[dependabot]

Bumps the go-minor-and-patch group with 4 updates: github.com/go-chi/chi/v5, github.com/go-jose/go-jose/v4, github.com/pb33f/libopenapi and github.com/pb33f/libopenapi-validator.

Updates github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.5.0

What's Changed

• middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only by @​VojtechVitek in go-chi/chi#1195
• middleware: test ClientIPFromHeader does not fall back to other headers by @​renanmpimentel in go-chi/chi#1208
• middleware: build Maybe handler once by @​lowgame in go-chi/chi#1197
• middleware: round and clamp Retry-After delays up to whole seconds by @​VojtechVitek in go-chi/chi#1217
• middleware: parse quoted ContentCharset media parameters by @​VojtechVitek in go-chi/chi#1218
• middleware: SupressNotFound must not mutate the request's route context by @​VojtechVitek in go-chi/chi#1220

New Contributors

• @​renanmpimentel made their first contribution in go-chi/chi#1208
• @​lowgame made their first contribution in go-chi/chi#1197

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

What's Changed

• Improve godoc: add links and titles by @​dolmen in go-chi/chi#1027
• Add Clone method to Context by @​VojtechVitek in go-chi/chi#1157
• middleware: ContentCharset should skip requests without a body by @​VojtechVitek in go-chi/chi#1158
• Update compress middleware support Brotli support documentation by @​sm3142 in go-chi/chi#1007
• fix: panic on Mount() when a router is mounted onto itself by @​sk-sanjay01 in go-chi/chi#1159
• test(middleware): Improves test coverage by @​nszilard in go-chi/chi#700
• Remove superfluous import aliases by @​JRaspass in go-chi/chi#1166
• Bump minimum Go to 1.24, use b.Loop() by @​JRaspass in go-chi/chi#1164
• Use slices.Backward where appropriate by @​JRaspass in go-chi/chi#1165
• Replace "interface{}" with "any" by @​JRaspass in go-chi/chi#1167
• Simplify chi.URLParam, call chi.URLParamFromCtx by @​JRaspass in go-chi/chi#1168
• middleware: record response status when flushing by @​jakezwang in go-chi/chi#1174
• middleware: honor Discard when flushing by @​LeulTew in go-chi/chi#1185
• README: point middleware doc links to chi/v5 by @​VojtechVitek in go-chi/chi#1196
• middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @​VojtechVitek in go-chi/chi#1214
  • Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

• @​dolmen made their first contribution in go-chi/chi#1027
• @​sm3142 made their first contribution in go-chi/chi#1007
• @​sk-sanjay01 made their first contribution in go-chi/chi#1159
• @​nszilard made their first contribution in go-chi/chi#700
• @​jakezwang made their first contribution in go-chi/chi#1174
• @​LeulTew made their first contribution in go-chi/chi#1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

Commits

• 3a33ba5 middleware: SupressNotFound must not mutate the request's route context (#1220)
• 6075570 middleware: parse quoted ContentCharset media parameters (#1218)
• 46295d0 middleware: test Retry-After rounding in one table test (#1217)
• c6e33a1 middleware: build Maybe handler once (#1197)
• c9744a3 middleware: test ClientIPFromHeader does not fall back to other headers (#1208)
• fff8bb2 middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only (#1195)
• 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
• 167e1e3 README: point middleware doc links to chi/v5 (#1196)
• 3d1777a middleware: honor Discard when flushing (#1185)
• b1c9ab4 middleware: record response status when flushing (#1174)
• Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.6

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

• Reject mismatched JWE CEK lengths by @​akshithg in go-jose/go-jose#266
• Add a tests containerfile and threat model by @​mcpherrinm in go-jose/go-jose#300
• Fix error message for future issued tokens by @​inahga in go-jose/go-jose#303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

Commits

• a0111f8 Merge commit from fork
• dd39a41 Fix error message for future issued tokens (#303)
• 13b7118 Add a tests containerfile and threat model (#300)
• 25b55fe Reject mismatched JWE CEK lengths (#266)
• See full diff in compare view

Updates github.com/pb33f/libopenapi from 0.41.5 to 0.41.6

Release notes

Sourced from github.com/pb33f/libopenapi's releases.

v0.41.6

Fixes seeded mock generation determinism.

@​tx3stn

Commits

• c4c4be7 fix: seeded mock generation now gives the same output on every run
• See full diff in compare view

Updates github.com/pb33f/libopenapi-validator from 0.16.0 to 0.16.1

Release notes

Sourced from github.com/pb33f/libopenapi-validator's releases.

v0.16.1

Fix panic on missing or non-map query parameter object- #278

@​SebTardif

Commits

• a300515 fix: collapse object query param decode into one type assertion
• 9ae50bc test: add coverage for QueryParameterCannotBeDecoded and object param paths
• 5fe4679 fix: return validation error when object query param cannot be decoded
• 6b4f611 Fix panic on missing or non-map query parameter object
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions