From 9ef81c7725f8d7834f0cee51bbbd2f642cf850fd Mon Sep 17 00:00:00 2001 From: Tomas Grasl Date: Sun, 25 Oct 2026 08:31:20 +0100 Subject: [PATCH 1/2] chore(deps): bump go-chi/chi to v5.4.0 Clears GHSA-j6qf-3m9c-vwj3. CodeForge does not use the affected ClientIPFromXFF helper (only middleware.RealIP), so this is hygiene, not a security fix. Co-Authored-By: Claude Opus 5.5 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e512894..0e31428 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/freema/codeforge go 1.25.0 require ( - github.com/go-chi/chi/v5 v5.2.5 + github.com/go-chi/chi/v5 v5.4.0 github.com/go-playground/validator/v10 v10.30.1 github.com/google/uuid v1.6.0 github.com/knadh/koanf/parsers/yaml v1.1.0 diff --git a/go.sum b/go.sum index 353aaf7..2d85cf5 100644 --- a/go.sum +++ b/go.sum @@ -20,8 +20,8 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw= github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s= -github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug= -github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0= +github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= +github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From eee56118ad57b332de02d1e7df24742258eacf3f Mon Sep 17 00:00:00 2001 From: Tomas Grasl Date: Sun, 25 Oct 2026 08:33:30 +0100 Subject: [PATCH 2/2] fix(server): drop chi RealIP middleware chi v5.4.0 deprecates RealIP: it rewrites r.RemoteAddr from X-Forwarded-For / X-Real-IP / True-Client-IP without checking that the request came through a trusted proxy. Nothing in CodeForge reads the client IP (rate limiting is keyed by API token), so the middleware only let clients spoof RemoteAddr. Removing it instead of configuring a trusted-proxy list. Co-Authored-By: Claude Opus 5.5 --- internal/server/server.go | 1 - 1 file changed, 1 deletion(-) diff --git a/internal/server/server.go b/internal/server/server.go index 4760b1c..170aa75 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -41,7 +41,6 @@ func New(cfg *config.Config, redis *redisclient.Client, sqliteDB *database.DB, s // Global middleware (timeout applied per-route-group, not globally, for SSE support) r.Use(chimw.RequestID) - r.Use(chimw.RealIP) r.Use(middleware.RequestLogger) r.Use(middleware.PrometheusMetrics) r.Use(chimw.Recoverer)