fix: bump github.com/go-chi/chi/v5 v5.2.4 to v5.3.1

[Copilot]

Summary

Backport go-chi/chi v5.2.4 to v5.3.1 on release/2.35, aligning with the upgrade already merged on main via #27051.

Security Advisories Addressed

chi v5.3.0 and v5.3.1 resolve the following advisories:

Advisory	Description	Severity
GHSA-9g5q-2w5x-hmxf	IP spoofing via XFF in RemoteAddr resolution	—
GHSA-rjr7-jggh-pgcp	RealIP allows IP spoofing via unvalidated XFF	—
GHSA-3fxj-6jh8-hvhx	IP spoofing in middleware.RealIP	Critical (9.3)
GHSA-mqqf-5wvp-8fh8	Open redirect in RedirectSlashes (CVE-2025-69725)	—
GHSA-vrw8-fxc6-2r93	Host Header Injection in RedirectSlashes	—

Impact Assessment

Coder does not use the directly affected middleware:

• middleware.RealIP — Coder uses its own httpmw.ExtractRealIP
• StripSlashes / RedirectSlashes / CleanPath — Coder uses its own singleSlashMW

The primary motivation for this backport is keeping release/2.35 aligned with main to prevent dependency drift and to satisfy IronBank scanning requirements.

Changes

• go.mod / go.sum: bump github.com/go-chi/chi/v5 v5.2.4 to v5.3.1

Related

• chore: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 #27051 — original Dependabot upgrade on main
• fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.34) #27148 — same backport on release/2.34

[linear-code]

ENT-132

[github-actions]

👋 Hey @Copilot!

This PR is targeting the release/2.35 release branch, but its title does not start with fix: or fix(scope):.

Only bug fixes should be cherry-picked to release branches. If this is a bug fix, please update the PR title to match the conventional commit format:

fix: description of the bug fix
fix(scope): description of the bug fix

If this is not a bug fix, it likely should not target a release branch.

[denisra]

LGTM

[denisra]

/coder-agents-review

[coder-agents-review]

Chat: Review posted | View chat
Requested: 2026-07-13 13:21 UTC by @denisra
Spend: $9.78 / $100.00

Review history

• R1 (2026-07-13): 8 reviewers, 1 Note, 1 P1, REQUEST_CHANGES. Review

deep-review v0.9.0 | Round 1 | 404826a..cfe7434

Last posted: Round 1, 2 findings (1 P1, 1 Note), REQUEST_CHANGES. Review

Finding inventory

Finding inventory - PR #27147

Findings

#	Sev	Status	Location	Summary	Round	Reviewer	Posted
CRF-1	P1	Open	go.mod:172	Cited CVE/GHSA IDs do not match any real go-chi/chi advisory; security justification is fabricated	R1	Mafu-san P1, Mafuuu P2, Razor P2, Hisoka Note, Pariston Note	Yes
CRF-2	Note	Open	go.mod:172	Coder uses its own realip/slash middleware; the affected chi middleware is unused, so the bump is hygiene, not an active-exposure fix	R1	Mafuuu, Pariston, Razor	Yes
CRF-3	Nit	Open	PR description	Three emdashes (U+2014) in the CVE bullets violate AGENTS.md no-emdash rule	R1	Leorio	Body
CRF-4	Nit	Open	commit cfe7434	Commit subject chore(go.mod): uses wrong type (release cherry-pick policy wants fix:) and a scope that excludes go.sum	R1	Mafu-san, Leorio	Body
CRF-5	P2	Dropped by orchestrator (verified stale)	title CI check	title CI check reported failing / blocking merge	R1	Netero P2, Mafu-san P2	No

Contested and acknowledged

(none this round)

Drop/downgrade log

CRF-5 (was P2, title CI check)

• Keep-at-P2 argument (written first): If the required title check were genuinely failing, this security backport would be blocked from merging, delaying a security-relevant dependency bump on a release branch.
• Drop reason (verified): The live statusCheckRollup shows the title check as SUCCESS on the four most recent runs against the same head SHA (cfe7434), and the PR is MERGEABLE. The recorded failure (job 86318944960, 08:22Z) is a superseded early run; the check re-ran at 08:33Z and passed after the PR title was changed to a scopeless fix:. The current PR title fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1 (backport 2.35) parses as type fix, no scope, which the validator accepts (.github/workflows/contrib.yaml). Netero and Mafu-san conflated the commit subject (chore(go.mod): ...) with the PR title; the title check validates the PR title, not the commit subject. No merge blocker exists. The residual commit-subject convention issue is captured as CRF-4 (Nit).

Law analysis

Not run (effective additions = 1, far below the 1000 threshold).

Round log

Round 1

Netero first pass + panel (Bisky, Hisoka, Mafu-san, Mafuuu, Pariston, Gon, Leorio + Razor wildcard). Reviewed against 404826a..cfe7434.
Pure dependency bump of go-chi/chi/v5 v5.2.4 -> v5.3.1 (go.mod/go.sum only, effective +1 -1), a backport of PR #27051 to release/2.35.
Five reviewers independently converged on the fabricated-CVE finding (CRF-1); verified against upstream chi advisories via web search (real advisories are the RealIP spoofing set and the RedirectSlashes open redirect; none of the cited IDs exist for chi). Event: REQUEST_CHANGES.
CRF-3 and CRF-4 raised in the review body (no diff-line anchor). CRF-5 (title check) dropped as a verified-stale CI signal.

About deep-review

CRF = Coder Review Finding (P0-P4, Nit, Note)

Reviewer	Focus
Bisky	tests
Chopper	ops/errors
Churn-guard	change verification
Ging	language modernization
Gon	naming
Hisoka	edge cases
Killua	perf
Kite	change integrity
Knov	contracts
Knuckle	SQL
Komugi	flake/determinism
Kurapika	security
Law	decomposition
Leorio	docs
Luffy	product
Mafu-san	process
Mafuuu	contracts
Melody	dispatch/pairing
Meruem	structural
Nami	frontend
Netero	mechanical checks
Pariston	premise testing
Pen-botter	product gaps
Razor	verification
Robin	duplication
Ryosuke	Go arch
Takumi	concurrency
Zoro	shape

🤖 Managed by Coder Agents.

[coder-agents-review]

This is a clean, minimal dependency bump: go.mod/go.sum only, go mod tidy and go mod verify both pass, no scope creep, and the PR body cites the source commit (PR #27051) and the Linear issue. The mechanics are sound and the upgrade itself is worth taking.

The problem is the justification, not the change. Severity this round: 1 P1 and 1 Note inline, plus 2 Nits in this body.

The three CVE/GHSA identifiers cited as the reason for this security backport do not correspond to any real go-chi/chi advisory (CRF-1). Five reviewers reached this independently, and I verified it against chi's upstream advisories and release notes: the real advisories in this version range are the RealIP IP-spoofing set (GHSA-3fxj-6jh8-hvhx, GHSA-rjr7-jggh-pgcp, GHSA-9g5q-2w5x-hmxf, fixed in v5.3.0) and the RedirectSlashes open redirect (CVE-2025-69725 / GHSA-mqqf-5wvp-8fh8 / GHSA-vrw8-fxc6-2r93). Chi has no "path traversal via StripSlashes" advisory and no "unbounded URL path DoS" advisory, and the cited IDs appear nowhere in chi's advisory list. As Hisoka put it: "I fought the diff for the three CVEs it claims to fix. None of them landed." This is a security-tracked backport to release/2.35, so the CVE list becomes the permanent security provenance for that release. Correct it (cite the advisories v5.3.1 actually carries, or describe the change as routine dependency hygiene) before merge.

On the red title check: it is a stale, superseded run. The check passed on the latest run against this same head SHA and the PR is currently mergeable; the scopeless fix: title is valid. No action needed there.

Two minor items, raised here rather than inline because they are not diff-line issues:

• Nit [CRF-3]: the PR description uses three emdashes (U+2014) in the CVE bullets, which AGENTS.md bans in human-facing writing. The commit body already uses - for the same lines; match it.
• Nit [CRF-4]: the commit subject chore(go.mod): upgrade ... uses chore while the release cherry-pick policy (.github/workflows/pr-cherry-pick-check.yaml) expects fix: for release/* targets, and the go.mod scope excludes go.sum. Squash-merge takes the PR title so it never lands, but the two records disagree; align the subject to fix: bump github.com/go-chi/chi/v5 from 5.2.4 to 5.3.1.

🤖 This review was automatically generated with Coder Agents.