Skip to content

fix: Hub lifecycle — wg race, TOCTOU, Go 1.27 - #2

Merged
kolkov merged 3 commits into
mainfrom
fix/hub-lifecycle
Sep 10, 2026
Merged

kolkov merged 3 commits into
mainfrom
fix/hub-lifecycle

Conversation

@kolkov

@kolkov kolkov commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Fixes all 3 blockers from Fable 5.1 audit. Validated clean by Fable.

B1: go.mod updated to Go 1.27 (json/v2 requires it).
B2: wg.Add(1) moved to NewHub() — prevents Close() racing with Run() startup.
B3: Register/Unregister/Broadcast use select with done channel instead of
    TOCTOU (RLock→check closed→RUnlock→send). No more panic on closed channel.
    Close() no longer closes register/unregister/broadcast channels.
- WebSocket Hub: added 'started' flag — Close() without Run() no longer deadlocks,
  double Run() returns immediately
- SSE Hub: Register/Unregister/Broadcast use select with done channel
  (double-select pattern: check done first, then try send)
- CI: Go 1.25 → 1.27 in all workflows
- README: removed 'timeouts' claim (no deadlines implemented yet)
Double Run or Run-after-Close no longer panics. Guard branch
returns silently without touching WaitGroup counter.
Close without Run returns immediately via started flag.
@kolkov
kolkov merged commit 07f08c1 into main Sep 10, 2026
@codecov

codecov Bot commented Sep 10, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 86.36364% with 6 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
websocket/hub.go 79.31% 6 Missing ⚠️

📢 Thoughts on this report? Let us know!

@kolkov
kolkov deleted the fix/hub-lifecycle branch September 10, 2026 21:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant