelist of accepted request Content-Types
  • middleware: new SetHeader handler for short-hand middleware to set a response header key/value
  • Minor bug fixes

v3.3.0

Compare Source

  • New chi.RegisterMethod(method) to add support for custom HTTP methods, see _examples/custom-method for usage
  • Deprecated LINK and UNLINK methods from the default list, please use chi.RegisterMethod("LINK") and chi.RegisterMethod("UNLINK") in an init() function

v3.2.1

Compare Source

  • Add new Match(rctx *Context, method, path string) bool method to Routes interface
    and Mux. Match searches the mux's routing tree for a handler that matches the method/path
  • Add new RouteMethod to *Context
  • Add new Routes pointer to *Context
  • Add new middleware.GetHead to route missing HEAD requests to GET handler
  • Updated benchmarks (see README)

v3.2.0

Compare Source

v3.1.5

Compare Source

  • Setup golint and go vet for the project
  • As per golint, we've redefined func ServerBaseContext(h http.Handler, baseCtx context.Context) http.Handler
    to func ServerBaseContext(baseCtx context.Context, h http.Handler) http.Handler

v3.1.4

Compare Source

v3.1.3: Router tree Walker, an analogy to filepath.Walk

Compare Source

func Walk(r Routes, walkFn WalkFunc) error

type WalkFunc func(method string, route string, handler http.Handler, middlewares ...func(http.Handler) http.Handler) error

v3.1.2

Compare Source

v3.1.1

Compare Source

v3.1.0

Compare Source

v3.0.0

Compare Source

  • Major update to chi library with many exciting updates, but also some breaking changes
  • URL parameter syntax changed from /:id to /{id} for even more flexible routing, such as
    /articles/{month}-{day}-{year}-{slug}, /articles/{id}, and /articles/{id}.{ext} on the
    same router
  • Support for regexp for routing patterns, in the form of /{paramKey:regExp} for example:
    r.Get("/articles/{name:[a-z]+}", h) and chi.URLParam(r, "name")
  • Add Method and MethodFunc to chi.Router to allow routing definitions such as
    r.Method("GET", "/", h) which provides a cleaner interface for custom handlers like
    in _examples/custom-handler
  • Deprecating mux#FileServer helper function. Instead, we encourage users to create their
    own using file handler with the stdlib, see _examples/fileserver for an example
  • Add support for LINK/UNLINK http methods via r.Method() and r.MethodFunc()
  • Moved the chi project to its own organization, to allow chi-related community packages to
    be easily discovered and supported, at: https://github.com/go-chi
  • NOTE: please update your import paths to "github.com/go-chi/chi"
  • NOTE: chi v2 is still available at https://github.com/go-chi/chi/tree/v2

v2.1.1

Compare Source

v2.1.0

Compare Source

  • Minor improvements and update to the chi core library
  • Introduced a brand new chi/render sub-package to complete the story of building
    APIs to offer a pattern for managing well-defined request / response payloads. Please
    check out the updated _examples/rest example for how it works.
  • Added MethodNotAllowed(h http.HandlerFunc) to chi.Router interface

v2.0.0

Compare Source

  • After many months of v2 being in an RC state with many companies and users running it in
    production, the inclusion of some improvements to the middlewares, we are very pleased to
    announce v2.0.0 of chi.

v1.5.5

Compare Source

v1.5.4

Compare Source

  • chi v5, github.com/go-chi/chi/v5 introduces the adoption of Go's SIV to adhere to the current state-of-the-tools in Go.
  • chi v1.5.x did not work out as planned, as the Go tooling is too powerful and chi's adoption is too wide.
    The most responsible thing to do for everyone's benefit is to just release v5 with SIV, so I present to you all,
    chi v5 at github.com/go-chi/chi/v5. I hope someday the developer experience and ergonomics I've been seeking
    will still come to fruition in some form, see golang/go#44550
  • History of changes: see go-chi/chi@v1.5.4...v5.0.0

v1.5.3

Compare Source

v1.5.2

Compare Source

  • Update go.mod to go 1.16 with new retract directive marking all versions without prior go.mod support
  • History of changes: see go-chi/chi@v1.5.2...v1.5.3
go-chi/httplog (github.com/go-chi/httplog)

v3.5.0

Compare Source

What's Changed

Full Changelog: go-chi/httplog@v3.4.0...v3.5.0

v3.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/httplog@v3.3.0...v3.4.0

v3.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/httplog@v3.2.2...v3.3.0

v3.2.2

Compare Source

What's Changed

Full Changelog: go-chi/httplog@v3.2.1...v3.2.2

v3.2.1

Compare Source

What's Changed

Full Changelog: go-chi/httplog@v3.2.0...v3.2.1

v3.2.0

Compare Source

What's Changed

  • Rename "ClientDisconnected" error to "ClientAborted"
  • Rename "error" key according to the schema but don't stringify
    by @​VojtechVitek in #​59

Full Changelog: go-chi/httplog@v3.1.0...v3.2.0

v3.1.0

Compare Source

What's Changed

Full Changelog: go-chi/httplog@v3.0.0...v3.1.0

v3.0.0

Compare Source

What's Changed

github.com/go-chi/httplog/v3

Based on prototype at https://github.com/golang-cz/httplog

Fixes #​28
Fixes #​35
Fixes #​36
Fixes #​40

New Contributors

Full Changelog: go-chi/httplog@v2.1.1...v3.0.0

v2.1.1

Compare Source

v2.1.0

Compare Source

v2.0.11

Compare Source

v2.0.10

Compare Source

v2.0.9

Compare Source

v2.0.8

Compare Source

v2.0.7

Compare Source

v2.0.6

Compare Source

v2.0.5

Compare Source

v2.0.4

Compare Source

v2.0.3

Compare Source

v2.0.2

Compare Source

v2.0.1

Compare Source

v2.0.0

Compare Source

v0.3.2

Compare Source

v0.3.1

Compare Source

v0.3.0

Compare Source

v0.2.5

Compare Source

v0.2.4

Compare Source

v0.2.3

Compare Source

v0.2.2

Compare Source

v0.2.1

Compare Source

v0.2.0

Compare Source

go-yaml/yaml (gopkg.in/yaml.v2)

v3.0.1

Compare Source

v3.0.0

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from moul as a code owner June 25, 2026 16:29
@renovate
renovate Bot force-pushed the renovate/major-all branch from a7efb14 to 1200d24 Compare July 6, 2026 20:37
@renovate
renovate Bot force-pushed the renovate/major-all branch from 1200d24 to a3b8843 Compare July 19, 2026 01:53
@renovate renovate Bot changed the title fix(deps): update all (major) fix(deps): update all to v3 Jul 19, 2026
@renovate renovate Bot changed the title fix(deps): update all to v3 fix(deps): update all (major) Jul 19, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch from a3b8843 to b7bf3a1 Compare July 19, 2026 06:11
@renovate
renovate Bot force-pushed the renovate/major-all branch 4 times, most recently from 74cad32 to 18d6dd9 Compare August 4, 2026 17:53
@renovate
renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 1214ad4 to 77b79d5 Compare August 13, 2026 01:01
@renovate
renovate Bot force-pushed the renovate/major-all branch from 77b79d5 to 2d01db3 Compare August 20, 2026 10:59
@renovate renovate Bot changed the title fix(deps): update all (major) fix(deps): update module gopkg.in/yaml.v2 to v3 Aug 28, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from e1c3a2c to e2747ef Compare August 28, 2026 20:35
@renovate renovate Bot changed the title fix(deps): update module gopkg.in/yaml.v2 to v3 fix(deps): update all to v3 Aug 28, 2026
@renovate

renovate Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

ℹ️ Artifact update notice

File name: chaos-bot/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.14 -> 1.23

@renovate
renovate Bot force-pushed the renovate/major-all branch from e2747ef to 62ebf54 Compare August 29, 2026 00:38
@renovate renovate Bot changed the title fix(deps): update all to v3 fix(deps): update all (major) Aug 29, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch from 62ebf54 to 157310a Compare August 29, 2026 17:58
@renovate renovate Bot changed the title fix(deps): update all (major) fix(deps): update all to v3 Aug 29, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch from 157310a to 9d37f18 Compare August 29, 2026 21:54
@renovate renovate Bot changed the title fix(deps): update all to v3 fix(deps): update all (major) Aug 29, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch 6 times, most recently from a8fa3af to 80bec9e Compare September 2, 2026 10:44
@renovate renovate Bot changed the title fix(deps): update all (major) fix(deps): update all to v3 Sep 2, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch 2 times, most recently from 6916143 to f8df3d9 Compare September 3, 2026 03:09
@renovate renovate Bot changed the title fix(deps): update all to v3 fix(deps): update all (major) Sep 3, 2026
@renovate
renovate Bot force-pushed the renovate/major-all branch from f8df3d9 to 431f5ac Compare September 9, 2026 19:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@moul moul Awaiting requested review from moul moul is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants