## Summary

Backport [go-chi/chi](https://github.com/go-chi/chi) v5.2.4 to v5.3.1 on
`release/2.35`, aligning with the upgrade already merged on `main` via
#27051.

## Security Advisories Addressed

chi v5.3.0 and v5.3.1 resolve the following advisories:

| Advisory | Description | Severity |
|----------|-------------|----------|
|
[GHSA-9g5q-2w5x-hmxf](GHSA-9g5q-2w5x-hmxf)
| IP spoofing via XFF in RemoteAddr resolution | — |
|
[GHSA-rjr7-jggh-pgcp](GHSA-rjr7-jggh-pgcp)
| RealIP allows IP spoofing via unvalidated XFF | — |
|
[GHSA-3fxj-6jh8-hvhx](GHSA-3fxj-6jh8-hvhx)
| IP spoofing in middleware.RealIP | Critical (9.3) |
|
[GHSA-mqqf-5wvp-8fh8](GHSA-mqqf-5wvp-8fh8)
| Open redirect in RedirectSlashes (CVE-2025-69725) | — |
|
[GHSA-vrw8-fxc6-2r93](GHSA-vrw8-fxc6-2r93)
| Host Header Injection in RedirectSlashes | — |

## Impact Assessment

Coder does **not** use the directly affected middleware:
- `middleware.RealIP` — Coder uses its own `httpmw.ExtractRealIP`
- `StripSlashes` / `RedirectSlashes` / `CleanPath` — Coder uses its own
`singleSlashMW`

The primary motivation for this backport is keeping `release/2.35`
aligned with `main` to prevent dependency drift and to satisfy IronBank
scanning requirements.

## Changes

- `go.mod` / `go.sum`: bump `github.com/go-chi/chi/v5` v5.2.4 to v5.3.1

## Related

- #27051 — original Dependabot upgrade on `main`
- #27148 — same backport on `release/2.34`

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Marcin Tojek <mtojek@users.noreply.github.com>

## Summary

Backport Go toolchain bump from 1.26.4 to 1.26.5 to `release/2.35`.

Go 1.26.5 ([released
2026-07-07](https://go.dev/doc/devel/release#go1.26.5)) includes
security fixes addressing:

- [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) —
`os` package
- [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) —
`crypto/tls` package

These were flagged by the IronBank scan of
`coder/coder-enterprise/coder-service-2:2.34.5`.

## Changes

- `go.mod`: `go 1.26.4` to `go 1.26.5` (language version floor)
- `mise.toml` / `mise.lock`: Go toolchain pin 1.26.4 to 1.26.5 (this is
what actually compiles the scanned artifact and clears the CVEs)

## Related

- #27157 — original bump on `main`
- #27158 — backport to `release/2.34`

Linear: ENT-128

…release link (#27259)

## Problem

The interactive releaser (`scripts/releaser`) renders the "Latest
Release"
cell of the release calendar with a doubled version prefix, e.g.
`[vv2.35.0](.../tag/v2.35.0)`.

`version.String()` already returns a `v`-prefixed string (e.g.
`v2.35.0`),
but `updateCalendar` wrapped it in a `"[v%s]"` template, so the link
label
gained a second `v`. The tag URL was already correct because release
tags
carry the `v` prefix.

## Fix

Drop the extra `v` from the label template (`"[v%s]"` → `"[%s]"`). The
URL is
unchanged.

- Label before: `[vv2.35.0]`
- Label after: `[v2.35.0]`

## Test

Added `TestUpdateCalendarLatestReleaseVersionPrefix`, which asserts the
`LatestRelease` cell for a matching row on both a patch and a minor
release.
It fails on the old code (`[vv2.35.x]`) and passes with the fix.

<details>
<summary>Investigation notes</summary>

- Entry path: `scripts/release.sh` → `go run ./scripts/releaser` →
  `runRelease` → `promptAndUpdateDocs` → `updateReleaseDocs` →
  `updateCalendarFile` → `updateCalendar` (`scripts/releaser/docs.go`).
- Root cause in `updateCalendar`: `fmt.Sprintf("[v%s](%s)",
newVer.String(), ...)`
  combined with `version.String()` returning `v%d.%d.%d`.
- Only the link label was affected; the `releaseTagURLFmt` URL was
correct
  because tags are `v`-prefixed.
- The standalone `scripts/update-release-calendar.sh` is a separate
implementation and is not affected (it strips the `v` before re-adding
one).
- The same logic exists on `main` at `scripts/releaser/v1/docs.go`; this
PR
  targets `release/2.35`.

</details>

---
This PR was generated by Coder Agents.

Backport of #27206

Original PR: #27206 — fix(site): replace ansi-to-html in the log viewer
Merge commit: b377bec
Requested by: @aslilac

Co-authored-by: McKayla はな <mckayla@hey.com>

Backport of #27274

Original PR: #27274 — fix(coderd): harden oauth2 redirect validation
Merge commit: 2f87991
Requested by: @aslilac