[dependabot]

Bumps github.com/go-chi/chi/v5 from 5.2.4 to 5.4.0.

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.4.0

What's Changed

• Improve godoc: add links and titles by @​dolmen in go-chi/chi#1027
• Add Clone method to Context by @​VojtechVitek in go-chi/chi#1157
• middleware: ContentCharset should skip requests without a body by @​VojtechVitek in go-chi/chi#1158
• Update compress middleware support Brotli support documentation by @​sm3142 in go-chi/chi#1007
• fix: panic on Mount() when a router is mounted onto itself by @​sk-sanjay01 in go-chi/chi#1159
• test(middleware): Improves test coverage by @​nszilard in go-chi/chi#700
• Remove superfluous import aliases by @​JRaspass in go-chi/chi#1166
• Bump minimum Go to 1.24, use b.Loop() by @​JRaspass in go-chi/chi#1164
• Use slices.Backward where appropriate by @​JRaspass in go-chi/chi#1165
• Replace "interface{}" with "any" by @​JRaspass in go-chi/chi#1167
• Simplify chi.URLParam, call chi.URLParamFromCtx by @​JRaspass in go-chi/chi#1168
• middleware: record response status when flushing by @​jakezwang in go-chi/chi#1174
• middleware: honor Discard when flushing by @​LeulTew in go-chi/chi#1185
• README: point middleware doc links to chi/v5 by @​VojtechVitek in go-chi/chi#1196
• middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @​VojtechVitek in go-chi/chi#1214
  • Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

• @​dolmen made their first contribution in go-chi/chi#1027
• @​sm3142 made their first contribution in go-chi/chi#1007
• @​sk-sanjay01 made their first contribution in go-chi/chi#1159
• @​nszilard made their first contribution in go-chi/chi#700
• @​jakezwang made their first contribution in go-chi/chi#1174
• @​LeulTew made their first contribution in go-chi/chi#1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

v5.3.2

What's Changed

• feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
• docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
• fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
• Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
• fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
  • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

v5.3.1

What's Changed

• Honor Discard() in httpFancyWriter.ReadFrom by @​DucMinhNe in go-chi/chi#1110
• Tidy build directives by @​JRaspass in go-chi/chi#1113
• feat(middleware): add text/xml and application/xml to default compressible types by @​VojtechVitek in go-chi/chi#1127
• Fix defaultLogEntry.Panic not respecting NoColor setting by @​doganarif in go-chi/chi#1050
• middleware: document printPrettyStack and harden NoColor panic test by @​VojtechVitek in go-chi/chi#1131
• feat(mux): support http QUERY method ietf rfc10008 by @​VojtechVitek in go-chi/chi#1132
• ci: pin GitHub Actions to full commit SHAs by @​XananasX7 in go-chi/chi#1116

... (truncated)

Commits

• 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
• 167e1e3 README: point middleware doc links to chi/v5 (#1196)
• 3d1777a middleware: honor Discard when flushing (#1185)
• b1c9ab4 middleware: record response status when flushing (#1174)
• ae6be74 Simplify chi.URLParam, call chi.URLParamFromCtx (#1168)
• 50ef4e4 Replace "interface{}" with "any" (#1167)
• 77074b3 Use slices.Backward where appropriate (#1165)
• 756fcb8 Bump minimum Go to 1.24, use b.Loop() (#1164)
• 5ac7a82 Remove superfluous import aliases (#1166)
• 36611d2 test(middleware): Improves test coverage (#700)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Additional security remediation

Expanded this PR to address existing security alerts at the maintainer's request; PR #359 is unchanged.

• Regenerated notices and notice metadata.
• Replaced the legacy github.com/docker/docker dependency with maintained github.com/moby/moby/api and github.com/moby/moby/client modules. Updated all installer and image-pull call sites and added regression tests, including negotiation with Engine API 1.41, port bindings, certificate archive uploads, network subnets, wait/log streams, and pull failures.
• Patched documentation dependencies: Vite 7.3.7, VitePress's nested Vite 6.4.5, and esbuild 0.28.2. Version-scoped overrides retain VitePress 1.x while removing affected versions.
• Retained the original GitHub-Actions-only Dependabot configuration. The proposed additional ecosystems and related README section were removed ahead of archival; dependency fixes, regression tests, and generated notices remain intact.
• Documented dependency maintenance, override rationale, and the Docker API 1.40 minimum. Updating this SDK does not patch external Docker daemons.

Security verification

Checked every installed copy against the vulnerable ranges from all 15 currently open GitHub Dependabot alerts. No affected versions remain in this PR's edited Go/npm dependency graph. Alerts will remain listed against the default branch until the fixes are merged and GitHub reprocesses dependencies. No alerts were dismissed.

Validation

Passed: full build, make verify-format, all Go tests, targeted race tests and go vet, integration-test compilation, clean npm ci, complete npm dependency-tree validation, documentation production build, browser smoke test of the development server, Dependabot YAML/path checks, and notice regeneration followed by an up-to-date check.

Environment limitations: the .NET unit runner timed out connecting to its test host (the pre-existing local issue); live integration tests were not run because no Tyger login/deployment is configured. npm audit was blocked by the Microsoft proxy returning HTTP 429; the direct npm registry was also unreachable. The authenticated GitHub advisory-range verification above independently covered all 15 existing repository alerts.

Maintenance scope decision

Local read-only Dependabot previews identified substantial version-update work, distinct from the existing security alerts. The additional version-update schedules were therefore reverted rather than starting an ongoing upgrade campaign ahead of repository archival. This does not disable repository security alerts or undo any security fixes. The rollback changes only .github/dependabot.yml and the related README section; both match their pre-expansion versions exactly.

[Copilot]

🔵 Needs a closer look

The Docker SDK migration affects installation, upgrades, data migrations, cleanup, and SSH image pulls, but validation used only mocked API responses, leaving live Docker daemon and SSH compatibility unverified.

No open issues 🎉

1 file not reviewed

• docs/package-lock.json: Generated file

What changed in this PR

This PR addresses dependency alerts in Tyger’s CLI and documentation tooling, migrates Docker integration to maintained Moby modules, and expands automated dependency updates.

Changes:

• Updates Go and npm dependencies, refreshes lockfiles, and regenerates third-party notices.
• Adapts Docker installer and image-pull calls to the Moby SDK, with regression tests for API compatibility and core operations.
• Adds weekly grouped Dependabot updates for Go, npm, NuGet, and Docker, plus maintenance and compatibility documentation.

File	Description
README.md	Documents dependency updates and notice regeneration.
NOTICE.txt	Replaces legacy Docker notices with Moby module licenses.
docs/​README.md	Explains dependency overrides and validation steps.
docs/​package.json	Updates Vite and adds scoped security overrides.
docs/​package-lock.json	Records updated documentation dependencies.
docs/​introduction/​installation/​docker-installation.md	Documents the Docker API minimum and daemon update responsibility.
cli/​internal/​install/​dockerinstall/​migrations.go	Adapts migration operations to the Moby SDK.
cli/​internal/​install/​dockerinstall/​docker.go	Migrates Docker operations and handles image-pull stream failures.
cli/​internal/​install/​dockerinstall/​docker_test.go	Adds Docker API negotiation and operation regression tests.
cli/​internal/​cmd/​run.go	Migrates run image-pulling calls to the Moby client.
cli/​go.sum	Refreshes Go dependency checksums.
cli/​go.mod	Updates chi and replaces the legacy Docker SDK dependencies.
.notice-metadata.txt	Refreshes generated notice tracking hashes.
.github/​dependabot.yml	Expands ecosystem coverage with weekly groups and seven-day cooldowns.

_{Review effort: Balanced}