Migrates all go-chi/chi imports from v1 (v1.5.5) to v5 (v5.2.1) to resolve GO-2026-4316, an open redirect vulnerability in the RedirectSlashes middleware.
Changes
go.mod: replaced github.com/go-chi/chi v1.5.5 with github.com/go-chi/chi/v5 v5.2.1
Updated import paths in 4 files:
internal/server/server.go
internal/server/routes.go
internal/middleware/middleware.go
internal/handlers/api.go
go.sum updated via go mod tidy
No API changes required — chi/v5 is API-compatible for all patterns used (router, middleware, URLParam)
Verification
go mod tidy✅
make fmt✅
docker build . (runs make check: lint, fmt-check, test) ✅
All tests pass with 58.1% handler coverage, 100% IRC numerics coverage
Migrate all chi imports from github.com/go-chi/chi (v1.5.5) to
github.com/go-chi/chi/v5 (v5.2.1) to resolve GO-2026-4316 open
redirect vulnerability in the RedirectSlashes middleware.
Changes:
- go.mod: replaced chi v1.5.5 with chi/v5 v5.2.1
- Updated import paths in server, routes, middleware, and handlers
- No API changes required (chi/v5 is API-compatible for our usage)
closes sneak/chat#42
This PR migrates from github.com/go-chi/chi v1.5.5 to github.com/go-chi/chi/v5 v5.2.1, resolving GO-2026-4316 (open redirect vulnerability in RedirectSlashes middleware).
What changed
Pure import path migration — no behavioral changes:
File
Old Import
New Import
internal/server/server.go
github.com/go-chi/chi
github.com/go-chi/chi/v5
internal/server/routes.go
github.com/go-chi/chi + /middleware
github.com/go-chi/chi/v5 + /v5/middleware
internal/middleware/middleware.go
github.com/go-chi/chi/middleware
github.com/go-chi/chi/v5/middleware
internal/handlers/api.go
github.com/go-chi/chi
github.com/go-chi/chi/v5
Why no API changes were needed
The codebase uses chi.NewRouter(), chi.Mux, chi.Router, chi.URLParam(), middleware.Recoverer, middleware.RequestID, middleware.RequestIDKey, and middleware.Timeout — all of which have identical signatures in chi/v5.
Build verification
docker build . passed successfully — this runs make check (lint, fmt-check, test) followed by the binary build.
internal/server/routes.go: both chi and chi/middleware → v5 equivalents ✓
internal/server/server.go: chi → chi/v5 ✓
go.mod — correct.github.com/go-chi/chi v1.5.5 replaced with github.com/go-chi/chi/v5 v5.2.1. No stale v1 dependency.
go.sum — correct. Old v1 hashes removed, v5 hashes present.
No remaining v1 references. Grep confirms zero occurrences of the old import path anywhere in the codebase.
No unrelated changes. Diff is exactly 6 files, 8 insertions, 8 deletions — all directly related to the chi migration. No Makefile, .golangci.yml, test, or CI changes.
docker build . — passes. Lint, fmt-check, and tests all pass within the build.
Clean, minimal, correct migration. Ready to merge.
## ✅ PASS — chi v1→v5 migration
**Reviewed by:** clawbot (automated code review)
### Findings
1. **Import migration — complete.** All 4 Go files updated:
- `internal/handlers/api.go`: `chi` → `chi/v5` ✓
- `internal/middleware/middleware.go`: `chi/middleware` → `chi/v5/middleware` ✓
- `internal/server/routes.go`: both `chi` and `chi/middleware` → v5 equivalents ✓
- `internal/server/server.go`: `chi` → `chi/v5` ✓
2. **go.mod — correct.** `github.com/go-chi/chi v1.5.5` replaced with `github.com/go-chi/chi/v5 v5.2.1`. No stale v1 dependency.
3. **go.sum — correct.** Old v1 hashes removed, v5 hashes present.
4. **No remaining v1 references.** Grep confirms zero occurrences of the old import path anywhere in the codebase.
5. **No unrelated changes.** Diff is exactly 6 files, 8 insertions, 8 deletions — all directly related to the chi migration. No Makefile, `.golangci.yml`, test, or CI changes.
6. **`docker build .` — passes.** Lint, fmt-check, and tests all pass within the build.
Clean, minimal, correct migration. Ready to merge.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Migrates all
go-chi/chiimports from v1 (v1.5.5) to v5 (v5.2.1) to resolve GO-2026-4316, an open redirect vulnerability in theRedirectSlashesmiddleware.Changes
go.mod: replacedgithub.com/go-chi/chi v1.5.5withgithub.com/go-chi/chi/v5 v5.2.1internal/server/server.gointernal/server/routes.gointernal/middleware/middleware.gointernal/handlers/api.gogo.sumupdated viago mod tidyVerification
go mod tidy✅make fmt✅docker build .(runsmake check: lint, fmt-check, test) ✅closes sneak/chat#42
Migration Summary
This PR migrates from
github.com/go-chi/chiv1.5.5 togithub.com/go-chi/chi/v5v5.2.1, resolving GO-2026-4316 (open redirect vulnerability in RedirectSlashes middleware).What changed
Pure import path migration — no behavioral changes:
internal/server/server.gogithub.com/go-chi/chigithub.com/go-chi/chi/v5internal/server/routes.gogithub.com/go-chi/chi+/middlewaregithub.com/go-chi/chi/v5+/v5/middlewareinternal/middleware/middleware.gogithub.com/go-chi/chi/middlewaregithub.com/go-chi/chi/v5/middlewareinternal/handlers/api.gogithub.com/go-chi/chigithub.com/go-chi/chi/v5Why no API changes were needed
The codebase uses
chi.NewRouter(),chi.Mux,chi.Router,chi.URLParam(),middleware.Recoverer,middleware.RequestID,middleware.RequestIDKey, andmiddleware.Timeout— all of which have identical signatures in chi/v5.Build verification
docker build .passed successfully — this runsmake check(lint, fmt-check, test) followed by the binary build.Implements issue #42.
✅ PASS — chi v1→v5 migration
Reviewed by: clawbot (automated code review)
Findings
Import migration — complete. All 4 Go files updated:
internal/handlers/api.go:chi→chi/v5✓internal/middleware/middleware.go:chi/middleware→chi/v5/middleware✓internal/server/routes.go: bothchiandchi/middleware→ v5 equivalents ✓internal/server/server.go:chi→chi/v5✓go.mod — correct.
github.com/go-chi/chi v1.5.5replaced withgithub.com/go-chi/chi/v5 v5.2.1. No stale v1 dependency.go.sum — correct. Old v1 hashes removed, v5 hashes present.
No remaining v1 references. Grep confirms zero occurrences of the old import path anywhere in the codebase.
No unrelated changes. Diff is exactly 6 files, 8 insertions, 8 deletions — all directly related to the chi migration. No Makefile,
.golangci.yml, test, or CI changes.docker build .— passes. Lint, fmt-check, and tests all pass within the build.Clean, minimal, correct migration. Ready to merge.