chore(deps): update security updates [security] by NumaryBot · Pull Request #167 · formancehq/fctl

NumaryBot · 2026-07-22T03:07:17Z

This PR contains the following updates:

Package	Type	Update	Change
github.com/go-chi/chi/v5	indirect	minor	`v5.2.5` -> `v5.3.0`
golang.org/x/text	indirect	minor	`v0.37.0` -> `v0.39.0`

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

GHSA-3fxj-6jh8-hvhx / GO-2026-5774

More information

Details

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

GHSA-rjr7-jggh-pgcp / GO-2026-5777

More information

Details

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

GHSA-9g5q-2w5x-hmxf / GO-2026-5775

More information

Details

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Infinite loop on invalid input in golang.org/x/text

CVE-2026-56852 / GO-2026-5970

More information

Details

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

`v5.3.0`

Compare Source

What's Changed

Use strings.ReplaceAll where applicable by @JRaspass in https://github.com/go-chi/chi/pull/1046
Propagate inline middlewares across mounted subrouters by @LukasJenicek in https://github.com/go-chi/chi/pull/1049
add go 1.26 to ci by @pkieltyka in https://github.com/go-chi/chi/pull/1052
Remove last uses of io/ioutil by @JRaspass in https://github.com/go-chi/chi/pull/1054
Simplify chi.walk with slices.Concat by @JRaspass in https://github.com/go-chi/chi/pull/1053
Apply the stringscutprefix modernizer by @JRaspass in https://github.com/go-chi/chi/pull/1051
Bump minimum Go to 1.23, always use request.Pattern by @JRaspass in https://github.com/go-chi/chi/pull/1048
middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @alliasgher in https://github.com/go-chi/chi/pull/1085
Fix typo in Route doc comment by @gouwazi in https://github.com/go-chi/chi/pull/1073
fix: set Request.Pattern from RoutePattern() by @leno23 in https://github.com/go-chi/chi/pull/1097
feat: middleware.ClientIP, a replacement for middleware.RealIP by @VojtechVitek in https://github.com/go-chi/chi/pull/967

New Contributors

@LukasJenicek made their first contribution in https://github.com/go-chi/chi/pull/1049
@alliasgher made their first contribution in https://github.com/go-chi/chi/pull/1085
@gouwazi made their first contribution in https://github.com/go-chi/chi/pull/1073
@leno23 made their first contribution in https://github.com/go-chi/chi/pull/1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)
GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)
GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @adam-p, @c2h5oh, @rezmoss, @Saku0512, @convto, @Dirbaio, @jawnsy, @lrstanley, @mfridman, @n33pm, @pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

NumaryBot · 2026-07-22T03:07:19Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/mod`	`v0.35.0` -> `v0.37.0`
`golang.org/x/sync`	`v0.20.0` -> `v0.21.0`

coderabbitai · 2026-07-22T03:07:28Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

go.mod is excluded by !**/*.mod
go.sum is excluded by !**/*.sum, !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e9496206-3230-4a50-ad4e-0580503715b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/security

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

NumaryBot · 2026-07-22T03:07:40Z

✅ Approve — automated review

This PR updates golang.org/x/text to v0.39.0 (security fix) along with transitive bumps to golang.org/x/mod and golang.org/x/sync triggered by the go get command. Changes are confined to go.mod and go.sum. All reviewers agree there are no correctness, compatibility, or maintainability issues introduced by these updates.

No findings.

NumaryBot added the security label Jul 22, 2026

NumaryBot requested a review from a team July 22, 2026 03:07

NumaryBot enabled auto-merge (squash) July 22, 2026 03:07

NumaryBot added the security label Jul 22, 2026

flemzord approved these changes Jul 22, 2026

View reviewed changes

flemzord previously approved these changes Jul 23, 2026

View reviewed changes

chore(deps): update security updates [security]

f593d89

NumaryBot dismissed flemzord’s stale review via f593d89 July 25, 2026 03:09

NumaryBot force-pushed the renovate/security branch from cf3bb9f to f593d89 Compare July 25, 2026 03:09

NumaryBot requested a review from a team as a code owner July 25, 2026 03:09

NumaryBot changed the title ~~chore(deps): update module golang.org/x/text to v0.39.0 [security]~~ chore(deps): update security updates [security] Jul 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update security updates [security]#167

chore(deps): update security updates [security]#167
NumaryBot wants to merge 1 commit into
mainfrom
renovate/security

NumaryBot commented Jul 22, 2026 •

edited

Loading

Uh oh!

NumaryBot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Review skipped

Uh oh!

NumaryBot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

NumaryBot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Details

Severity

References

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Details

Severity

References

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Details

Severity

References

Infinite loop on invalid input in golang.org/x/text

Details

Severity

References

Release Notes

v5.3.0

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

Why a new middleware (not "fix RealIP in place")

The new API

Example usage:

Configuration

Uh oh!

NumaryBot commented Jul 22, 2026

ℹ Artifact update notice

File name: go.mod

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

NumaryBot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Approve — automated review

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

NumaryBot commented Jul 22, 2026 •

edited

Loading

`v5.3.0`

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

NumaryBot commented Jul 22, 2026 •

edited

Loading