Update module github.com/go-chi/chi/v5 to v5.3.0 [SECURITY] by renovate[bot] · Pull Request #75 · crossplane/function-runtime-oci

renovate · 2025-07-28T13:42:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-chi/chi/v5	`v5.0.10` → `v5.3.0`

chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

GHSA-vrw8-fxc6-2r93 / GO-2025-3770

More information

Details

Summary

The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect.

We consider this a lower-severity open redirect, as it can't be exploited from browsers or email clients (requires manipulation of a Host header).

Details

The RedirectSlashes method uses the Host header to construct the redirectURL at this line https://github.com/go-chi/chi/blob/master/middleware/strip.go#L55

The Host header can be manipulated by a user to be any arbitrary host. This leads to open redirect when using the RedirectSlashes middleware

PoC

Create a simple server which uses the RedirectSlashes middleware

package main

import (
	"fmt"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware" // Import the middleware package
)

func main() {
	// Create a new Chi router
	r := chi.NewRouter()

	// Use the built-in RedirectSlashes middleware
	r.Use(middleware.RedirectSlashes) // Use middleware.RedirectSlashes

	// Define a route handler
	r.Get("/", func(w http.ResponseWriter, r *http.Request) {
		// A simple response
		w.Write([]byte("Hello, World!"))
	})

	// Start the server
	fmt.Println("Starting server on :8080")
	http.ListenAndServe(":8080", r)
}

Run the server go run main.go

Once the server is running, send a request that will trigger the RedirectSlashes function with an arbitrary Host header
curl -iL -H "Host: example.com" http://localhost:8080/test/

Observe that the request will be redirected to example.com

curl -L -H "Host: example.com" http://localhost:8080/test/

<!doctype html>
<html>
<head>
    <title>Example Domain</title>

    <meta charset="utf-8" />
    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <style type="text/css">
    body {
        background-color: #f0f0f2;
        margin: 0;
        padding: 0;
        font-family: -apple-system, system-ui, BlinkMacSystemFont, "Segoe UI", "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
... snipped ...

Without the host header, the response is returned from the test server

curl -L http://localhost:8080/test/

404 page not found

Impact

An open redirect vulnerability allows attackers to trick users into visiting malicious sites. This can lead to phishing attacks, credential theft, and malware distribution, as users trust the application’s domain while being redirected to harmful sites.

Potential mitigation

It seems that the purpose of the RedirectSlashes function is to redirect within the same application. In that case r.RequestURI can be used instead of r.Host by default. If there is a use case to redirect to a different host, a flag can be added to use the Host header instead. As this flag will be controlled by the developer they will make the decision of allowing redirects to arbitrary hosts based on their judgement.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

GHSA-9g5q-2w5x-hmxf / GO-2026-5775

More information

Details

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

GHSA-rjr7-jggh-pgcp / GO-2026-5777

More information

Details

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

`v5.3.0`

Compare Source

What's Changed

Use strings.ReplaceAll where applicable by @JRaspass in #1046
Propagate inline middlewares across mounted subrouters by @LukasJenicek in #1049
add go 1.26 to ci by @pkieltyka in #1052
Remove last uses of io/ioutil by @JRaspass in #1054
Simplify chi.walk with slices.Concat by @JRaspass in #1053
Apply the stringscutprefix modernizer by @JRaspass in #1051
Bump minimum Go to 1.23, always use request.Pattern by @JRaspass in #1048
middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @alliasgher in #1085
Fix typo in Route doc comment by @gouwazi in #1073
fix: set Request.Pattern from RoutePattern() by @leno23 in #1097
feat: middleware.ClientIP, a replacement for middleware.RealIP by @VojtechVitek in #967

New Contributors

@LukasJenicek made their first contribution in #1049
@alliasgher made their first contribution in #1085
@gouwazi made their first contribution in #1073
@leno23 made their first contribution in #1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

PR #967 introduced middleware.ClientIP, a replacement for middleware.RealIP that closes the three open spoofing advisories:

GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)
GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)
GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @adam-p, @c2h5oh, @rezmoss, @Saku0512, @convto, @Dirbaio, @jawnsy, @lrstanley, @mfridman, @n33pm, @pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

`v5.2.5`

Compare Source

What's Changed

Bump minimum Go to 1.22 and use new features by @JRaspass in #1017
Refactor graceful shutdown example by @mikereid1 in #994
Refactor to use atomic type by @cuiweixie in #1019
update reverseMethodMap in RegisterMethod by @cixel in #1022
Update comment about min Go version by @JRaspass in #1023
middleware: harden RedirectSlashes handler by @pkieltyka in #1044
Fix(middleware): Prevent double handler invocation in RouteHeaders with empty router by @mahanadh in #1045

New Contributors

@mikereid1 made their first contribution in #994
@cuiweixie made their first contribution in #1019
@cixel made their first contribution in #1022
@mahanadh made their first contribution in #1045

Full Changelog: go-chi/chi@v5.2.3...v5.2.5

`v5.2.4`

Compare Source

`v5.2.3`

Compare Source

What's Changed

Add pathvalue example to README and implement PathValue handler. by @catatsuy in #985
Allow multiple whitespace between method & pattern by @JRaspass in #1013
Avoid potential nil dereference by @ProjectMutilation in #1008
feat(mux): support http.Request.Pattern in Go 1.23 by @Gusted in #986
fix/608 - Fix flaky Throttle middleware test by synchronizing token usage by @OtavioBernardes in #1016
Optimize throttle middleware by avoiding unnecessary timer creation by @vasayxtx in #1011
Simplify wildcard replacement in route patterns by @srpvpn in #1012
Replace methodTypString func with reverseMethodMap by @JRaspass in #1018

New Contributors

@ProjectMutilation made their first contribution in #1008
@Gusted made their first contribution in #986
@OtavioBernardes made their first contribution in #1016
@srpvpn made their first contribution in #1012

Full Changelog: go-chi/chi@v5.2.2...v5.2.3

`v5.2.2`

Compare Source

What's Changed

Use strings.Cut in a few places by @JRaspass in #971
Fix non-constant format strings in t.Fatalf by @JRaspass in #972
Apply fieldalignment fixes to optimize struct memory layout by @pixel365 in #974
go 1.24 by @pkieltyka in #977
chore: delint ioutil usage by @costela in #962
Fixed typo in Router interface definition by @mithileshgupta12 in #958
Add support for TinyGo by @efraimbart in #978
Exclude middleware/profiler.go in TinyGo, as there's no net/http/pprof pkg by @cxjava in #982
Make use of strings.Cut by @scop in #1005
Change install command format to code block by @sglkc in #1001
Correct documentation by @mrdomino in #992

Security fix

Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
- a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
- reported by Anuraag Baishya, @anuraagbaishya. Thank you!

New Contributors

@pixel365 made their first contribution in #974
@mithileshgupta12 made their first contribution in #958
@efraimbart made their first contribution in #978
@cxjava made their first contribution in #982
@sglkc made their first contribution in #1001
@mrdomino made their first contribution in #992

Full Changelog: go-chi/chi@v5.2.1...v5.2.2

`v5.2.1`

Compare Source

⚠️ Chi supports Go 1.20+

Starting this release, we will now support the four most recent major versions of Go. See #963 for related discussion.

What's Changed

Support the four most recent major versions of Go by @VojtechVitek in #969

Full Changelog: go-chi/chi@v5.2.0...v5.2.1

`v5.2.0`

Compare Source

What's Changed

update credits section to link to goji license by @pkieltyka in #944
go 1.23 by @pkieltyka in #945
Make Context.RoutePattern() nil-safe by @gaiaz-iusipov in #927
govet: Fix non-constant format string by @marcofranssen in #952
Add Find to Routes interface by @joeriddles in #872
Fix grammar error by @AntonC9018 in #917
~~feat(): add CF-Connecting-IP by @n33pm in #908~~
- ~~Revert "feat(): add CF-Connecting-IP" by @VojtechVitek in #966~~
Fixed incorrect comment about routing by @jtams in #887
Fix condition in TestRedirectSlashes by @tchssk in #856
middleware: Add strip prefix middleware by @m1k1o in #875
Set up go module for _examples/versions by @hongkuancn in #948
Ability to specify response HTTP status code for Throttle middleware by @vasayxtx in #571
Support Content-Type headers with charset/boundary parameters by @GocaMaric in #880
Fix Mux.Find not correctly handling nested routes by @joeriddles in #954
fix(WrapResponseWriter): allow multiple informational statuses by @costela in #961

New Contributors

@gaiaz-iusipov made their first contribution in #927
@marcofranssen made their first contribution in #952
@joeriddles made their first contribution in #872
@AntonC9018 made their first contribution in #917
@n33pm made their first contribution in #908
@jtams made their first contribution in #887
@tchssk made their first contribution in #856
@m1k1o made their first contribution in #875
@hongkuancn made their first contribution in #948
@GocaMaric made their first contribution in #880
@costela made their first contribution in #961

Full Changelog: go-chi/chi@v5.1.0...v5.2.0

`v5.1.0`

Compare Source

What's Changed

middleware: add Discard method to WrapResponseWriter by @patrislav in #926
- Adds Discard() method to the middleware.WrapResponseWriter interface. This is technically an API breaking change. However after some discussion at #926 (comment), we decided to move forward, and release as minor version, as we don't expect anyone to rely on this interface / implement it externally.

New Contributors

@patrislav made their first contribution in #926

Full Changelog: go-chi/chi@v5.0.14...v5.1.0

`v5.0.14`

Compare Source

What's Changed

middleware: fix typo in RealIP doc by @l2dy in #903
reduce size of Context struct from 216 bytes to 208 bytes by @juburr in #912
Avoid possible memory leak in compress middleware by @Neurostep in #919
docs: Update stale links in docs for contributing by @Lutherwaves in #904
Revert "Avoid possible memory leak in compress middleware" by @VojtechVitek in #924

New Contributors

@l2dy made their first contribution in #903
@juburr made their first contribution in #912
@Neurostep made their first contribution in #919
@Lutherwaves made their first contribution in #904

Full Changelog: go-chi/chi@v5.0.12...v5.0.14

`v5.0.13`

Compare Source

What's Changed

middleware: fix typo in RealIP doc by @l2dy in #903
reduce size of Context struct from 216 bytes to 208 bytes by @juburr in #912
Avoid possible memory leak in compress middleware by @Neurostep in #919

New Contributors

@l2dy made their first contribution in #903
@juburr made their first contribution in #912
@Neurostep made their first contribution in #919

Full Changelog: go-chi/chi@v5.0.12...v5.0.13

`v5.0.12`

Compare Source

History of changes: see go-chi/chi@v5.0.11...v5.0.12

`v5.0.11`

Compare Source

History of changes: see go-chi/chi@v5.0.10...v5.0.11

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-24T23:48:03Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.20` -> `1.23`

renovate Bot added the automated label Jul 28, 2025

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Sep 7, 2025

renovate Bot closed this Sep 7, 2025

renovate Bot deleted the renovate/go-github.com-go-chi-chi-v5-vulnerability branch September 7, 2025 20:30

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Sep 8, 2025

renovate Bot reopened this Sep 8, 2025

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch from bb43fa0 to 2f3d3cd Compare September 8, 2025 02:02

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Dec 6, 2025

renovate Bot closed this Dec 6, 2025

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Dec 10, 2025

renovate Bot reopened this Dec 10, 2025

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from 2f3d3cd to f617255 Compare December 10, 2025 12:34

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Feb 25, 2026

renovate Bot closed this Feb 25, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Feb 27, 2026

renovate Bot reopened this Feb 27, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch from f617255 to 444f9fb Compare February 27, 2026 13:44

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Mar 2, 2026

renovate Bot closed this Mar 2, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Mar 5, 2026

renovate Bot reopened this Mar 5, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from 444f9fb to 5f8aeca Compare March 5, 2026 09:35

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Apr 7, 2026

renovate Bot closed this Apr 7, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Apr 7, 2026

renovate Bot reopened this Apr 7, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from 5f8aeca to d821946 Compare April 7, 2026 17:03

renovate Bot closed this Apr 28, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Apr 28, 2026

renovate Bot reopened this Apr 28, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from d821946 to d59f277 Compare April 28, 2026 09:37

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Jun 1, 2026

renovate Bot closed this Jun 1, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Jun 1, 2026

renovate Bot reopened this Jun 1, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from d59f277 to 4da6878 Compare June 1, 2026 19:00

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Jun 3, 2026

renovate Bot closed this Jun 3, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Jun 3, 2026

renovate Bot reopened this Jun 3, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from 4da6878 to cbe6104 Compare June 3, 2026 09:52

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Jul 20, 2026

renovate Bot closed this Jul 20, 2026

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] Jul 21, 2026

renovate Bot reopened this Jul 21, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch from cbe6104 to 550f0bd Compare July 21, 2026 01:07

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY]~~ Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed Jul 24, 2026

renovate Bot closed this Jul 24, 2026

Update module github.com/go-chi/chi/v5 to v5.3.0 [SECURITY]

c40a319

renovate Bot changed the title ~~Update module github.com/go-chi/chi/v5 to v5.2.2 [SECURITY] - autoclosed~~ Update module github.com/go-chi/chi/v5 to v5.3.0 [SECURITY] Jul 24, 2026

renovate Bot reopened this Jul 24, 2026

renovate Bot force-pushed the renovate/go-github.com-go-chi-chi-v5-vulnerability branch 2 times, most recently from 550f0bd to c40a319 Compare July 24, 2026 23:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update module github.com/go-chi/chi/v5 to v5.3.0 [SECURITY] - #75

Update module github.com/go-chi/chi/v5 to v5.3.0 [SECURITY]#75
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-go-chi-chi-v5-vulnerability

renovate Bot commented Jul 28, 2025 •

edited

Loading

Uh oh!

renovate Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Details

Summary

Details

PoC

Impact

Potential mitigation

Severity

References

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Details

Severity

References

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Details

Severity

References

Release Notes

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

Why a new middleware (not "fix RealIP in place")

The new API

Example usage:

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Security fix

New Contributors

⚠️ Chi supports Go 1.20+

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

renovate Bot commented Jul 24, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 28, 2025 •

edited

Loading