security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-3fxj-6jh8-hvhx	github.com/go-chi/chi/v5	None	v5.2.1	5.3.0		confirmed

Not Included

• Deferred by batch limit: 29 advisories. They will be considered by future runs.
• Other deferred scanner findings: 4.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	golang.org/x/tools	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	puppeteer-core	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Dependency-only patch bump with no server code changes; low blast radius though it touches the HTTP stack used by the API.

Overview
Bumps github.com/go-chi/chi/v5 from v5.2.1 to v5.3.0 in server/go.mod and server/go.sum to remediate GHSA-3fxj-6jh8-hvhx. There are no application or routing code changes—only the pinned module version and checksums.

Chi remains the HTTP router for the API (server/cmd/api); behavior should match the prior release aside from the security fix in the upstream library.

^{Reviewed by Cursor Bugbot for commit 6f4de78. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​go-chi/​chi/​v5@​v5.2.1 ⏵ v5.3.0	+1	+24

View full report