fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) - #27148
Conversation
|
👋 Hey @Copilot! This PR is targeting the Only bug fixes should be cherry-picked to release branches. If this is a bug fix, please update the PR title to match the conventional commit format: If this is not a bug fix, it likely should not target a release branch. |
|
/coder-agents-review |
|
Chat: Review posted | View chat Review history
deep-review v0.9.0 | Round 1 | Last posted: Round 1, 2 findings (1 P3, 1 Note), COMMENT. Review Finding inventoryFinding inventory - PR #27148Findings
Round logRound 1Netero-only first pass: no findings, 2 Notes (P3-and-below), panel proceeded. Panel: Bisky, Hisoka, Mafu-san, Mafuuu, Pariston, Gon, Leorio, Kurapika, Razor (wildcard). Reviewed against db643c8..a25a78e. Pure Cross-check resolution (title CI check): the CVE severity: modal reviewer rating was Note; Leorio (writing specialist, domain owner) P3; Mafu-san P2. Set P3: the description is self-contradictory and the IDs are unverifiable, which is worth correcting before a security backport merges, but it is metadata only with no code impact. Not elevated to P2 because consequence is bounded to the audit trail. About deep-reviewCRF = Coder Review Finding (P0-P4, Nit, Note)
|
There was a problem hiding this comment.
Clean, correct, and proportional: a two-line go.mod/go.sum bump of github.com/go-chi/chi/v5 v5.2.4 -> v5.3.1, matching the version main shipped in #27051. Multiple reviewers independently verified the build, go mod verify, go mod tidy -diff, and chi-consumer tests, all clean. Zero code defects. Every finding is in the PR/commit metadata, not the shipped artifact.
Severity count: 2 P3, 1 Nit, 1 Note. No P0-P1.
Hisoka on the actual code risk: "I came to fight the router. It didn't fight back. Every edge I pushed on folded into dormant code." Four reviewers traced Coder's chi usage and agree the runtime exposure is nil (see the Note on go.mod:158); the bump is correct hygiene and branch-drift alignment with main, not incident response.
CI / title check (process, resolves a reviewer disagreement). The red title check (run 86319047440) is stale, not a defect in the current title. The title job in .github/workflows/contrib.yaml validates pull_request.title, and the current title fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) parses as type fix with no scope and passes the validator. The trailing (backport 2.34) is not a conventional-commit scope. Inference from the chore(go.mod): commit subject and the github-actions cherry-pick comment: the PR was opened titled chore(go.mod): ... (scope go.mod excludes go.sum -> setFailed) and renamed afterward. Do not edit the current title; re-trigger the check (any edited/synchronize event) and it should go green.
Commit-quality observations (metadata, not code):
- Nit [CRF-3] The commit subject
chore(go.mod): upgrade go-chi/chi/v5 v5.2.4 -> v5.3.1uses scopego.mod, which does not containgo.sum(the commit's other changed file), violating the AGENTS.md rule that a scope must be a real path containing every changed file. Its typechorealso disagrees with the PR title'sfixand with the release-branch policy (.github/workflows/pr-cherry-pick-check.yaml) that PRs torelease/*start withfix:. Drop the scope:fix: upgrade go-chi/chi/v5 v5.2.4 -> v5.3.1. (Leorio, Mafu-san) - P3 [CRF-4] The commit body is empty, so the rationale (three advisories, source PR #27051, ENT-131) lives only in the PR description and is lost to
git blame/git logafter merge. On a release branch, git history is the audit surface. Move the reasoning into the commit body. (Leorio)
Given the metadata-only findings, this is a COMMENT, not a change request. The version bump itself is ready.
🤖 This review was automatically generated with Coder Agents.
Backport chi v5.3.1 to release/2.34, aligning with the upgrade already merged on main (#27051). chi v5.3.0 and v5.3.1 address several security advisories: - GHSA-9g5q-2w5x-hmxf: IP spoofing via XFF in RemoteAddr resolution - GHSA-rjr7-jggh-pgcp: RealIP allows IP spoofing via unvalidated XFF - GHSA-3fxj-6jh8-hvhx: IP spoofing in middleware.RealIP (Critical, 9.3) - GHSA-mqqf-5wvp-8fh8 (CVE-2025-69725): Open redirect in RedirectSlashes - GHSA-vrw8-fxc6-2r93: Host Header Injection in RedirectSlashes Coder does not use the affected middleware (middleware.RealIP, StripSlashes, RedirectSlashes, CleanPath); it relies on its own httpmw.ExtractRealIP and singleSlashMW. The primary motivation is keeping the release branch aligned with main to prevent drift.
a25a78e to
57210ac
Compare
Summary
Backport go-chi/chi v5.2.4 to v5.3.1 on
release/2.34, aligning with the upgrade already merged onmainvia #27051.Security Advisories Addressed
chi v5.3.0 and v5.3.1 resolve the following advisories:
Impact Assessment
Coder does not use the directly affected middleware:
middleware.RealIP— Coder uses its ownhttpmw.ExtractRealIPStripSlashes/RedirectSlashes/CleanPath— Coder uses its ownsingleSlashMWThe primary motivation for this backport is keeping
release/2.34aligned withmainto prevent dependency drift and to satisfy IronBank scanning requirements.Changes
go.mod/go.sum: bumpgithub.com/go-chi/chi/v5v5.2.4 to v5.3.1Related
mainrelease/2.35