From 3fd236518dedcb42f4f9c1768c70c7f5c26c3d2f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 13 Nov 2026 19:20:10 +0000 Subject: [PATCH] build(deps): bump github.com/go-chi/chi/v5 from 5.4.0 to 5.5.0 Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.4.0 to 5.5.0. - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.4.0...v5.5.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 +- vendor/github.com/go-chi/chi/v5/README.md | 28 ++++++++++++- .../chi/v5/middleware/content_charset.go | 8 ++++ .../go-chi/chi/v5/middleware/deprecation.go | 40 +++++++++++++++++++ .../go-chi/chi/v5/middleware/maybe.go | 3 +- .../go-chi/chi/v5/middleware/sunset.go | 30 +++++++++----- .../chi/v5/middleware/supress_notfound.go | 2 +- .../go-chi/chi/v5/middleware/throttle.go | 14 ++++++- vendor/modules.txt | 2 +- 10 files changed, 116 insertions(+), 17 deletions(-) create mode 100644 vendor/github.com/go-chi/chi/v5/middleware/deprecation.go diff --git a/go.mod b/go.mod index d73da112e9..3e79e36b10 100644 --- a/go.mod +++ b/go.mod @@ -20,7 +20,7 @@ require ( github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e github.com/gabriel-vasile/mimetype v1.4.15 github.com/ggwhite/go-masker v1.1.0 - github.com/go-chi/chi/v5 v5.4.0 + github.com/go-chi/chi/v5 v5.5.0 github.com/go-chi/httprate v0.16.1 github.com/go-chi/render v1.0.3 github.com/go-ldap/ldap/v3 v3.4.15 diff --git a/go.sum b/go.sum index 860a093c47..a36779b138 100644 --- a/go.sum +++ b/go.sum @@ -303,8 +303,8 @@ github.com/go-asn1-ber/asn1-ber v1.3.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkPro github.com/go-asn1-ber/asn1-ber v1.4.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ= github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= -github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= -github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/httprate v0.16.1 h1:q2M8FmDsI4oEr1oRX43N+VeA0Ujd1tb/EasrSzXy87o= github.com/go-chi/httprate v0.16.1/go.mod h1:A8lo+qRhk+s9LiuP5saS7XCGDXRXMcrueq0NfIuCa/I= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= diff --git a/vendor/github.com/go-chi/chi/v5/README.md b/vendor/github.com/go-chi/chi/v5/README.md index 5f9f443567..0d8886f448 100644 --- a/vendor/github.com/go-chi/chi/v5/README.md +++ b/vendor/github.com/go-chi/chi/v5/README.md @@ -345,6 +345,7 @@ with `net/http` can be used with chi's mux. | [Compress] | Gzip compression for clients that accept compressed responses | | [ContentCharset] | Ensure charset for Content-Type request headers | | [CleanPath] | Clean double slashes from request path | +| [Deprecation] | Set the Deprecation response header (RFC 9745); see also [Sunset] | | [GetHead] | Automatically route undefined HEAD requests to GET handlers | | [Heartbeat] | Monitoring endpoint to check the servers pulse | | [Logger] | Logs the start and end of each request with the elapsed processing time | @@ -361,7 +362,7 @@ with `net/http` can be used with chi's mux. | [RouteHeaders] | Route handling for request headers | | [SetHeader] | Short-hand middleware to set a response header key/value | | [StripSlashes] | Strip slashes on routing paths | -| [Sunset] | Sunset set Deprecation/Sunset header to response | +| [Sunset] | Set the Sunset response header (RFC 8594); see also [Deprecation] | | [Throttle] | Puts a ceiling on the number of concurrent requests | | [Timeout] | Signals to the request context when the timeout deadline is reached | | [URLFormat] | Parse extension from url and put it on request context | @@ -374,6 +375,7 @@ with `net/http` can be used with chi's mux. [Compress]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#Compress [ContentCharset]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#ContentCharset [CleanPath]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#CleanPath +[Deprecation]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#Deprecation [GetHead]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#GetHead [GetReqID]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#GetReqID [Heartbeat]: https://pkg.go.dev/github.com/go-chi/chi/v5/middleware#Heartbeat @@ -474,6 +476,30 @@ See the per-function godoc for the full semantics of each middleware, and [adam-p's "The perils of the 'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/) for the underlying threat model. +### Deprecating and removing a route + +Use `Deprecation` first. Add `Sunset` when you know the removal date. + +| Situation | Use | +| :------------------------------------------------------- | :-------------------------- | +| Route works, clients should migrate, no removal date yet | `Deprecation` | +| You know the date the route will stop working | `Deprecation` + `Sunset` | +| Route is already removed | Neither. Return `410 Gone`. | + +```go +// A bad date parses to the zero time, and the middleware panics at startup. +deprecatedAt, _ := time.Parse(time.DateOnly, "2026-01-15") +sunsetAt, _ := time.Parse(time.DateOnly, "2026-07-01") + +// Step 1: the route is deprecated. +r.With(middleware.Deprecation(deprecatedAt)).Get("/v1/users", listUsers) + +// Step 2: the removal date is known. +r.With(middleware.Deprecation(deprecatedAt), middleware.Sunset(sunsetAt)).Get("/v1/users", listUsers) + +// After sunsetAt: remove the route, or return 410 Gone. +``` + ### Extra middlewares & packages Please see https://github.com/go-chi for additional packages. diff --git a/vendor/github.com/go-chi/chi/v5/middleware/content_charset.go b/vendor/github.com/go-chi/chi/v5/middleware/content_charset.go index 55773517cb..f42edcdebe 100644 --- a/vendor/github.com/go-chi/chi/v5/middleware/content_charset.go +++ b/vendor/github.com/go-chi/chi/v5/middleware/content_charset.go @@ -1,6 +1,7 @@ package middleware import ( + "mime" "net/http" "slices" "strings" @@ -9,6 +10,7 @@ import ( // ContentCharset generates a handler that writes a 415 Unsupported Media Type response if none of the charsets match. // An empty charset will allow requests with no Content-Type header or no specified charset. // Requests without a body (ContentLength == 0) are always allowed. +// Quoted charset values, such as charset="UTF-8", are accepted. func ContentCharset(charsets ...string) func(next http.Handler) http.Handler { for i, c := range charsets { charsets[i] = strings.ToLower(c) @@ -33,6 +35,12 @@ func ContentCharset(charsets ...string) func(next http.Handler) http.Handler { // Check the content encoding against a list of acceptable values. func contentEncoding(ce string, charsets ...string) bool { + _, params, err := mime.ParseMediaType(ce) + if err == nil { + return slices.Contains(charsets, strings.ToLower(params["charset"])) + } + + // Keep the previous lenient handling when the header is not a valid media type. _, ce = split(strings.ToLower(ce), ";") _, ce = split(ce, "charset=") ce, _ = split(ce, ";") diff --git a/vendor/github.com/go-chi/chi/v5/middleware/deprecation.go b/vendor/github.com/go-chi/chi/v5/middleware/deprecation.go new file mode 100644 index 0000000000..649e1ddbd9 --- /dev/null +++ b/vendor/github.com/go-chi/chi/v5/middleware/deprecation.go @@ -0,0 +1,40 @@ +package middleware + +import ( + "net/http" + "strconv" + "time" +) + +// Deprecation marks a route as deprecated, per RFC 9745. +// https://www.rfc-editor.org/rfc/rfc9745.html +// +// Use it from the day you decide to retire a route. The route keeps working, +// and clients are told to migrate. When you know the removal date, add [Sunset]. +// Middleware order doesn't matter. +// +// deprecatedAt is when the route was, or will be, deprecated. A past date is fine. +// It panics if deprecatedAt is the zero time, which is usually an unset value. +// Pass a real date, or skip the middleware when no date is set. +// +// Each link is added as-is as a Link header, so it must be a full RFC 8288 +// value, e.g. `; rel="deprecation"`. +func Deprecation(deprecatedAt time.Time, links ...string) func(http.Handler) http.Handler { + if deprecatedAt.IsZero() { + panic("middleware.Deprecation: deprecatedAt must not be zero") + } + + // RFC 9745 uses a Structured Field Date (RFC 9651), not an HTTP-date. + value := "@" + strconv.FormatInt(deprecatedAt.Unix(), 10) + + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Deprecation", value) + + for _, link := range links { + w.Header().Add("Link", link) + } + next.ServeHTTP(w, r) + }) + } +} diff --git a/vendor/github.com/go-chi/chi/v5/middleware/maybe.go b/vendor/github.com/go-chi/chi/v5/middleware/maybe.go index eabca005a6..cce4cbb34d 100644 --- a/vendor/github.com/go-chi/chi/v5/middleware/maybe.go +++ b/vendor/github.com/go-chi/chi/v5/middleware/maybe.go @@ -7,9 +7,10 @@ import "net/http" // a request does not satisfy the maybeFn logic. func Maybe(mw func(http.Handler) http.Handler, maybeFn func(r *http.Request) bool) func(http.Handler) http.Handler { return func(next http.Handler) http.Handler { + wrapped := mw(next) return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if maybeFn(r) { - mw(next).ServeHTTP(w, r) + wrapped.ServeHTTP(w, r) } else { next.ServeHTTP(w, r) } diff --git a/vendor/github.com/go-chi/chi/v5/middleware/sunset.go b/vendor/github.com/go-chi/chi/v5/middleware/sunset.go index 18815d585d..e28279b39e 100644 --- a/vendor/github.com/go-chi/chi/v5/middleware/sunset.go +++ b/vendor/github.com/go-chi/chi/v5/middleware/sunset.go @@ -5,19 +5,31 @@ import ( "time" ) -// Sunset set Deprecation/Sunset header to response -// This can be used to enable Sunset in a route or a route group -// For more: https://www.rfc-editor.org/rfc/rfc8594.html +// Sunset announces when a route will stop working, per RFC 8594. +// https://www.rfc-editor.org/rfc/rfc8594.html +// +// Use it once you know the removal date, and keep [Deprecation] on the same +// route. Sunset alone is valid, but clients get no "stop using this" signal. +// Middleware order doesn't matter. +// +// sunsetAt is usually a future date, and should not be before the deprecation date. +// After it, remove the route or return 410 Gone. +// It panics if sunsetAt is the zero time, which is usually an unset value. +// Pass a real date, or skip the middleware when no date is set. +// +// Each link is added as-is as a Link header, so it must be a full RFC 8288 +// value, e.g. `; rel="sunset"`. func Sunset(sunsetAt time.Time, links ...string) func(http.Handler) http.Handler { + if sunsetAt.IsZero() { + panic("middleware.Sunset: sunsetAt must not be zero") + } + return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if !sunsetAt.IsZero() { - w.Header().Set("Sunset", sunsetAt.Format(http.TimeFormat)) - w.Header().Set("Deprecation", sunsetAt.Format(http.TimeFormat)) + w.Header().Set("Sunset", sunsetAt.UTC().Format(http.TimeFormat)) - for _, link := range links { - w.Header().Add("Link", link) - } + for _, link := range links { + w.Header().Add("Link", link) } next.ServeHTTP(w, r) }) diff --git a/vendor/github.com/go-chi/chi/v5/middleware/supress_notfound.go b/vendor/github.com/go-chi/chi/v5/middleware/supress_notfound.go index 83a8a87215..bb9b7ddfa8 100644 --- a/vendor/github.com/go-chi/chi/v5/middleware/supress_notfound.go +++ b/vendor/github.com/go-chi/chi/v5/middleware/supress_notfound.go @@ -16,7 +16,7 @@ func SupressNotFound(router *chi.Mux) func(next http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { rctx := chi.RouteContext(r.Context()) - match := rctx.Routes.Match(rctx, r.Method, r.URL.Path) + match := rctx.Routes.Match(chi.NewRouteContext(), r.Method, r.URL.Path) if !match { router.NotFoundHandler().ServeHTTP(w, r) return diff --git a/vendor/github.com/go-chi/chi/v5/middleware/throttle.go b/vendor/github.com/go-chi/chi/v5/middleware/throttle.go index 7ea482b91d..22c5595f7b 100644 --- a/vendor/github.com/go-chi/chi/v5/middleware/throttle.go +++ b/vendor/github.com/go-chi/chi/v5/middleware/throttle.go @@ -18,6 +18,9 @@ var ( // ThrottleOpts represents a set of throttling options. type ThrottleOpts struct { + // RetryAfterFn, if set, enables the Retry-After header on rejected requests. + // The result is rounded up to whole seconds and clamped at 0, because the + // header carries a non-negative integer (RFC 9110 section 10.2.3). RetryAfterFn func(ctxDone bool) time.Duration Limit int BacklogLimit int @@ -147,5 +150,14 @@ func (t throttler) setRetryAfterHeaderIfNeeded(w http.ResponseWriter, ctxDone bo if t.retryAfterFn == nil { return } - w.Header().Set("Retry-After", strconv.Itoa(int(t.retryAfterFn(ctxDone).Seconds()))) + // delay-seconds is non-negative, and rounding up avoids asking clients to + // retry before the duration returned by RetryAfterFn has elapsed. + delay := t.retryAfterFn(ctxDone) + seconds := delay / time.Second + if delay < 0 { + seconds = 0 + } else if delay%time.Second != 0 { + seconds++ + } + w.Header().Set("Retry-After", strconv.FormatInt(int64(seconds), 10)) } diff --git a/vendor/modules.txt b/vendor/modules.txt index 959a910c24..f1b3ec8e33 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -455,7 +455,7 @@ github.com/go-acme/lego/v5/challenge # github.com/go-asn1-ber/asn1-ber v1.5.8 ## explicit; go 1.13 github.com/go-asn1-ber/asn1-ber -# github.com/go-chi/chi/v5 v5.4.0 +# github.com/go-chi/chi/v5 v5.5.0 ## explicit; go 1.24 github.com/go-chi/chi/v5 github.com/go-chi/chi/v5/middleware