Skip to content

fix(deps): update go modules (minor/patch)#32

Merged
alexlovelltroy merged 1 commit into
mainfrom
renovate/go-modules-(minorpatch)
Jul 23, 2026
Merged

fix(deps): update go modules (minor/patch)#32
alexlovelltroy merged 1 commit into
mainfrom
renovate/go-modules-(minorpatch)

Conversation

@renovate

@renovate renovate Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/getkin/kin-openapi v0.133.0 → v0.142.0 age confidence
github.com/go-chi/chi/v5 v5.2.4 → v5.3.1 age confidence
github.com/golang-jwt/jwt/v5 v5.3.0 → v5.3.1 age confidence
github.com/openchami/tokensmith v0.4.0 → v0.4.1 age confidence
github.com/prometheus/client_golang v1.23.2 → v1.24.0 age confidence
github.com/rs/zerolog v1.34.0 → v1.35.1 age confidence

Release Notes

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.142.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.141.0...v0.142.0

v0.141.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.140.0...v0.141.0

v0.140.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.139.0...v0.140.0

v0.139.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.138.0...v0.139.0

v0.138.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.137.0...v0.138.0

v0.137.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.136.0...v0.137.0

v0.136.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.135.0...v0.136.0

v0.135.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.134.0...v0.135.0

v0.134.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.133.0...v0.134.0

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.1

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

PR #​967 introduced middleware.ClientIP, a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

v5.2.5

Compare Source

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.2.3...v5.2.5

golang-jwt/jwt (github.com/golang-jwt/jwt/v5)

v5.3.1

Compare Source

What's Changed

🔐 Features
👒 Dependencies

New Contributors

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

openchami/tokensmith (github.com/openchami/tokensmith)

v0.4.1

Compare Source

Changelog

prometheus/client_golang (github.com/prometheus/client_golang)

v1.24.0: - 2026-07-20

Compare Source

Changes
  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #​1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #​2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #​1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #​1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #​1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #​1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #​1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #​1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #​1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #​1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #​1846, #​1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #​1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #​1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #​1888, #​1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #​1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #​1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #​1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #​1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #​2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #​2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #​1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #​1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #​1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #​1927
All commits

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Denver)

  • Branch creation
    • "before 5am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file renovate labels Jul 22, 2026
@renovate

renovate Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 8 additional dependencies were updated

Details:

Package Change
github.com/go-openapi/jsonpointer v0.21.0 -> v0.22.5
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 -> v0.1.1
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 -> v0.0.14
github.com/prometheus/common v0.66.1 -> v0.70.0
github.com/prometheus/procfs v0.16.1 -> v0.21.1
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.4
golang.org/x/sys v0.46.0 -> v0.47.0
google.golang.org/protobuf v1.36.8 -> v1.36.11

@renovate
renovate Bot force-pushed the renovate/go-modules-(minorpatch) branch 2 times, most recently from 48df511 to cdd5e99 Compare July 23, 2026 12:50
@renovate
renovate Bot force-pushed the renovate/go-modules-(minorpatch) branch from cdd5e99 to 69ed85e Compare July 23, 2026 13:03
@alexlovelltroy
alexlovelltroy merged commit 496df55 into main Jul 23, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alexlovelltroy