go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/docker/go-metrics v0.0.1
 	github.com/go-jose/go-jose/v3 v3.0.1
 	github.com/google/uuid v1.3.1
-	github.com/gorilla/handlers v1.5.1
+	github.com/gorilla/handlers v1.5.2
 	github.com/gorilla/mux v1.8.1
 	github.com/hashicorp/golang-lru/arc/v2 v2.0.5
 	github.com/klauspost/compress v1.17.4

go.sum

@@ -76,7 +76,6 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -136,8 +135,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9
 github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
 github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
-github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4=
-github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
+github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
+github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=

vendor/github.com/gorilla/handlers/.editorconfig

@@ -0,0 +1,20 @@
+; https://editorconfig.org/
+
+root = true
+
+[*]
+insert_final_newline = true
+charset = utf-8
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[{Makefile,go.mod,go.sum,*.go,.gitmodules}]
+indent_style = tab
+indent_size = 4
+
+[*.md]
+indent_size = 4
+trim_trailing_whitespace = false
+
+eclint_indent_style = unset

vendor/github.com/gorilla/handlers/.gitignore

@@ -0,0 +1,2 @@
+# Output of the go test coverage tool
+coverage.coverprofile

vendor/github.com/gorilla/handlers/LICENSE

@@ -1,22 +1,27 @@
-Copyright (c) 2013 The Gorilla Handlers Authors. All rights reserved.
+Copyright (c) 2023 The Gorilla Authors. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
+modification, are permitted provided that the following conditions are
+met:
 
-  Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
+	 * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+	 * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+	 * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
 
-  Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/gorilla/handlers/Makefile

@@ -0,0 +1,34 @@
+GO_LINT=$(shell which golangci-lint 2> /dev/null || echo '')
+GO_LINT_URI=github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+
+GO_SEC=$(shell which gosec 2> /dev/null || echo '')
+GO_SEC_URI=github.com/securego/gosec/v2/cmd/gosec@latest
+
+GO_VULNCHECK=$(shell which govulncheck 2> /dev/null || echo '')
+GO_VULNCHECK_URI=golang.org/x/vuln/cmd/govulncheck@latest
+
+.PHONY: verify
+verify: sec govulncheck lint test
+
+.PHONY: lint
+lint:
+	$(if $(GO_LINT), ,go install $(GO_LINT_URI))
+	@echo "##### Running golangci-lint #####"
+	golangci-lint run -v
+
+.PHONY: sec
+sec:
+	$(if $(GO_SEC), ,go install $(GO_SEC_URI))
+	@echo "##### Running gosec #####"
+	gosec ./...
+
+.PHONY: govulncheck
+govulncheck:
+	$(if $(GO_VULNCHECK), ,go install $(GO_VULNCHECK_URI))
+	@echo "##### Running govulncheck #####"
+	govulncheck ./...
+
+.PHONY: test
+test:
+	@echo "##### Running tests #####"
+	go test -race -cover -coverprofile=coverage.coverprofile -covermode=atomic -v ./...

vendor/github.com/gorilla/handlers/README.md

@@ -1,9 +1,9 @@
-gorilla/handlers
-================
-[![GoDoc](https://godoc.org/github.com/gorilla/handlers?status.svg)](https://godoc.org/github.com/gorilla/handlers)
-[![CircleCI](https://circleci.com/gh/gorilla/handlers.svg?style=svg)](https://circleci.com/gh/gorilla/handlers)
-[![Sourcegraph](https://sourcegraph.com/github.com/gorilla/handlers/-/badge.svg)](https://sourcegraph.com/github.com/gorilla/handlers?badge)
+# gorilla/handlers
 
+![Testing](https://github.com/gorilla/handlers/actions/workflows/test.yml/badge.svg)
+[![Codecov](https://codecov.io/github/gorilla/handlers/branch/main/graph/badge.svg)](https://codecov.io/github/gorilla/handlers)
+[![GoDoc](https://godoc.org/github.com/gorilla/handlers?status.svg)](https://godoc.org/github.com/gorilla/handlers)
+[![Sourcegraph](https://sourcegraph.com/github.com/gorilla/handlers/-/badge.svg)](https://sourcegraph.com/github.com/gorilla/handlers?badge)
 
 Package handlers is a collection of handlers (aka "HTTP middleware") for use
 with Go's `net/http` package (or any framework supporting `http.Handler`), including:

vendor/github.com/gorilla/handlers/canonical.go

@@ -26,7 +26,6 @@ type canonical struct {
 //	r.HandleFunc("/route", YourHandler)
 //
 //	log.Fatal(http.ListenAndServe(":7000", canonical(r)))
-//
 func CanonicalHost(domain string, code int) func(h http.Handler) http.Handler {
 	fn := func(h http.Handler) http.Handler {
 		return canonical{h, domain, code}

vendor/github.com/gorilla/handlers/compress.go

@@ -44,13 +44,13 @@ type flusher interface {
 	Flush() error
 }
 
-func (w *compressResponseWriter) Flush() {
+func (cw *compressResponseWriter) Flush() {
 	// Flush compressed data if compressor supports it.
-	if f, ok := w.compressor.(flusher); ok {
-		f.Flush()
+	if f, ok := cw.compressor.(flusher); ok {
+		_ = f.Flush()
 	}
 	// Flush HTTP response.
-	if f, ok := w.w.(http.Flusher); ok {
+	if f, ok := cw.w.(http.Flusher); ok {
 		f.Flush()
 	}
 }

vendor/github.com/gorilla/handlers/cors.go

@@ -26,14 +26,14 @@ type cors struct {
 type OriginValidator func(string) bool
 
 var (
-	defaultCorsOptionStatusCode = 200
-	defaultCorsMethods          = []string{"GET", "HEAD", "POST"}
+	defaultCorsOptionStatusCode = http.StatusOK
+	defaultCorsMethods          = []string{http.MethodGet, http.MethodHead, http.MethodPost}
 	defaultCorsHeaders          = []string{"Accept", "Accept-Language", "Content-Language", "Origin"}
-	// (WebKit/Safari v9 sends the Origin header by default in AJAX requests)
+	// (WebKit/Safari v9 sends the Origin header by default in AJAX requests).
 )
 
 const (
-	corsOptionMethod           string = "OPTIONS"
+	corsOptionMethod           string = http.MethodOptions
 	corsAllowOriginHeader      string = "Access-Control-Allow-Origin"
 	corsExposeHeadersHeader    string = "Access-Control-Expose-Headers"
 	corsMaxAgeHeader           string = "Access-Control-Max-Age"
@@ -101,11 +101,9 @@ func (ch *cors) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		if !ch.isMatch(method, defaultCorsMethods) {
 			w.Header().Set(corsAllowMethodsHeader, method)
 		}
-	} else {
-		if len(ch.exposedHeaders) > 0 {
+	} else if len(ch.exposedHeaders) > 0 {
 		w.Header().Set(corsExposeHeadersHeader, strings.Join(ch.exposedHeaders, ","))
 	}
-	}
 
 	if ch.allowCredentials {
 		w.Header().Set(corsAllowCredentialsHeader, "true")
@@ -156,7 +154,6 @@ func (ch *cors) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 //	    // Apply the CORS middleware to our top-level router, with the defaults.
 //	    http.ListenAndServe(":8000", handlers.CORS()(r))
 //	}
-//
 func CORS(opts ...CORSOption) func(http.Handler) http.Handler {
 	return func(h http.Handler) http.Handler {
 		ch := parseCORSOptions(opts...)
@@ -174,7 +171,7 @@ func parseCORSOptions(opts ...CORSOption) *cors {
 	}
 
 	for _, option := range opts {
-		option(ch)
+		_ = option(ch) //TODO: @bharat-rajani, return error to caller if not nil?
 	}
 
 	return ch

vendor/github.com/gorilla/handlers/handlers.go

@@ -35,7 +35,7 @@ func (h MethodHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		}
 		sort.Strings(allow)
 		w.Header().Set("Allow", strings.Join(allow, ", "))
-		if req.Method == "OPTIONS" {
+		if req.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusOK)
 		} else {
 			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
@@ -44,7 +44,7 @@ func (h MethodHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 }
 
 // responseLogger is wrapper of http.ResponseWriter that keeps track of its HTTP
-// status code and body size
+// status code and body size.
 type responseLogger struct {
 	w      http.ResponseWriter
 	status int
@@ -97,7 +97,7 @@ func isContentType(h http.Header, contentType string) bool {
 // Only PUT, POST, and PATCH requests are considered.
 func ContentTypeHandler(h http.Handler, contentTypes ...string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !(r.Method == "PUT" || r.Method == "POST" || r.Method == "PATCH") {
+		if !(r.Method == http.MethodPut || r.Method == http.MethodPost || r.Method == http.MethodPatch) {
 			h.ServeHTTP(w, r)
 			return
 		}
@@ -108,7 +108,10 @@ func ContentTypeHandler(h http.Handler, contentTypes ...string) http.Handler {
 				return
 			}
 		}
-		http.Error(w, fmt.Sprintf("Unsupported content type %q; expected one of %q", r.Header.Get("Content-Type"), contentTypes), http.StatusUnsupportedMediaType)
+		http.Error(w, fmt.Sprintf("Unsupported content type %q; expected one of %q",
+			r.Header.Get("Content-Type"),
+			contentTypes),
+			http.StatusUnsupportedMediaType)
 	})
 }
 
@@ -133,12 +136,12 @@ const (
 // Form method takes precedence over header method.
 func HTTPMethodOverrideHandler(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "POST" {
+		if r.Method == http.MethodPost {
 			om := r.FormValue(HTTPMethodOverrideFormKey)
 			if om == "" {
 				om = r.Header.Get(HTTPMethodOverrideHeader)
 			}
-			if om == "PUT" || om == "PATCH" || om == "DELETE" {
+			if om == http.MethodPut || om == http.MethodPatch || om == http.MethodDelete {
 				r.Method = om
 			}
 		}

vendor/github.com/gorilla/handlers/logging.go

@@ -18,7 +18,7 @@ import (
 
 // Logging
 
-// LogFormatterParams is the structure any formatter will be handed when time to log comes
+// LogFormatterParams is the structure any formatter will be handed when time to log comes.
 type LogFormatterParams struct {
 	Request    *http.Request
 	URL        url.URL
@@ -27,7 +27,7 @@ type LogFormatterParams struct {
 	Size       int
 }
 
-// LogFormatter gives the signature of the formatter function passed to CustomLoggingHandler
+// LogFormatter gives the signature of the formatter function passed to CustomLoggingHandler.
 type LogFormatter func(writer io.Writer, params LogFormatterParams)
 
 // loggingHandler is the http.Handler implementation for LoggingHandlerTo and its
@@ -46,7 +46,10 @@ func (h loggingHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 
 	h.handler.ServeHTTP(w, req)
 	if req.MultipartForm != nil {
-		req.MultipartForm.RemoveAll()
+		err := req.MultipartForm.RemoveAll()
+		if err != nil {
+			return
+		}
 	}
 
 	params := LogFormatterParams{
@@ -76,7 +79,7 @@ const lowerhex = "0123456789abcdef"
 
 func appendQuoted(buf []byte, s string) []byte {
 	var runeTmp [utf8.UTFMax]byte
-	for width := 0; len(s) > 0; s = s[width:] {
+	for width := 0; len(s) > 0; s = s[width:] { //nolint: wastedassign //TODO: why width starts from 0and reassigned as 1
 		r := rune(s[0])
 		width = 1
 		if r >= utf8.RuneSelf {
@@ -191,7 +194,7 @@ func buildCommonLogLine(req *http.Request, url url.URL, ts time.Time, status int
 func writeLog(writer io.Writer, params LogFormatterParams) {
 	buf := buildCommonLogLine(params.Request, params.URL, params.TimeStamp, params.StatusCode, params.Size)
 	buf = append(buf, '\n')
-	writer.Write(buf)
+	_, _ = writer.Write(buf)
 }
 
 // writeCombinedLog writes a log entry for req to w in Apache Combined Log Format.
@@ -204,7 +207,7 @@ func writeCombinedLog(writer io.Writer, params LogFormatterParams) {
 	buf = append(buf, `" "`...)
 	buf = appendQuoted(buf, params.Request.UserAgent())
 	buf = append(buf, '"', '\n')
-	writer.Write(buf)
+	_, _ = writer.Write(buf)
 }
 
 // CombinedLoggingHandler return a http.Handler that wraps h and logs requests to out in
@@ -212,7 +215,7 @@ func writeCombinedLog(writer io.Writer, params LogFormatterParams) {
 //
 // See http://httpd.apache.org/docs/2.2/logs.html#combined for a description of this format.
 //
-// LoggingHandler always sets the ident field of the log to -
+// LoggingHandler always sets the ident field of the log to -.
 func CombinedLoggingHandler(out io.Writer, h http.Handler) http.Handler {
 	return loggingHandler{out, h, writeCombinedLog}
 }
@@ -232,13 +235,12 @@ func CombinedLoggingHandler(out io.Writer, h http.Handler) http.Handler {
 //	})
 //	loggedRouter := handlers.LoggingHandler(os.Stdout, r)
 //	http.ListenAndServe(":1123", loggedRouter)
-//
 func LoggingHandler(out io.Writer, h http.Handler) http.Handler {
 	return loggingHandler{out, h, writeLog}
 }
 
 // CustomLoggingHandler provides a way to supply a custom log formatter
-// while taking advantage of the mechanisms in this package
+// while taking advantage of the mechanisms in this package.
 func CustomLoggingHandler(out io.Writer, h http.Handler, f LogFormatter) http.Handler {
 	return loggingHandler{out, h, f}
 }

vendor/github.com/gorilla/handlers/proxy_headers.go

@@ -18,7 +18,7 @@ var (
 var (
 	// RFC7239 defines a new "Forwarded: " header designed to replace the
 	// existing use of X-Forwarded-* headers.
-	// e.g. Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43
+	// e.g. Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43.
 	forwarded = http.CanonicalHeaderKey("Forwarded")
 	// Allows for a sub-match of the first value after 'for=' to the next
 	// comma, semi-colon or space. The match is case-insensitive.
@@ -67,7 +67,9 @@ func ProxyHeaders(h http.Handler) http.Handler {
 func getIP(r *http.Request) string {
 	var addr string
 
-	if fwd := r.Header.Get(xForwardedFor); fwd != "" {
+	switch {
+	case r.Header.Get(xForwardedFor) != "":
+		fwd := r.Header.Get(xForwardedFor)
 		// Only grab the first (client) address. Note that '192.168.0.1,
 		// 10.1.1.1' is a valid key for X-Forwarded-For where addresses after
 		// the first may represent forwarding proxies earlier in the chain.
@@ -76,17 +78,15 @@ func getIP(r *http.Request) string {
 			s = len(fwd)
 		}
 		addr = fwd[:s]
-	} else if fwd := r.Header.Get(xRealIP); fwd != "" {
-		// X-Real-IP should only contain one IP address (the client making the
-		// request).
-		addr = fwd
-	} else if fwd := r.Header.Get(forwarded); fwd != "" {
+	case r.Header.Get(xRealIP) != "":
+		addr = r.Header.Get(xRealIP)
+	case r.Header.Get(forwarded) != "":
 		// match should contain at least two elements if the protocol was
 		// specified in the Forwarded header. The first element will always be
 		// the 'for=' capture, which we ignore. In the case of multiple IP
 		// addresses (for=8.8.8.8, 8.8.4.4,172.16.1.20 is valid) we only
 		// extract the first, which should be the client IP.
-		if match := forRegex.FindStringSubmatch(fwd); len(match) > 1 {
+		if match := forRegex.FindStringSubmatch(r.Header.Get(forwarded)); len(match) > 1 {
 			// IPv6 addresses in Forwarded headers are quoted-strings. We strip
 			// these quotes.
 			addr = strings.Trim(match[1], `"`)

vendor/github.com/gorilla/handlers/recovery.go

@@ -50,20 +50,22 @@ func RecoveryHandler(opts ...RecoveryOption) func(h http.Handler) http.Handler {
 }
 
 // RecoveryLogger is a functional option to override
-// the default logger
+// the default logger.
 func RecoveryLogger(logger RecoveryHandlerLogger) RecoveryOption {
 	return func(h http.Handler) {
-		r := h.(*recoveryHandler)
+		r := h.(*recoveryHandler) //nolint:errcheck //TODO:
+		// @bharat-rajani should return type-assertion error but would break the API?
 		r.logger = logger
 	}
 }
 
 // PrintRecoveryStack is a functional option to enable
 // or disable printing stack traces on panic.
-func PrintRecoveryStack(print bool) RecoveryOption {
+func PrintRecoveryStack(shouldPrint bool) RecoveryOption {
 	return func(h http.Handler) {
-		r := h.(*recoveryHandler)
-		r.printStack = print
+		r := h.(*recoveryHandler) //nolint:errcheck //TODO:
+		// @bharat-rajani should return type-assertion error but would break the API?
+		r.printStack = shouldPrint
 	}
 }
 

vendor/modules.txt

@@ -243,8 +243,8 @@ github.com/googleapis/gax-go/v2
 github.com/googleapis/gax-go/v2/apierror
 github.com/googleapis/gax-go/v2/apierror/internal/proto
 github.com/googleapis/gax-go/v2/internal
-# github.com/gorilla/handlers v1.5.1
-## explicit; go 1.14
+# github.com/gorilla/handlers v1.5.2
+## explicit; go 1.20
 github.com/gorilla/handlers
 # github.com/gorilla/mux v1.8.1
 ## explicit; go 1.20