* fix(http): wait for the prefetch goroutine to exit before reusing its file
stopPrefetchAndCopyData waited at most 10 s for the Resolve prefetch, but a
stalled body read only times out after readTimeout (15 s). The caller then
closed and removed the temporary file while the prefetch goroutine could
still write to it.
Stopping the prefetch now closes the Resolve body, which interrupts a
pending read, and waits on a channel closed when the goroutine exits. Pause
uses the same path. The stop channel is closed under resolveRespLock so a
concurrent Pause and first-connection takeover cannot close it twice.
The proxy test helper now calls Setup before Resolve, as the downloader
does, so the Resolve request also goes through the proxy.
Fixes#1563
* refactor(http): wait on prefetchExitCh in completeFromResolveFallback
Replaces the 10 ms polling loop with the exit channel added in the
previous commit, so every place that waits for the prefetch uses it.
---------
Co-authored-by: Levi <[email protected]>
govulncheck (-tags nosqlite,web ./cmd/web/... and ./cmd/api/...) reports
40 reachable vulnerabilities in 10 modules on main. This update fixes 34
of them and keeps the go directive at 1.25.4, the version CI uses.
- github.com/go-git/go-git/v5 v5.8.1 -> v5.19.2: GO-2024-2456,
GO-2024-2466, GO-2025-3367, GO-2025-3368, GO-2026-4473, GO-2026-4909,
GO-2026-4910, GO-2026-5074, GO-2026-5105, GO-2026-5336, GO-2026-5496,
GO-2026-5693, GO-2026-6213, GO-2026-6214
- github.com/go-git/go-billy/v5 v5.4.1 -> v5.9.2: GO-2026-5490,
GO-2026-5597
- golang.org/x/crypto v0.48.0 -> v0.55.0: GO-2026-5013, GO-2026-5015,
GO-2026-5017, GO-2026-5018, GO-2026-5019, GO-2026-5020, GO-2026-5021
- golang.org/x/net v0.50.0 -> v0.58.0: GO-2026-4559, GO-2026-5026,
GO-2026-5942
- golang.org/x/text v0.34.0 -> v0.41.0: GO-2026-5970
- github.com/imroc/req/v3 v3.52.2 -> v3.58.0, which brings
github.com/quic-go/quic-go v0.51.0 -> v0.59.0 (GO-2025-4017) and
github.com/refraction-networking/utls v1.6.7 -> v1.8.2 (GO-2025-3638,
GO-2026-4509, GO-2026-4512). req v3.52.2 does not build against a
quic-go with the fix.
- github.com/pion/dtls/v3 v3.0.10 -> v3.1.4: GO-2026-6165
- github.com/pion/stun/v3 v3.1.1 -> v3.1.5: GO-2026-6163
- github.com/cloudflare/circl v1.6.1 -> v1.6.3: GO-2026-4550
The other module changes are what go mod tidy needs for these.
Still open, because the fixed releases need Go 1.26: golang.org/x/net
GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617
(fixed in v0.60.0), and golang.org/x/crypto GO-2026-6354 and GO-2026-6355
(fixed in v0.56.0). GO-2026-6610 affects every x/net before v0.60.0;
govulncheck does not report it as reachable with v0.50.0, but does with
v0.56.0 and v0.58.0.
Co-authored-by: Levi <[email protected]>
The prefetch goroutine sets prefetchDone only after one more read and
closing the body. A Start in that window took the whole file as the
fallback snapshot, expandConnections marked the task done, and the temp
file was never copied, leaving a zero-filled target.
Read prefetchSize once and treat the prefetch as complete when it reached
the known size.
Replace server startup panics with returned errors, print actionable CLI
messages with exit status 1, and clarify the API token flags.
Add regressions for missing web authentication credentials.
FixesGopeedLab/gopeed#1614
Levi
Konstantin OstrovskiiandLevi
Silas MariuszandLevi
Codess
Junker der Provinz
WuFeng
HouKangle
Arpit Khandelwal
OKAN TIKTAS
Ashish Goswami
Kunpeng Xie
UltraGeek0102
JiangJiang
doctor-martin-sowa