fix(deps): remove vulnerable chi v4 middleware dependency - #2651
Open
Quang Nguyen (nddq) with Copilot wants to merge 2 commits into
Open
fix(deps): remove vulnerable chi v4 middleware dependency#2651Quang Nguyen (nddq) with Copilot wants to merge 2 commits into
Quang Nguyen (nddq) with Copilot wants to merge 2 commits into
Conversation
Co-authored-by: nddq <28567936+nddq@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix code scanning alert #808
Remove vulnerable legacy chi middleware dependency
Aug 13, 2026
Quang Nguyen (nddq)
changed the title
Quang Nguyen (nddq)
marked this pull request as ready for review
August 14, 2026 03:23
Quang Nguyen (nddq)
approved these changes
Aug 14, 2026
Quang Nguyen (nddq)
enabled auto-merge
August 14, 2026 03:25
Retina Code Coverage ReportTotal coverage no change |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
pkg/serverandpkg/logimported the chi v4middlewarepackage whilego.modalready requireschi/v5for the router — a mixed-version leftover. The v4 line carriesGO-2026-4316(open redirect inRedirectSlashes) with no fixed v4 release, and govulncheck flags it as reachable.This migrates both imports to
github.com/go-chi/chi/v5/middlewareand drops the v4 module fromgo.mod/go.sum. The v5middlewareAPI is drop-in for everything used.Related Issue
Code-scanning alert 808 (govulncheck,
GO-2026-4316), raised by the scanner added in #2643.Checklist
git commit -S -s ...). See this documentation on signing commits.Screenshots (if applicable) or Testing Completed
Verified on the PR head: no
go-chi/chiv4 reference remains anywhere in the repo, andgo buildandgo vetpass forpkg/serverandpkg/log. govulncheck at the builder toolchain (go1.26.5) confirmsGO-2026-4316no longer appears.Additional Notes
The govulncheck legs on this PR will still be red with 11 findings — that is unrelated to this change. Go 1.26.6 shipped stdlib security fixes on 2026-08-13 and the builder images are on
1.26.5, so seven new stdlib findings apply repo-wide until thegolang-baseimage bump. This PR's delta is exactly the removal ofGO-2026-4316.