GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: bump go-chi/chi/v5 to v5.5.0 (backport 2.38) by coder[bot] · Pull Request #31501 · coder/coder

Conversation

@coder

@coder coder Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/go-chi/chi/v5 from v5.3.1 to v5.5.0 on release/2.38, matching main and release/2.39 (9ddbf27, #31050). This clears CVE-2026-114437 / GHSA-j6qf-3m9c-vwj3 (client-IP spoofing in middleware.ClientIPFromXFF, fixed in 5.4.0), which the IronBank VAT scan of coder-service-2:2.38.4 flags (Medium) in /opt/coder.

Coder is not vulnerable: it never uses chi's client-IP middleware and resolves client IPs itself in coderd/httpmw/realip.go. This is scan hygiene. The only chi middleware used on this branch is NewCompressor and StripPrefix (SCIM), so the 5.4+ changes to compress.go, mux.go and tree.go were checked with the compressor and routing tests.

Only go.mod/go.sum change; go mod tidy changed no other modules. Verified: go build ./... succeeds and go test ./coderd/cachecompress/... ./coderd/httpmw/... ./coderd/httpapi/... ./site/... passes. Local git hooks were skipped; CI is the gate.

Part of ENT-239 (parent ENT-230). Backported to every supported release line, like the other ENT-230 fixes.

Opened by Superblink on behalf of @droopy4096.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@coder
fix: bump go-chi/chi/v5 to v5.5.0 (backport 2.38)
3286f90
@coder coder Bot assigned droopy4096 Oct 29, 2026
@linear-code

linear-code Bot commented Oct 29, 2026

Copy link
Copy Markdown

ENT-239
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot added the community Pull Requests and issues created by the community. label Oct 29, 2026
@coder
coder Bot requested review from Shelnutt2, denisra, jdomeracki-coder and zenithwolf1000 October 29, 2026 17:20
denisra
denisra approved these changes Nov 2, 2026
View reviewed changes
@denisra
denisra merged commit c2f9967 into release/2.38 Nov 2, 2026
50 of 51 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@denisra
denisra deleted the superblink/ent-239-chi-550-release-238 branch November 2, 2026 17:54
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@denisra denisra denisra approved these changes
@Shelnutt2 Shelnutt2 Awaiting requested review from Shelnutt2
@zenithwolf1000 zenithwolf1000 Awaiting requested review from zenithwolf1000
@jdomeracki-coder jdomeracki-coder Awaiting requested review from jdomeracki-coder

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@droopy4096 droopy4096

Labels

community Pull Requests and issues created by the community.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@denisra @droopy4096
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.