From 805974968b3b626d0ffeeceb145234207e21d8b6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 11:55:30 +0000 Subject: [PATCH 1/4] chore(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.2 to 5.4.0. - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.3.2...v5.4.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e95124c47d..0e976b0a1e 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/confluentinc/confluent-kafka-go/v2 v2.16.0 github.com/forscht/namegen v1.0.1 github.com/getkin/kin-openapi v0.149.0 - github.com/go-chi/chi/v5 v5.3.2 + github.com/go-chi/chi/v5 v5.4.0 github.com/go-chi/cors v1.2.2 github.com/go-chi/render v1.0.3 github.com/go-co-op/gocron/v2 v2.22.0 diff --git a/go.sum b/go.sum index 674c78d2cd..5fea34d1dc 100644 --- a/go.sum +++ b/go.sum @@ -131,8 +131,8 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA= github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY= -github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= -github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= +github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE= github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= From 76fe2132ca91fcb6265db7905cda39d9c3267764 Mon Sep 17 00:00:00 2001 From: Krisztian Gacsal Date: Mon, 19 Oct 2026 16:19:06 +0200 Subject: [PATCH 2/4] fix: go mod --- collector/go.mod | 2 +- collector/go.sum | 4 ++-- e2e/go.mod | 2 +- e2e/go.sum | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/collector/go.mod b/collector/go.mod index 5fa200a7d1..84faba7a67 100644 --- a/collector/go.mod +++ b/collector/go.mod @@ -205,7 +205,7 @@ require ( github.com/generikvault/gvalstrings v0.0.0-20180926130504-471f38f0112a // indirect github.com/getkin/kin-openapi v0.149.0 // indirect github.com/getsentry/sentry-go v0.47.0 // indirect - github.com/go-chi/chi/v5 v5.3.2 // indirect + github.com/go-chi/chi/v5 v5.4.0 // indirect github.com/go-faker/faker/v4 v4.7.0 // indirect github.com/go-faster/city v1.0.1 // indirect github.com/go-faster/errors v0.7.1 // indirect diff --git a/collector/go.sum b/collector/go.sum index 5f75baf2a1..6f3e2e8ca2 100644 --- a/collector/go.sum +++ b/collector/go.sum @@ -728,8 +728,8 @@ github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwv github.com/gin-gonic/gin v1.7.3/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= -github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= -github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= +github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0= github.com/go-co-op/gocron/v2 v2.22.0 h1:uEuH2F7k7VoESb1BYSaffuuV+T0kkpzsC0aXk7/z79I= diff --git a/e2e/go.mod b/e2e/go.mod index dcd4270a4d..ad786287f2 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -9,7 +9,7 @@ replace github.com/openmeterio/openmeter/api/v3/client => ../api/v3/client require ( github.com/brianvoe/gofakeit/v6 v6.28.0 github.com/cloudevents/sdk-go/v2 v2.16.2 - github.com/go-chi/chi/v5 v5.3.2 + github.com/go-chi/chi/v5 v5.4.0 github.com/jackc/pgx/v5 v5.11.0 github.com/oklog/ulid/v2 v2.1.2 github.com/openmeterio/openmeter v0.0.0-00010101000000-000000000000 diff --git a/e2e/go.sum b/e2e/go.sum index 1c17e4a526..dcc98d7217 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -76,8 +76,8 @@ github.com/forscht/namegen v1.0.1 h1:HipCEuyIKECsb1Yt68xaX7XTCDDrd+aDdEROoayY52I github.com/forscht/namegen v1.0.1/go.mod h1:Vnu8EC4fPGwaP7ogYi7kTPvRQHAUZUe1i1wN1RlgzII= github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA= github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY= -github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= -github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= +github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= From bae21688fa02d01cff820a4aae299695bd768759 Mon Sep 17 00:00:00 2001 From: Krisztian Gacsal Date: Wed, 21 Oct 2026 17:14:35 +0200 Subject: [PATCH 3/4] fix: clientIP tests --- app/common/server_test.go | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/app/common/server_test.go b/app/common/server_test.go index cdcbd4d4f5..7ba4e25e85 100644 --- a/app/common/server_test.go +++ b/app/common/server_test.go @@ -66,6 +66,7 @@ func TestNewClientIPMiddleware(t *testing.T) { Source: config.ClientIPSourceXFF, TrustedIPPrefixes: []string{"10.0.0.0/8"}, }, func(r *http.Request) { + r.RemoteAddr = "10.0.0.2:1234" r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") }) @@ -81,12 +82,40 @@ func TestNewClientIPMiddleware(t *testing.T) { TrustedIPPrefixes: []string{"10.0.0.0/8"}, TrustedProxies: 3, }, func(r *http.Request) { + r.RemoteAddr = "10.0.0.2:1234" r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") }) require.Equal(t, "203.0.113.7", got) }) + t.Run("xff source with trusted prefixes ignores headers from untrusted peers", func(t *testing.T) { + // A trusted hop claimed in XFF cannot make an untrusted socket peer trusted. + got := resolveClientIP(t, config.ClientIPMiddlewareConfig{ + Source: config.ClientIPSourceXFF, + TrustedIPPrefixes: []string{"10.0.0.0/8"}, + }, func(r *http.Request) { + r.RemoteAddr = "198.51.100.9:1234" + r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") + }) + + require.Equal(t, "198.51.100.9", got) + }) + + t.Run("xff source with trusted prefixes ignores headers from untrusted peers when trusted proxies is also set", func(t *testing.T) { + // The proxy count must not bypass the trusted-prefix check on the socket peer. + got := resolveClientIP(t, config.ClientIPMiddlewareConfig{ + Source: config.ClientIPSourceXFF, + TrustedIPPrefixes: []string{"10.0.0.0/8"}, + TrustedProxies: 1, + }, func(r *http.Request) { + r.RemoteAddr = "198.51.100.9:1234" + r.Header.Set("X-Forwarded-For", "203.0.113.7, 10.0.0.1") + }) + + require.Equal(t, "198.51.100.9", got) + }) + t.Run("xff source with trusted proxies resolves the proxy-added entry", func(t *testing.T) { got := resolveClientIP(t, config.ClientIPMiddlewareConfig{ Source: config.ClientIPSourceXFF, From 15d1f9ae2296364cb13af2ccc5b2d5fcf866ebb0 Mon Sep 17 00:00:00 2001 From: Krisztian Gacsal Date: Wed, 21 Oct 2026 17:18:54 +0200 Subject: [PATCH 4/4] fix: go mod --- collector/go.mod | 2 +- collector/go.sum | 4 ++-- e2e/go.mod | 2 +- e2e/go.sum | 4 ++-- go.mod | 2 +- go.sum | 4 ++-- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/collector/go.mod b/collector/go.mod index 84faba7a67..7512301aa1 100644 --- a/collector/go.mod +++ b/collector/go.mod @@ -205,7 +205,7 @@ require ( github.com/generikvault/gvalstrings v0.0.0-20180926130504-471f38f0112a // indirect github.com/getkin/kin-openapi v0.149.0 // indirect github.com/getsentry/sentry-go v0.47.0 // indirect - github.com/go-chi/chi/v5 v5.4.0 // indirect + github.com/go-chi/chi/v5 v5.5.0 // indirect github.com/go-faker/faker/v4 v4.7.0 // indirect github.com/go-faster/city v1.0.1 // indirect github.com/go-faster/errors v0.7.1 // indirect diff --git a/collector/go.sum b/collector/go.sum index 6f3e2e8ca2..b8660f94e6 100644 --- a/collector/go.sum +++ b/collector/go.sum @@ -728,8 +728,8 @@ github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwv github.com/gin-gonic/gin v1.7.3/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= -github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= -github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0= github.com/go-co-op/gocron/v2 v2.22.0 h1:uEuH2F7k7VoESb1BYSaffuuV+T0kkpzsC0aXk7/z79I= diff --git a/e2e/go.mod b/e2e/go.mod index ad786287f2..58e2e4317f 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -9,7 +9,7 @@ replace github.com/openmeterio/openmeter/api/v3/client => ../api/v3/client require ( github.com/brianvoe/gofakeit/v6 v6.28.0 github.com/cloudevents/sdk-go/v2 v2.16.2 - github.com/go-chi/chi/v5 v5.4.0 + github.com/go-chi/chi/v5 v5.5.0 github.com/jackc/pgx/v5 v5.11.0 github.com/oklog/ulid/v2 v2.1.2 github.com/openmeterio/openmeter v0.0.0-00010101000000-000000000000 diff --git a/e2e/go.sum b/e2e/go.sum index dcc98d7217..974464fb6f 100644 --- a/e2e/go.sum +++ b/e2e/go.sum @@ -76,8 +76,8 @@ github.com/forscht/namegen v1.0.1 h1:HipCEuyIKECsb1Yt68xaX7XTCDDrd+aDdEROoayY52I github.com/forscht/namegen v1.0.1/go.mod h1:Vnu8EC4fPGwaP7ogYi7kTPvRQHAUZUe1i1wN1RlgzII= github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA= github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY= -github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= -github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4= github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= diff --git a/go.mod b/go.mod index 0e976b0a1e..c731c7d6b3 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/confluentinc/confluent-kafka-go/v2 v2.16.0 github.com/forscht/namegen v1.0.1 github.com/getkin/kin-openapi v0.149.0 - github.com/go-chi/chi/v5 v5.4.0 + github.com/go-chi/chi/v5 v5.5.0 github.com/go-chi/cors v1.2.2 github.com/go-chi/render v1.0.3 github.com/go-co-op/gocron/v2 v2.22.0 diff --git a/go.sum b/go.sum index 5fea34d1dc..1b43af4676 100644 --- a/go.sum +++ b/go.sum @@ -131,8 +131,8 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA= github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY= -github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE= -github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= +github.com/go-chi/chi/v5 v5.5.0 h1:xdKQ1dJmVJsmgahrXSKhUx8NyVPzpwdlyrrQFpMPJgg= +github.com/go-chi/chi/v5 v5.5.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM= github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE= github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=