From 4dade44e7250a0a050a56bb4e994032eff53ea51 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 11:18:07 +0000
Subject: [PATCH] chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1
 (#27051)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from
5.2.4 to 5.3.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-chi/chi/releases">github.com/go-chi/chi/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Honor Discard() in httpFancyWriter.ReadFrom by <a
href="https://github.com/DucMinhNe"><code>@​DucMinhNe</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li>
<li>Tidy build directives by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1113">go-chi/chi#1113</a></li>
<li>feat(middleware): add text/xml and application/xml to default
compressible types by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1127">go-chi/chi#1127</a></li>
<li>Fix defaultLogEntry.Panic not respecting NoColor setting by <a
href="https://github.com/doganarif"><code>@​doganarif</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li>
<li>middleware: document printPrettyStack and harden NoColor panic test
by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1131">go-chi/chi#1131</a></li>
<li>feat(mux): support http QUERY method ietf rfc10008 by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1132">go-chi/chi#1132</a></li>
<li>ci: pin GitHub Actions to full commit SHAs by <a
href="https://github.com/XananasX7"><code>@​XananasX7</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/DucMinhNe"><code>@​DucMinhNe</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1110">go-chi/chi#1110</a></li>
<li><a href="https://github.com/doganarif"><code>@​doganarif</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1050">go-chi/chi#1050</a></li>
<li><a href="https://github.com/XananasX7"><code>@​XananasX7</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1116">go-chi/chi#1116</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1">https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1</a></p>
<h2>v5.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Use strings.ReplaceAll where applicable by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1046">go-chi/chi#1046</a></li>
<li>Propagate inline middlewares across mounted subrouters by <a
href="https://github.com/LukasJenicek"><code>@​LukasJenicek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li>
<li>add go 1.26 to ci by <a
href="https://github.com/pkieltyka"><code>@​pkieltyka</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1052">go-chi/chi#1052</a></li>
<li>Remove last uses of io/ioutil by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1054">go-chi/chi#1054</a></li>
<li>Simplify chi.walk with slices.Concat by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1053">go-chi/chi#1053</a></li>
<li>Apply the stringscutprefix modernizer by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1051">go-chi/chi#1051</a></li>
<li>Bump minimum Go to 1.23, always use request.Pattern by <a
href="https://github.com/JRaspass"><code>@​JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1048">go-chi/chi#1048</a></li>
<li>middleware: fix httpFancyWriter.ReadFrom double-counting bytes with
Tee by <a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li>
<li>Fix typo in Route doc comment by <a
href="https://github.com/gouwazi"><code>@​gouwazi</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li>
<li>fix: set Request.Pattern from RoutePattern() by <a
href="https://github.com/leno23"><code>@​leno23</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li>
<li>feat: middleware.ClientIP, a replacement for middleware.RealIP by <a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/967">go-chi/chi#967</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/LukasJenicek"><code>@​LukasJenicek</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1049">go-chi/chi#1049</a></li>
<li><a
href="https://github.com/alliasgher"><code>@​alliasgher</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1085">go-chi/chi#1085</a></li>
<li><a href="https://github.com/gouwazi"><code>@​gouwazi</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1073">go-chi/chi#1073</a></li>
<li><a href="https://github.com/leno23"><code>@​leno23</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1097">go-chi/chi#1097</a></li>
</ul>
<h2>SECURITY: middleware.ClientIP, a replacement for
middleware.RealIP</h2>
<p><a
href="https://github.com/VojtechVitek"><code>@​VojtechVitek</code></a>
submitted PR <a
href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>, which
introduces middleware.ClientIP — a replacement for middleware.RealIP
that closes the three open spoofing advisories:</p>
<ul>
<li><a
href="https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf">GHSA-9g5q-2w5x-hmxf</a>
— IP spoofing via XFF in <code>RemoteAddr</code> resolution
(convto)</li>
<li><a
href="https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp">GHSA-rjr7-jggh-pgcp</a>
— RealIP allows IP spoofing via unvalidated XFF (rezmoss)</li>
<li><a
href="https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx">GHSA-3fxj-6jh8-hvhx</a>
— IP spoofing in <code>middleware.RealIP</code> (Saku0512, Critical /
9.3)</li>
</ul>
<p>It also addresses issues outlined at:</p>
<ul>
<li><a
href="https://redirect.github.com/go-chi/chi/issues/708">go-chi/chi#708</a></li>
<li><a
href="https://adam-p.ca/blog/2022/03/x-forwarded-for/">https://adam-p.ca/blog/2022/03/x-forwarded-for/</a></li>
<li><a
href="https://redirect.github.com/go-chi/chi/issues/711">go-chi/chi#711</a></li>
<li><a
href="https://redirect.github.com/go-chi/chi/issues/453">go-chi/chi#453</a></li>
<li><a
href="https://redirect.github.com/go-chi/chi/pull/908">go-chi/chi#908</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-chi/chi/commit/8b258c7bb28f97a5f2a856ff7ef962578fec9215"><code>8b258c7</code></a>
ci: pin GitHub Actions to full commit SHAs (<a
href="https://redirect.github.com/go-chi/chi/issues/1116">#1116</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/caf87e6e1bd9f29326f2ffdb93d8098139f08e4f"><code>caf87e6</code></a>
feat(mux): support http QUERY method ietf rfc10008 (<a
href="https://redirect.github.com/go-chi/chi/issues/1132">#1132</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/7fcb8a20364d7b72e2d5a0e413ae80346e1c99c8"><code>7fcb8a2</code></a>
middleware: document printPrettyStack and harden NoColor panic test (<a
href="https://redirect.github.com/go-chi/chi/issues/1131">#1131</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/878fe71fc9e506a63ea6957ed09c9ce84f789e97"><code>878fe71</code></a>
Fix defaultLogEntry.Panic not respecting NoColor setting (<a
href="https://redirect.github.com/go-chi/chi/issues/1050">#1050</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/d7b767bcbea51e486bdc9fd06d25136767ec14b5"><code>d7b767b</code></a>
feat(middleware): add text/xml and application/xml to default
compressible ty...</li>
<li><a
href="https://github.com/go-chi/chi/commit/3b50c7cc35ff25f384202409733c3332c150e0ec"><code>3b50c7c</code></a>
Tidy build directives (<a
href="https://redirect.github.com/go-chi/chi/issues/1113">#1113</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/2b9fca258f92830fc8232582e9e05a4d4a572a5d"><code>2b9fca2</code></a>
Honor Discard() in httpFancyWriter.ReadFrom (<a
href="https://redirect.github.com/go-chi/chi/issues/1110">#1110</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/3b171578ca44dfd75ca3c5cbddc7b44c600a7b49"><code>3b17157</code></a>
feat: middleware.ClientIP, a replacement for middleware.RealIP (<a
href="https://redirect.github.com/go-chi/chi/issues/967">#967</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/818fdcfc4786168651768377ba647cf9dd5b3953"><code>818fdcf</code></a>
fix: set Request.Pattern from RoutePattern() (<a
href="https://redirect.github.com/go-chi/chi/issues/1097">#1097</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/f975af0cb10cbefaccf0422385420fe62722d648"><code>f975af0</code></a>
Fix typo in Route doc comment (<a
href="https://redirect.github.com/go-chi/chi/issues/1073">#1073</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/go-chi/chi/compare/v5.2.4...v5.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-chi/chi/v5&package-manager=go_modules&previous-version=5.2.4&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 4bd83199bd..f1be0a6a41 100644
--- a/go.mod
+++ b/go.mod
@@ -169,7 +169,7 @@ require (
 	github.com/fergusstrange/embedded-postgres v1.34.0
 	github.com/gen2brain/beeep v0.11.1
 	github.com/gliderlabs/ssh v0.3.8
-	github.com/go-chi/chi/v5 v5.2.4
+	github.com/go-chi/chi/v5 v5.3.1
 	github.com/go-chi/cors v1.2.1
 	github.com/go-chi/httprate v0.15.0
 	github.com/go-jose/go-jose/v4 v4.1.4
diff --git a/go.sum b/go.sum
index 1b4e45af20..1f17a831a5 100644
--- a/go.sum
+++ b/go.sum
@@ -508,8 +508,8 @@ github.com/github/fakeca v0.1.0 h1:Km/MVOFvclqxPM9dZBC4+QE564nU4gz4iZ0D9pMw28I=
 github.com/github/fakeca v0.1.0/go.mod h1:+bormgoGMMuamOscx7N91aOuUST7wdaJ2rNjeohylyo=
 github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
 github.com/go-chi/chi/v5 v5.2.0/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/chi/v5 v5.2.4 h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4=
-github.com/go-chi/chi/v5 v5.2.4/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
+github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
+github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
 github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-chi/hostrouter v0.3.0 h1:75it1eO3FvkG8te1CvU6Kvr3WzAZNEBbo8xIrxUKLOQ=