Pull requests

• fix(middleware): normalize Content-Type case and trim whitespace in Compress

  #1243·fabrianivan opened Oct 26, 2026·

  ·

• tree: collapse consecutive subrouter wildcards in Walk

  #1240·NgoQuocViet2001 opened Oct 24, 2026·

  ·

• fix(security): Supply-chain CVEs: chi/v5 vulnerable pins (RealIP IP spoofing, RedirectSlashes open redirect) and 127 inh

  #1239·failsafesecurity opened Oct 23, 2026·

  ·

• fix(security): RedirectSlashes open redirect bypass via TAB control character (incomplete CVE-2025-71405 mitigation)

  #1238·failsafesecurity opened Oct 23, 2026·

  ·

• test(middleware): live-server regression test for RouteHeaders Host route

  #1237·failsafesecurity opened Oct 23, 2026·

  ·

• fix(middleware): match RouteHeaders Host route against r.Host

  #1236·failsafesecurity opened Oct 23, 2026·

  ·

• middleware: StripSlashes should route on the raw path so escaped slashes (%2F) keep matching

  #1235·tony1233200 opened Oct 22, 2026·

  ·
  1

• routing: don't let a regexp param match across path segments

  #1234·Sathwik-giddi opened Oct 22, 2026·

  ·
  1

• docs: add ARCHITECTURE.md for contributors

  #1233·CHAPIBUNNY opened Oct 21, 2026·

  ·
  2

• fix(middleware): preserve existing request ID in context

  #1231·SAY-5 opened Oct 19, 2026·

  ·
  1

• middleware: preserve leading-dot URL segments in URLFormat

  #1230·fallintoplace opened Oct 18, 2026·

  ·

• middleware: report short tee writes

  #1229·lowgame opened Oct 18, 2026Contributor·

  ·

• middleware: escape quotes and backslashes in BasicAuth realms

  #1227·yuefdev opened Oct 18, 2026·

  ·

• fix(mux): drop internal wildcard key from URLParams on mount

  #1226·arseniy-gl opened Oct 17, 2026·

  ·
  1

• middleware: GetHead checks the current sub-router, not the root

  #1225·cindykrafft opened Oct 16, 2026·

  ·

• tree: refuse to let a regexp placeholder match a slash across segments

  #1224·piyush295 opened Oct 16, 2026·

  ·
  1

• tree: anchor regexp params to the whole value, alternations included

  #1223·KaweMaximo opened Oct 15, 2026·

  ·

• middleware: resolve SupressNotFound preflight like the router does

  #1222·phaethix opened Oct 14, 2026·

  ·

• middleware: commit compression headers before flushing response

  #1221·phaethix opened Oct 14, 2026·

  ·

• tree: keep a node's endpoints in a slice, not a map

  #1219·charconstpointer opened Oct 14, 2026·

  ·
  1

• fix: decode URL path parameters exactly once (#832)

  #1216·MrBeldum opened Oct 13, 2026·

  ·
  1

• tree: store one endpoint for a route that serves every method

  #1215·charconstpointer opened Oct 13, 2026·

  ·

• middleware: make PageRoute work in mounted routers

  #1212·maxazure opened Oct 11, 2026·

  ·
  1

• fix(tree): prevent regexp placeholders from matching slash across path segments

  routing
  #1210·AdamMagued opened Oct 9, 2026·

  ·
  1

• fix(middleware/compress): parse Accept-Encoding honoring quality values

  #1209·AdamMagued opened Oct 9, 2026·

  ·
  1