Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in #1110
Tidy build directives by @JRaspass in #1113
feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in #1127
Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in #1050
middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in #1131
feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in #1132
ci: pin GitHub Actions to full commit SHAs by @XananasX7 in #1116

New Contributors

@DucMinhNe made their first contribution in #1110
@doganarif made their first contribution in #1050
@XananasX7 made their first contribution in #1116

Full Changelog: https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1

`v5.3.0`

Compare Source

What's Changed

Use strings.ReplaceAll where applicable by @JRaspass in #1046
Propagate inline middlewares across mounted subrouters by @LukasJenicek in #1049
add go 1.26 to ci by @pkieltyka in #1052
Remove last uses of io/ioutil by @JRaspass in #1054
Simplify chi.walk with slices.Concat by @JRaspass in #1053
Apply the stringscutprefix modernizer by @JRaspass in #1051
Bump minimum Go to 1.23, always use request.Pattern by @JRaspass in #1048
middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @alliasgher in #1085
Fix typo in Route doc comment by @gouwazi in #1073
fix: set Request.Pattern from RoutePattern() by @leno23 in #1097
feat: middleware.ClientIP, a replacement for middleware.RealIP by @VojtechVitek in #967

New Contributors

@LukasJenicek made their first contribution in #1049
@alliasgher made their first contribution in #1085
@gouwazi made their first contribution in #1073
@leno23 made their first contribution in #1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)
GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)
GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @adam-p, @c2h5oh, @rezmoss, @Saku0512, @convto, @Dirbaio, @jawnsy, @lrstanley, @mfridman, @n33pm, @pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | require | minor | `v5.2.5` → `v5.3.1` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>go-chi/chi (github.com/go-chi/chi/v5)</summary> ### [`v5.3.1`](https://github.com/go-chi/chi/releases/tag/v5.3.1) [Compare Source](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1) #### What's Changed - Honor Discard() in httpFancyWriter.ReadFrom by [@DucMinhNe](https://github.com/DucMinhNe) in [#1110](https://github.com/go-chi/chi/pull/1110) - Tidy build directives by [@JRaspass](https://github.com/JRaspass) in [#1113](https://github.com/go-chi/chi/pull/1113) - feat(middleware): add text/xml and application/xml to default compressible types by [@VojtechVitek](https://github.com/VojtechVitek) in [#1127](https://github.com/go-chi/chi/pull/1127) - Fix defaultLogEntry.Panic not respecting NoColor setting by [@doganarif](https://github.com/doganarif) in [#1050](https://github.com/go-chi/chi/pull/1050) - middleware: document printPrettyStack and harden NoColor panic test by [@VojtechVitek](https://github.com/VojtechVitek) in [#1131](https://github.com/go-chi/chi/pull/1131) - feat(mux): support http QUERY method ietf rfc10008 by [@VojtechVitek](https://github.com/VojtechVitek) in [#1132](https://github.com/go-chi/chi/pull/1132) - ci: pin GitHub Actions to full commit SHAs by [@XananasX7](https://github.com/XananasX7) in [#1116](https://github.com/go-chi/chi/pull/1116) #### New Contributors - [@DucMinhNe](https://github.com/DucMinhNe) made their first contribution in [#1110](https://github.com/go-chi/chi/pull/1110) - [@doganarif](https://github.com/doganarif) made their first contribution in [#1050](https://github.com/go-chi/chi/pull/1050) - [@XananasX7](https://github.com/XananasX7) made their first contribution in [#1116](https://github.com/go-chi/chi/pull/1116) **Full Changelog**: <https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1> ### [`v5.3.0`](https://github.com/go-chi/chi/releases/tag/v5.3.0) [Compare Source](https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0) #### What's Changed - Use strings.ReplaceAll where applicable by [@JRaspass](https://github.com/JRaspass) in [#1046](https://github.com/go-chi/chi/pull/1046) - Propagate inline middlewares across mounted subrouters by [@LukasJenicek](https://github.com/LukasJenicek) in [#1049](https://github.com/go-chi/chi/pull/1049) - add go 1.26 to ci by [@pkieltyka](https://github.com/pkieltyka) in [#1052](https://github.com/go-chi/chi/pull/1052) - Remove last uses of io/ioutil by [@JRaspass](https://github.com/JRaspass) in [#1054](https://github.com/go-chi/chi/pull/1054) - Simplify chi.walk with slices.Concat by [@JRaspass](https://github.com/JRaspass) in [#1053](https://github.com/go-chi/chi/pull/1053) - Apply the stringscutprefix modernizer by [@JRaspass](https://github.com/JRaspass) in [#1051](https://github.com/go-chi/chi/pull/1051) - Bump minimum Go to 1.23, always use request.Pattern by [@JRaspass](https://github.com/JRaspass) in [#1048](https://github.com/go-chi/chi/pull/1048) - middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by [@alliasgher](https://github.com/alliasgher) in [#1085](https://github.com/go-chi/chi/pull/1085) - Fix typo in Route doc comment by [@gouwazi](https://github.com/gouwazi) in [#1073](https://github.com/go-chi/chi/pull/1073) - fix: set Request.Pattern from RoutePattern() by [@leno23](https://github.com/leno23) in [#1097](https://github.com/go-chi/chi/pull/1097) - feat: middleware.ClientIP, a replacement for middleware.RealIP by [@VojtechVitek](https://github.com/VojtechVitek) in [#967](https://github.com/go-chi/chi/pull/967) #### New Contributors - [@LukasJenicek](https://github.com/LukasJenicek) made their first contribution in [#1049](https://github.com/go-chi/chi/pull/1049) - [@alliasgher](https://github.com/alliasgher) made their first contribution in [#1085](https://github.com/go-chi/chi/pull/1085) - [@gouwazi](https://github.com/gouwazi) made their first contribution in [#1073](https://github.com/go-chi/chi/pull/1073) - [@leno23](https://github.com/leno23) made their first contribution in [#1097](https://github.com/go-chi/chi/pull/1097) #### SECURITY: middleware.ClientIP, a replacement for middleware.RealIP [@VojtechVitek](https://github.com/VojtechVitek) submitted PR [#967](https://github.com/go-chi/chi/issues/967), which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories: - [GHSA-9g5q-2w5x-hmxf](https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf) — IP spoofing via XFF in `RemoteAddr` resolution (convto) - [GHSA-rjr7-jggh-pgcp](https://github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp) — RealIP allows IP spoofing via unvalidated XFF (rezmoss) - [GHSA-3fxj-6jh8-hvhx](https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx) — IP spoofing in `middleware.RealIP` (Saku0512, Critical / 9.3) It also addresses issues outlined at: - [#708](https://github.com/go-chi/chi/issues/708) - <https://adam-p.ca/blog/2022/03/x-forwarded-for/> - [#711](https://github.com/go-chi/chi/issues/711) - [#453](https://github.com/go-chi/chi/issues/453) - [#908](https://github.com/go-chi/chi/pull/908) `middleware.RealIP` is deprecated in this PR with pointers to the new API. The deprecation only adds a `// Deprecated:` doc comment; the function keeps working for backward compatibility. ##### Why a new middleware (not "fix RealIP in place") `RealIP` has two unfixable design choices: it mutates `r.RemoteAddr`, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per [adam-p's "The perils of the 'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/) (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly. ##### The new API Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors: ```go // One of the four. There is no safe default — pick exactly one. func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler func ClientIPFromRemoteAddr(h http.Handler) http.Handler // Read the result. func GetClientIP(ctx context.Context) string // for logs, rate-limit keys func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work ``` #### Example usage: ```go // Pick a single ClientIP middleware based on your deployment // Cloudflare. r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP")) // Nginx with ngx_http_realip_module. r.Use(middleware.ClientIPFromHeader("X-Real-IP")) // Apache with mod_remoteip. r.Use(middleware.ClientIPFromHeader("X-Client-IP")) // AWS CloudFront, or any proxy fleet with known CIDRs. r.Use(middleware.ClientIPFromXFF( "13.32.0.0/15", // CloudFront IPv4 "52.46.0.0/18", // CloudFront IPv4 "2600:9000::/28", // CloudFront IPv6 )) // Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools, // ephemeral containers, dynamic CDN edges). r.Use(middleware.ClientIPFromXFFTrustedProxies(2)) // Server directly on the public internet, no proxy in front. r.Use(middleware.ClientIPFromRemoteAddr) ``` And in your handler or downstream middleware: ```go clientIP := middleware.GetClientIP(r.Context()) // log it, use it as a rate-limit key, etc. ``` *** Thanks to [@adam-p](https://github.com/adam-p), [@c2h5oh](https://github.com/c2h5oh), [@rezmoss](https://github.com/rezmoss), [@Saku0512](https://github.com/Saku0512), [@convto](https://github.com/convto), [@Dirbaio](https://github.com/Dirbaio), [@jawnsy](https://github.com/jawnsy), [@lrstanley](https://github.com/lrstanley), [@mfridman](https://github.com/mfridman), [@n33pm](https://github.com/n33pm), [@pkieltyka](https://github.com/pkieltyka) for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR. **Full Changelog**: <https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-05-22 11:59:09 -04:00

chore(deps): update module github.com/go-chi/chi/v5 to v5.3.0 b95b2dc07f

renovate-bot force-pushed renovate/github.com-go-chi-chi-v5-5.x from b95b2dc07f to 8515b6755a

2026-06-11 04:53:05 -04:00

Compare

renovate-bot changed title from ~~chore(deps): update module github.com/go-chi/chi/v5 to v5.3.0~~ to chore(deps): update module github.com/go-chi/chi/v5 to v5.3.1

2026-07-06 11:51:25 -04:00

renovate-bot force-pushed renovate/github.com-go-chi-chi-v5-5.x from 8515b6755a to e5880a07a6

2026-07-06 11:51:27 -04:00

Compare