From 80659239563528770cab4b502be48d6d4e2cf623 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 23:26:15 +0000 Subject: [PATCH] chore(deps): bump github.com/go-chi/chi/v5 in /server Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.1 to 5.3.2. - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.3.1...v5.3.2) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- server/go.mod | 2 +- server/go.sum | 4 +- .../vendor/github.com/go-chi/chi/v5/README.md | 5 ++ .../vendor/github.com/go-chi/chi/v5/tree.go | 52 ++++++++++++++++--- server/vendor/modules.txt | 2 +- 5 files changed, 55 insertions(+), 10 deletions(-) diff --git a/server/go.mod b/server/go.mod index e2a958b..b420085 100644 --- a/server/go.mod +++ b/server/go.mod @@ -3,7 +3,7 @@ module github.com/nimzshafie/airgap-devkit/server go 1.26.6 require ( - github.com/go-chi/chi/v5 v5.3.1 + github.com/go-chi/chi/v5 v5.3.2 golang.org/x/text v0.41.0 ) diff --git a/server/go.sum b/server/go.sum index f0cc763..1f9770c 100644 --- a/server/go.sum +++ b/server/go.sum @@ -2,8 +2,8 @@ github.com/Acconut/go-httptest-recorder v1.0.0 h1:TAv2dfnqp/l+SUvIaMAUK4GeN4+wqb github.com/Acconut/go-httptest-recorder v1.0.0/go.mod h1:CwQyhTH1kq/gLyWiRieo7c0uokpu3PXeyF/nZjUNtmM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8= -github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= +github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc= github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= diff --git a/server/vendor/github.com/go-chi/chi/v5/README.md b/server/vendor/github.com/go-chi/chi/v5/README.md index e668e20..07aeaa8 100644 --- a/server/vendor/github.com/go-chi/chi/v5/README.md +++ b/server/vendor/github.com/go-chi/chi/v5/README.md @@ -465,6 +465,11 @@ is folded to plain IPv4, and IPv6 zone identifiers carried in headers are stripped, so one logical client maps to a single canonical key for logs, rate limits, and ACLs. +For `ClientIPFromXFFTrustedProxies`, `numTrustedProxies` is the total proxy +hops between client and server. Prefer `ClientIPFromXFF` with explicit CIDRs +when you can — CIDR-based trust cannot off-by-one. See the godoc for a +deployment recipe and a verify checklist. + See the per-function godoc for the full semantics of each middleware, and [adam-p's "The perils of the 'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/) for the underlying threat model. diff --git a/server/vendor/github.com/go-chi/chi/v5/tree.go b/server/vendor/github.com/go-chi/chi/v5/tree.go index 74ff43d..e7bc9ed 100644 --- a/server/vendor/github.com/go-chi/chi/v5/tree.go +++ b/server/vendor/github.com/go-chi/chi/v5/tree.go @@ -7,6 +7,7 @@ package chi import ( "fmt" "net/http" + "reflect" "regexp" "slices" "sort" @@ -478,7 +479,9 @@ func (n *node) findRoute(rctx *Context, method methodTyp, path string) *node { if endpoints == mALL || endpoints == mSTUB { continue } - rctx.methodsAllowed = append(rctx.methodsAllowed, endpoints) + if !slices.Contains(rctx.methodsAllowed, endpoints) { + rctx.methodsAllowed = append(rctx.methodsAllowed, endpoints) + } } // flag that the routing context found a route, but not a corresponding @@ -524,7 +527,9 @@ func (n *node) findRoute(rctx *Context, method methodTyp, path string) *node { if endpoints == mALL || endpoints == mSTUB { continue } - rctx.methodsAllowed = append(rctx.methodsAllowed, endpoints) + if !slices.Contains(rctx.methodsAllowed, endpoints) { + rctx.methodsAllowed = append(rctx.methodsAllowed, endpoints) + } } // flag that the routing context found a route, but not a corresponding @@ -629,8 +634,10 @@ func (n *node) routes() []Route { rts := []Route{} n.walk(func(eps endpoints, subroutes Routes) bool { - if eps[mSTUB] != nil && eps[mSTUB].handler != nil && subroutes == nil { - return false + // Hide Mount()'s stub handler, but not a real handler sharing its pattern. + var stubHandler http.Handler + if eps[mSTUB] != nil { + stubHandler = eps[mSTUB].handler } // Group methodHandlers by unique patterns @@ -650,12 +657,17 @@ func (n *node) routes() []Route { for p, mh := range pats { hs := make(map[string]http.Handler) + + // Walk() reads Handlers["*"] for With() middleware when recursing + // into a subroute, so keep it there even if it's also the stub. if mh[mALL] != nil && mh[mALL].handler != nil { - hs["*"] = mh[mALL].handler + if subroutes != nil || !equalHandlers(mh[mALL].handler, stubHandler) { + hs["*"] = mh[mALL].handler + } } for mt, h := range mh { - if h.handler == nil { + if h.handler == nil || equalHandlers(h.handler, stubHandler) { continue } if m, ok := reverseMethodMap[mt]; ok { @@ -663,6 +675,11 @@ func (n *node) routes() []Route { } } + // Keep subroute nodes so Walk() can recurse; a stub-only leaf has nothing to report. + if len(hs) == 0 && subroutes == nil { + continue + } + rt := Route{subroutes, hs, p} rts = append(rts, rt) } @@ -673,6 +690,29 @@ func (n *node) routes() []Route { return rts } +// equalHandlers reports whether a and b are the same handler value. Handlers +// are commonly funcs (e.g. http.HandlerFunc), and a direct == on those +// panics at runtime, so funcs are compared by pointer instead. +func equalHandlers(a, b http.Handler) bool { + if a == nil || b == nil { + return a == b + } + + av := reflect.ValueOf(a) + bv := reflect.ValueOf(b) + if av.Type() != bv.Type() { + return false + } + + if av.Kind() == reflect.Func { + return av.Pointer() == bv.Pointer() + } + if av.Type().Comparable() { + return a == b + } + return false +} + func (n *node) walk(fn func(eps endpoints, subroutes Routes) bool) bool { // Visit the leaf values if any if (n.endpoints != nil || n.subroutes != nil) && fn(n.endpoints, n.subroutes) { diff --git a/server/vendor/modules.txt b/server/vendor/modules.txt index a532d5d..7486c9e 100644 --- a/server/vendor/modules.txt +++ b/server/vendor/modules.txt @@ -1,4 +1,4 @@ -# github.com/go-chi/chi/v5 v5.3.1 +# github.com/go-chi/chi/v5 v5.3.2 ## explicit; go 1.23 github.com/go-chi/chi/v5 # github.com/tus/tusd/v2 v2.10.0