security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-3fxj-6jh8-hvhx	github.com/go-chi/chi/v5	None	v5.2.1	5.3.0		confirmed

Not Included

• Deferred by batch limit: 33 advisories. They will be considered by future runs.
• Other deferred scanner findings: 257.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	dario.cat/mergo	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Azure/go-ansiterm	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/apapsch/go-jsonmerge/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cespare/xxhash/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/euank/go-kmsg-parser/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/grpc-ecosystem/grpc-gateway/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/oapi-codegen/oapi-codegen/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/avast/retry-go/v5	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cenkalti/backoff/v5	Non-CVE alert is not handled by dependency remediation.
...	...	247 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Single patch-level bump of the HTTP router used in the API; no auth or business-logic edits, though routing/middleware behavior should be smoke-tested as usual for framework updates.

Overview
Addresses GHSA-3fxj-6jh8-hvhx by upgrading the direct dependency github.com/go-chi/chi/v5 from v5.2.1 to v5.3.0 in server/go.mod.

server/go.sum is updated with a large set of checksum lines, reflecting dependency resolution after the bump (including transitive modules). There are no application code changes—only module lockfile updates from the Socket vulnerability remediation workflow.

^{Reviewed by Cursor Bugbot for commit d9b88f1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​go-chi/​chi/​v5@​v5.2.1 ⏵ v5.3.0	+1	+24

View full report

[ulziibay-kernel]

Verified the bump against the advisory's first patched version; rebuilt on current main and confirmed the toolchain lock/build is clean. CI green.