Skip to content

fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) - #27148

Merged
mtojek merged 3 commits into
release/2.34from
copilot/ent-131-backport-go-chi-upgrade
Jul 14, 2026
Merged

fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34)#27148
mtojek merged 3 commits into
release/2.34from
copilot/ent-131-backport-go-chi-upgrade

Conversation

Copilot AI commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Backport go-chi/chi v5.2.4 to v5.3.1 on release/2.34, aligning with the upgrade already merged on main via #27051.

Security Advisories Addressed

chi v5.3.0 and v5.3.1 resolve the following advisories:

Advisory Description Severity
GHSA-9g5q-2w5x-hmxf IP spoofing via XFF in RemoteAddr resolution
GHSA-rjr7-jggh-pgcp RealIP allows IP spoofing via unvalidated XFF
GHSA-3fxj-6jh8-hvhx IP spoofing in middleware.RealIP Critical (9.3)
GHSA-mqqf-5wvp-8fh8 Open redirect in RedirectSlashes (CVE-2025-69725)
GHSA-vrw8-fxc6-2r93 Host Header Injection in RedirectSlashes

Impact Assessment

Coder does not use the directly affected middleware:

  • middleware.RealIP — Coder uses its own httpmw.ExtractRealIP
  • StripSlashes / RedirectSlashes / CleanPath — Coder uses its own singleSlashMW

The primary motivation for this backport is keeping release/2.34 aligned with main to prevent dependency drift and to satisfy IronBank scanning requirements.

Changes

  • go.mod / go.sum: bump github.com/go-chi/chi/v5 v5.2.4 to v5.3.1

Related

@linear-code

linear-code Bot commented Jul 10, 2026

Copy link
Copy Markdown

ENT-131

Copilot AI changed the title [WIP] Backport go-chi/chi/v5 upgrade from v5.2.4 to v5.3.1 chore(go.mod): upgrade go-chi/chi/v5 v5.2.4 -> v5.3.1 (security backport) Jul 10, 2026
Copilot AI requested a review from denisra July 10, 2026 07:57
@denisra
denisra marked this pull request as ready for review July 10, 2026 08:22
@denisra denisra changed the title chore(go.mod): upgrade go-chi/chi/v5 v5.2.4 -> v5.3.1 (security backport) chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) Jul 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

👋 Hey @Copilot!

This PR is targeting the release/2.34 release branch, but its title does not start with fix: or fix(scope):.

Only bug fixes should be cherry-picked to release branches. If this is a bug fix, please update the PR title to match the conventional commit format:

fix: description of the bug fix
fix(scope): description of the bug fix

If this is not a bug fix, it likely should not target a release branch.

@denisra denisra changed the title chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) Jul 10, 2026

@denisra denisra left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@denisra

denisra commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

/coder-agents-review

@coder-agents-review

coder-agents-review Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Chat: Review posted | View chat
Requested: 2026-07-13 13:21 UTC by @denisra
Spend: $9.29 / $100.00

Review history
  • R1 (2026-07-13): 9 reviewers, 1 Note, 1 P3, COMMENT. Review

deep-review v0.9.0 | Round 1 | db643c8..a25a78e

Last posted: Round 1, 2 findings (1 P3, 1 Note), COMMENT. Review

Finding inventory

Finding inventory - PR #27148

Findings

# Sev Status Location Summary Round Reviewer Posted
CRF-1 P3 Open go.mod:158 (PR description) CVE-to-GHSA mapping self-contradicts embedded prompt; cited advisory IDs unverifiable against public sources R1 Leorio P3, Mafu-san P2, Netero/Hisoka/Mafuuu/Pariston/Kurapika/Razor Note Yes
CRF-2 Note Open go.mod:158 PR body overstates exposure: Coder never calls the StripSlashes/RedirectSlashes/RealIP middleware the advisories target; only core path-DoS is live; strip.go byte-identical v5.2.4->v5.3.1 R1 Hisoka, Mafuuu, Pariston, Kurapika, Razor Yes
CRF-3 Nit Open commit a25a78e Commit subject chore(go.mod) scope omits go.sum (AGENTS scope rule); type chore conflicts with release-branch fix: policy R1 Leorio, Mafu-san Yes (body)
CRF-4 P3 Open commit a25a78e Empty commit body; security rationale (CVEs, source PR #27051, ENT-131) lives only in PR body and vanishes from git history R1 Leorio Yes (body)

Round log

Round 1

Netero-only first pass: no findings, 2 Notes (P3-and-below), panel proceeded. Panel: Bisky, Hisoka, Mafu-san, Mafuuu, Pariston, Gon, Leorio, Kurapika, Razor (wildcard). Reviewed against db643c8..a25a78e.

Pure go.mod/go.sum bump of go-chi/chi/v5 v5.2.4 -> v5.3.1. Build, go mod verify, go mod tidy -diff, and chi consumer tests all clean across multiple reviewers. Zero code defects. All findings are in PR/commit metadata.

Cross-check resolution (title CI check): the title job validates pull_request.title; current title fix: bump ... (backport 2.34) parses as type fix, no scope, and passes. The red run 86319047440 was against the PR's earlier chore(go.mod): ... title, where scope go.mod excluded go.sum -> setFailed. Stale; clears on re-trigger. Mafu-san's P1 (title blocks merge) is downgraded: it diagnosed the mechanism against the commit subject, not the now-valid PR title. Reported as a process/CI observation in the review body, not an inline finding.

CVE severity: modal reviewer rating was Note; Leorio (writing specialist, domain owner) P3; Mafu-san P2. Set P3: the description is self-contradictory and the IDs are unverifiable, which is worth correcting before a security backport merges, but it is metadata only with no code impact. Not elevated to P2 because consequence is bounded to the audit trail.

About deep-review

CRF = Coder Review Finding (P0-P4, Nit, Note)

Reviewer Focus
Bisky tests
Chopper ops/errors
Churn-guard change verification
Ging language modernization
Gon naming
Hisoka edge cases
Killua perf
Kite change integrity
Knov contracts
Knuckle SQL
Komugi flake/determinism
Kurapika security
Law decomposition
Leorio docs
Luffy product
Mafu-san process
Mafuuu contracts
Melody dispatch/pairing
Meruem structural
Nami frontend
Netero mechanical checks
Pariston premise testing
Pen-botter product gaps
Razor verification
Robin duplication
Ryosuke Go arch
Takumi concurrency
Zoro shape

🤖 Managed by Coder Agents.

@coder-agents-review coder-agents-review Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean, correct, and proportional: a two-line go.mod/go.sum bump of github.com/go-chi/chi/v5 v5.2.4 -> v5.3.1, matching the version main shipped in #27051. Multiple reviewers independently verified the build, go mod verify, go mod tidy -diff, and chi-consumer tests, all clean. Zero code defects. Every finding is in the PR/commit metadata, not the shipped artifact.

Severity count: 2 P3, 1 Nit, 1 Note. No P0-P1.

Hisoka on the actual code risk: "I came to fight the router. It didn't fight back. Every edge I pushed on folded into dormant code." Four reviewers traced Coder's chi usage and agree the runtime exposure is nil (see the Note on go.mod:158); the bump is correct hygiene and branch-drift alignment with main, not incident response.

CI / title check (process, resolves a reviewer disagreement). The red title check (run 86319047440) is stale, not a defect in the current title. The title job in .github/workflows/contrib.yaml validates pull_request.title, and the current title fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) parses as type fix with no scope and passes the validator. The trailing (backport 2.34) is not a conventional-commit scope. Inference from the chore(go.mod): commit subject and the github-actions cherry-pick comment: the PR was opened titled chore(go.mod): ... (scope go.mod excludes go.sum -> setFailed) and renamed afterward. Do not edit the current title; re-trigger the check (any edited/synchronize event) and it should go green.

Commit-quality observations (metadata, not code):

  • Nit [CRF-3] The commit subject chore(go.mod): upgrade go-chi/chi/v5 v5.2.4 -> v5.3.1 uses scope go.mod, which does not contain go.sum (the commit's other changed file), violating the AGENTS.md rule that a scope must be a real path containing every changed file. Its type chore also disagrees with the PR title's fix and with the release-branch policy (.github/workflows/pr-cherry-pick-check.yaml) that PRs to release/* start with fix:. Drop the scope: fix: upgrade go-chi/chi/v5 v5.2.4 -> v5.3.1. (Leorio, Mafu-san)
  • P3 [CRF-4] The commit body is empty, so the rationale (three advisories, source PR #27051, ENT-131) lives only in the PR description and is lost to git blame/git log after merge. On a release branch, git history is the audit surface. Move the reasoning into the commit body. (Leorio)

Given the metadata-only findings, this is a COMMENT, not a change request. The version bump itself is ready.

🤖 This review was automatically generated with Coder Agents.

Comment thread go.mod
Comment thread go.mod
Backport chi v5.3.1 to release/2.34, aligning with the upgrade already
merged on main (#27051).

chi v5.3.0 and v5.3.1 address several security advisories:

- GHSA-9g5q-2w5x-hmxf: IP spoofing via XFF in RemoteAddr resolution
- GHSA-rjr7-jggh-pgcp: RealIP allows IP spoofing via unvalidated XFF
- GHSA-3fxj-6jh8-hvhx: IP spoofing in middleware.RealIP (Critical, 9.3)
- GHSA-mqqf-5wvp-8fh8 (CVE-2025-69725): Open redirect in RedirectSlashes
- GHSA-vrw8-fxc6-2r93: Host Header Injection in RedirectSlashes

Coder does not use the affected middleware (middleware.RealIP,
StripSlashes, RedirectSlashes, CleanPath); it relies on its own
httpmw.ExtractRealIP and singleSlashMW. The primary motivation is
keeping the release branch aligned with main to prevent drift.
@denisra
denisra force-pushed the copilot/ent-131-backport-go-chi-upgrade branch from a25a78e to 57210ac Compare July 13, 2026 15:39
@mtojek
mtojek self-requested a review July 14, 2026 10:40
@mtojek
mtojek merged commit e77a5be into release/2.34 Jul 14, 2026
25 checks passed
@mtojek
mtojek deleted the copilot/ent-131-backport-go-chi-upgrade branch July 14, 2026 10:47
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 14, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants