chore(deps): bump the go-maintenance group in /server-go with 3 updates

[dependabot]

Bumps the go-maintenance group in /server-go with 3 updates: github.com/go-chi/chi/v5, github.com/go-chi/cors and github.com/WebDecoy/web-bot-auth.

Updates github.com/go-chi/chi/v5 from 5.0.11 to 5.3.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

• feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
• docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
• fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
• Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
• fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
  • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

v5.3.1

What's Changed

• Honor Discard() in httpFancyWriter.ReadFrom by @​DucMinhNe in go-chi/chi#1110
• Tidy build directives by @​JRaspass in go-chi/chi#1113
• feat(middleware): add text/xml and application/xml to default compressible types by @​VojtechVitek in go-chi/chi#1127
• Fix defaultLogEntry.Panic not respecting NoColor setting by @​doganarif in go-chi/chi#1050
• middleware: document printPrettyStack and harden NoColor panic test by @​VojtechVitek in go-chi/chi#1131
• feat(mux): support http QUERY method ietf rfc10008 by @​VojtechVitek in go-chi/chi#1132
• ci: pin GitHub Actions to full commit SHAs by @​XananasX7 in go-chi/chi#1116

New Contributors

• @​DucMinhNe made their first contribution in go-chi/chi#1110
• @​doganarif made their first contribution in go-chi/chi#1050
• @​XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

v5.3.0

What's Changed

• Use strings.ReplaceAll where applicable by @​JRaspass in go-chi/chi#1046
• Propagate inline middlewares across mounted subrouters by @​LukasJenicek in go-chi/chi#1049
• add go 1.26 to ci by @​pkieltyka in go-chi/chi#1052
• Remove last uses of io/ioutil by @​JRaspass in go-chi/chi#1054
• Simplify chi.walk with slices.Concat by @​JRaspass in go-chi/chi#1053
• Apply the stringscutprefix modernizer by @​JRaspass in go-chi/chi#1051
• Bump minimum Go to 1.23, always use request.Pattern by @​JRaspass in go-chi/chi#1048
• middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @​alliasgher in go-chi/chi#1085
• Fix typo in Route doc comment by @​gouwazi in go-chi/chi#1073
• fix: set Request.Pattern from RoutePattern() by @​leno23 in go-chi/chi#1097
• feat: middleware.ClientIP, a replacement for middleware.RealIP by @​VojtechVitek in go-chi/chi#967

New Contributors

• @​LukasJenicek made their first contribution in go-chi/chi#1049
• @​alliasgher made their first contribution in go-chi/chi#1085
• @​gouwazi made their first contribution in go-chi/chi#1073
• @​leno23 made their first contribution in go-chi/chi#1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

... (truncated)

Changelog

Sourced from github.com/go-chi/chi/v5's changelog.

Changelog

v5.0.12 (2024-02-16)

• History of changes: see go-chi/chi@v5.0.11...v5.0.12

Commits

• 3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
• 9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
• 29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
• bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
• 60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
• 8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
• caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
• 7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
• 878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
• d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
• Additional commits viewable in compare view

Updates github.com/go-chi/cors from 1.2.1 to 1.2.2

Release notes

Sourced from github.com/go-chi/cors's releases.

v1.2.2

What's Changed

• Update README with install by @​Uyutaka in go-chi/cors#22
• Fix broken credits link by @​lordidiot in go-chi/cors#25
• fix test_default error message #28 by @​ablankz in go-chi/cors#29
• Update Go version in CI by @​VojtechVitek in go-chi/cors#32
• Fix Origin header check by @​c2h5oh in go-chi/cors#38

New Contributors

• @​Uyutaka made their first contribution in go-chi/cors#22
• @​lordidiot made their first contribution in go-chi/cors#25
• @​ablankz made their first contribution in go-chi/cors#29
• @​VojtechVitek made their first contribution in go-chi/cors#32
• @​c2h5oh made their first contribution in go-chi/cors#38

Full Changelog: go-chi/cors@v1.2.1...v1.2.2

Commits

• 3a53812 Fix Origin header check (#38)
• f8fbaee Update Go version in CI (#32)
• b41f767 fix test_default error message #28 (#29)
• 76ca797 Fix broken link (#25)
• 9aca617 Update README with install (#22)
• See full diff in compare view

Updates github.com/WebDecoy/web-bot-auth from 0.2.0 to 0.4.1

Release notes

Sourced from github.com/WebDecoy/web-bot-auth's releases.

v0.4.1 — Directory fetch contract

Out-of-band directory discovery now requires HTTP 200, rejects redirects, validates the directory media type, and validates the supplied origin shape.

v0.4.0 — Web Bot Auth WG draft alignment

Aligns signing and verification with draft-ietf-webbotauth-httpsig-protocol-00.

• Signs the exact Signature-Agent dictionary member by default.
• Requires Signature-Agent during verification.
• Adds explicit compatibility modes for legacy bare-string signers and historical missing-header fixtures.
• Validated against Cloudflare's live crawltest.com parser.

Commits

• 3fb19ad fix: enforce directory discovery response contract (#3)
• 477a789 feat: align signing with Web Bot Auth WG draft (#2)
• 4ffdf69 feat: reject a directory that is not served as one (draft-02 §5.5.1) (#1)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions