Skip to content

chore(deps): update security updates [security] - #209

Merged
NumaryBot merged 1 commit into
mainfrom
renovate/security
Jul 29, 2026
Merged

chore(deps): update security updates [security]#209
NumaryBot merged 1 commit into
mainfrom
renovate/security

Conversation

@NumaryBot

@NumaryBot NumaryBot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
github.com/go-chi/chi/v5 indirect minor v5.2.5 -> v5.3.0
go.opentelemetry.io/otel require minor v1.43.0 -> v1.44.0

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

GHSA-9g5q-2w5x-hmxf / GO-2026-5775

More information

Details

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

GHSA-rjr7-jggh-pgcp / GO-2026-5777

More information

Details

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

GHSA-3fxj-6jh8-hvhx / GO-2026-5774

More information

Details

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

CVE-2026-41178 / GHSA-5wrp-cwcj-q835 / GO-2026-5158

More information

Details

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #​967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.44.0: /v0.66.0/v0.20.0/v0.0.17

Compare Source

Added
  • Add ByteSlice and ByteSliceValue functions for new BYTESLICE attribute type in go.opentelemetry.io/otel/attribute. (#​7948)
  • Apply attribute value limit to the KindBytes attribute type in go.opentelemetry.io/otel/sdk/log. (#​7990)
  • Apply attribute value limit to the BYTESLICE attribute type in go.opentelemetry.io/otel/sdk/trace. (#​7990)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/trace. (#​8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#​8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#​8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8153)
  • Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#​8153)
  • Add String method for Value type in go.opentelemetry.io/otel/attribute. (#​8142)
  • Add Slice and SliceValue functions for new SLICE attribute type in go.opentelemetry.io/otel/attribute. (#​8166)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#​8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#​8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8216)
  • Support SLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#​8216)
  • Apply AttributeValueLengthLimit to attribute.SLICE type attribute values in go.opentelemetry.io/otel/sdk/trace, recursively truncating contained string values. (#​8217)
  • Add Error field on Record type in go.opentelemetry.io/otel/log/logtest. (#​8148)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#​8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#​8157)
  • Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8157)
  • Add Settable to go.opentelemetry.io/otel/metric/x to allow reusing attribute options. (#​8178)
  • Add experimental support for splitting metric data across multiple batches in go.opentelemetry.io/otel/sdk/metric.
    Set OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size> to enable for all periodic readers.
    See go.opentelemetry.io/otel/sdk/metric/internal/x for feature documentation. (#​8071)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc.
    Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable.
    See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x for feature documentation. (#​8192)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp.
    Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable.
    See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x for feature documentation. (#​8194)
  • Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutlog.
    Enable with OTEL_GO_X_SELF_OBSERVABILITY=true environment variable.
    See go.opentelemetry.io/otel/stdout/stdoutlog/internal/x for feature documentation. (#​8263)
  • Add WithDefaultAttributes to go.opentelemetry.io/otel/metric/x to support setting default attributes on instruments. (#​8135)
  • Add go.opentelemetry.io/otel/semconv/v1.41.0 package.
    The package contains semantic conventions from the v1.41.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.40.0. (#​8324)
  • Add Observable variants of instruments to go.opentelemetry.io/otel/semconv/v1.41.0 package. (#​8350)
  • Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in go.opentelemetry.io/otel/semconv/v1.41.0. (#​8002)
Changed
  • ⚠️ Breaking Change: go.opentelemetry.io/otel/sdk/metric now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation.
    New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing attribute.Bool("otel.metric.overflow", true).
    This can break users who relied on the previous unlimited default.
    Set WithCardinalityLimit(0) or the deprecated OTEL_GO_X_CARDINALITY_LIMIT=0 environment variable to preserve unlimited cardinality.
    Note that support for OTEL_GO_X_CARDINALITY_LIMIT may be removed in a future release. (#​8247)
  • ErrorType in go.opentelemetry.io/otel/semconv now unwraps errors created with fmt.Errorf when deriving the error.type attribute. (#​8133)
  • go.opentelemetry.io/otel/sdk/log now unwraps error chains created with fmt.Errorf when deriving the error.type attribute from errors on log records. (#​8133)
  • Set.MarshalLog method in go.opentelemetry.io/otel/attribute now uses Value.String formatting following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#​8169)
  • Optimize go.opentelemetry.io/otel/sdk/metric to return a drop reservoir and short-circuit Offer calls to the exemplar reservoir when exemplar.AlwaysOffFilter is configured. (#​8211) (#​8267)
  • Optimize go.opentelemetry.io/otel/sdk/metric to return a drop reservoir for asynchronous instruments when exemplar.TraceBasedFilter is configured. (#​8286)
Deprecated
  • Deprecate Value.Emit method in go.opentelemetry.io/otel/attribute.
    Use Value.String instead. (#​8176)
Fixed
  • Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc.
    The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#​8157, #​8365)
  • Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp.
    The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#​8157, #​8365)
  • Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc.
    The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#​8157, #​8365)
  • Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp.
    The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#​8157, #​8365)
  • Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
    The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#​8157, #​8365)
  • Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp.
    The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#​8157, #​8365)
  • Fix gzipped request body replay on redirect in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8135)
  • Fix gzipped request body replay on redirect in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8152)
  • go.opentelemetry.io/otel/exporters/prometheus now uses Value.String formatting for label values following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#​8170)
  • Propagate errors from the exporter when calling Shutdown on BatchSpanProcessor in go.opentelemetry.io/otel/sdk/trace. (#​8197)
  • Fix stale status code reporting on self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8226)
  • Fix a concurrent Collect data race and potential panic in go.opentelemetry.io/otel/exporters/prometheus when WithResourceAsConstantLabels option is used. (#​8227)
  • Fix race condition in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by reverting #​7447. (#​8249)
  • Fix FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar to safely handle zero size.
    A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in Offer() and Collect() ensure no-op behavior. (#​8295)
  • Fix counting of spans and logs in self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8254)
  • Drop conflicting scope attributes named name, version, or schema_url from metric labels in go.opentelemetry.io/otel/exporters/prometheus, preserving the dedicated otel_scope_name, otel_scope_version, and otel_scope_schema_url labels. (#​8264)
  • Close schema files opened by ParseFile in go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1. (GHSA-995v-fvrw-c78m)
  • Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation. (#​8222)
  • Fix go.opentelemetry.io/otel/semconv/v1.41.0 to include Attr* helper methods for required attributes on observable instruments. (#​8361)
  • Limit baggage extraction error reporting in go.opentelemetry.io/otel/propagation to prevent malformed or oversized baggage headers from flooding logs. (GHSA-5wrp-cwcj-q835)

What's Changed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@NumaryBot
NumaryBot requested a review from a team as a code owner July 25, 2026 03:08
@NumaryBot
NumaryBot enabled auto-merge (squash) July 25, 2026 03:08
@NumaryBot

NumaryBot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0

@coderabbitai

coderabbitai Bot commented Jul 25, 2026

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)
  • go.mod is excluded by !**/*.mod
  • go.sum is excluded by !**/*.sum, !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c2ecbf6-8a35-4ac5-bc8b-1ed4dc10ec78

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/security

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@NumaryBot

NumaryBot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

✅ Approve — automated review

This PR is a routine dependency update, bumping security-relevant packages along with two transitive OpenTelemetry dependencies (otel/trace and otel/metric from v1.43.0 to v1.44.0). No correctness issues, logic changes, or regressions were identified by any reviewer. The changes are limited to go.mod and go.sum version/checksum entries.

No findings.

@NumaryBot
NumaryBot merged commit 2f61bb3 into main Jul 29, 2026
10 of 16 checks passed
@NumaryBot
NumaryBot deleted the renovate/security branch July 29, 2026 21:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@flemzord flemzord flemzord approved these changes

Assignees

No one assigned

Labels

security

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@NumaryBot @flemzord