Repository navigation
RTECO-1263 - Fixed Content Reader race panic - #3502
Merged
Merged
Conversation
fluxxBot
added
the
safe to test
fluxxBot
marked this pull request as ready for review
May 21, 2026 12:07
fluxxBot
force-pushed
the
RTECO-1263-readerPanic
branch
from
May 21, 2026 12:08
ff1257b to
7b5a0d8
Compare
fluxxBot
added
safe to test
udaykb2
approved these changes
May 21, 2026
fluxxBot
added
bug
fluxxBot
enabled auto-merge (squash)
May 21, 2026 12:10
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
jfrog-cli 2.104.1 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>## What changed in v2.104.1 > Auto-generated from 6 repositories · 2026-05-22 > Comparing `v2.103.0` → `v2.104.1` > ℹ️ No changes in: gofrog ### ✨ New Features - **[build-info-go]** Enhance Yarn module to support workspace projects and non-registry de… [#379](jfrog/build-info-go#379) (@fluxxBot) - **[jfrog-cli]** Add common --format flag support [#3454](jfrog/jfrog-cli#3454) (@ehl-jf) - **[jfrog-cli]** Add --format flag support to rt commands [#3456](jfrog/jfrog-cli#3456) (@ehl-jf) - **[jfrog-cli]** Add usage report for `jf api` [#3479](jfrog/jfrog-cli#3479) (@ehl-jf) - **[jfrog-cli]** RTECO-1017 - Enrich User-Agent with agent/CI context and reuse Cursor… [#3468](jfrog/jfrog-cli#3468) (@fluxxBot) - **[jfrog-cli]** RTECO-1035 - Added Support for yarn v4 [#3440](jfrog/jfrog-cli#3440) (@fluxxBot) - **[jfrog-cli-artifactory]** Add UV package manager setup support [#437](jfrog/jfrog-cli-artifactory#437) (@sverdlov93) - **[jfrog-cli-artifactory]** RTECO-1015 - Implement jf skills list command [#432](jfrog/jfrog-cli-artifactory#432) (@udaykb2) - **[jfrog-cli-artifactory]** RTECO-1016 - Implement skills update command [#434](jfrog/jfrog-cli-artifactory#434) (@udaykb2) - **[jfrog-cli-artifactory]** RTECO-1007 - Collect build-info on jf skills publish [#441](jfrog/jfrog-cli-artifactory#441) (@udaykb2) - **[jfrog-cli-artifactory]** Add --format flag support to artifactory commands [#435](jfrog/jfrog-cli-artifactory#435) (@ehl-jf) - **[jfrog-cli-artifactory]** RTECO-1035 - Added Support for yarn v4 [#422](jfrog/jfrog-cli-artifactory#422) (@fluxxBot) - **[jfrog-cli-core]** Add UV package manager support [#1549](jfrog/jfrog-cli-core#1549) (@sverdlov93) - **[jfrog-cli-core]** Add common --format flag support [#1547](jfrog/jfrog-cli-core#1547) (@ehl-jf) - **[jfrog-cli-core]** RTECO-1017 - Detect agent + CI invocation context, enrich metrics wit… [#1555](jfrog/jfrog-cli-core#1555) (@fluxxBot) - **[jfrog-cli-security]** Add cache and parallel run to Git Count Contributors [#701](jfrog/jfrog-cli-security#701) (@attiasas) - **[jfrog-client-go]** Add `SAST Fast Diff Mode` option to configuration profile [#1342](jfrog/jfrog-client-go#1342) (@attiasas) - **[jfrog-client-go]** RTECO-1015 - Implement ListSkills method to fetch skills [#1341](jfrog/jfrog-client-go#1341) (@udaykb2) ### 🐛 Bug Fixes - **[build-info-go]** RTECO-1265: fix(dotnet): preserve all per-TFM package versions in build-info [#381](jfrog/build-info-go#381) (@Edenb2131) - **[build-info-go]** RTECO-1265 - Fixed Nuget bracket based dependency resolution [#385](jfrog/build-info-go#385) (@fluxxBot) - **[jfrog-cli]** RTECO-992 - Fix uv build command build-info and update jfrog-cli-artifactory dependency [#3485](jfrog/jfrog-cli#3485) (@agrasth) - **[jfrog-cli]** RTECO-1263 - Fixed Content Reader race panic [#3502](jfrog/jfrog-cli#3502) (@fluxxBot) - **[jfrog-cli-artifactory]** Fix duplicate dependency entries in build-info for jf uv build and publish [#438](jfrog/jfrog-cli-artifactory#438) (@agrasth) - **[jfrog-cli-artifactory]** RTECO-992 - Restore build-info for jf uv build, clear artifacts only [#449](jfrog/jfrog-cli-artifactory#449) (@agrasth) - **[jfrog-cli-core]** JGC-471 - Fix npm output format parsing [#1551](jfrog/jfrog-cli-core#1551) (@ehl-jf) - **[jfrog-cli-core]** Fix #delayed multiarch image list.manifest files are not getting migr… [#1552](jfrog/jfrog-cli-core#1552) (@amithins) - **[jfrog-client-go]** Fix race in ContentReader causing 'send on closed channel' panic [#1347](jfrog/jfrog-client-go#1347) (@fluxxBot) ### 🔧 Internal Changes - **[build-info-go]** Bump Maven extractor to 2.43.9 and Gradle4 extractor to 4.35.9 [#383](jfrog/build-info-go#383) (@agrasth) - **[jfrog-cli-artifactory]** RTECO-1048 - Improve skills install command [#446](jfrog/jfrog-cli-artifactory#446) (@udaykb2) - **[jfrog-cli-artifactory]** RTECO-1011 - Improve skill commands [#448](jfrog/jfrog-cli-artifactory#448) (@udaykb2) - **[jfrog-cli-security]** Update AnalyzerManager version to 1.33.0 [#748](jfrog/jfrog-cli-security#748) (@attiasas) ### 📦 Other Changes - **[jfrog-cli]** RTECO-1003 - Updated branch name for jfrog-cli [#3467](jfrog/jfrog-cli#3467) (@naveenku-jfrog) - **[jfrog-cli]** Remove the `how` command [#3494](jfrog/jfrog-cli#3494) (@ehl-jf) - **[jfrog-cli-artifactory]** Show list and update in jf skills help [#451](jfrog/jfrog-cli-artifactory#451) (@udaykb2) - **[jfrog-client-go]** CVE-2025-11579 [#1289](jfrog/jfrog-client-go#1289) (@saya-entro) --- ### 📊 Summary | Repository | Changes | |---|---| | [jfrog-cli-artifactory](https://github.com/jfrog/jfrog-cli-artifactory) | 11 | | [jfrog-cli](https://github.com/jfrog/jfrog-cli) | 9 | | [jfrog-cli-core](https://github.com/jfrog/jfrog-cli-core) | 5 | | [build-info-go](https://github.com/jfrog/build-info-go) | 4 | | [jfrog-client-go](https://github.com/jfrog/jfrog-client-go) | 4 | | [jfrog-cli-security](https://github.com/jfrog/jfrog-cli-security) | 2 | | **Total** | **35** | ### 🔗 Module Version Changes | Module | From | To | |---|---|---| | [build-info-go](https://github.com/jfrog/build-info-go) | `v1.13.1-0.20260429070557-93b98034d295` | `v1.13.1-0.20260521104402-1e35b9b5b0c6` | | [jfrog-cli-artifactory](https://github.com/jfrog/jfrog-cli-artifactory) | `v0.8.1-0.20260429074430-a5871f2898b5` | `v0.8.1-0.20260520131142-ef80a14dd499` | | [jfrog-cli-core](https://github.com/jfrog/jfrog-cli-core) | `v2.60.1-0.20260429073430-5723b4f21705` | `v2.60.1-0.20260520130103-75be6a23c54b` | | [jfrog-cli-security](https://github.com/jfrog/jfrog-cli-security) | `v1.28.0` | `v1.29.0` | | [jfrog-client-go](https://github.com/jfrog/jfrog-client-go) | `v1.55.1-0.20260428070955-750b933dc5c7` | `v1.55.1-0.20260521115926-32f082854b39` | </pre> <p>View the full release notes at <a href="https://github.com/jfrog/jfrog-cli/releases/tag/v2.104.1">https://github.com/jfrog/jfrog-cli/releases/tag/v2.104.1</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!5774
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
masterbranch.go vet ./....go fmt ./....Summary
Fixes
panic: send on closed channelinContentReadertriggered intermittently by concurrent use ofNextRecordandReset(or by callers that invokeResetinternally, e.g.Length,SortContentReader).Resolves RTECO-1263.
Background
ContentReader.NextRecordspawns a producer goroutine once (viasync.Once) that streams JSON array elements from one or more files intocr.dataChannel. The receiver inNextRecordand the producer inreadSingleFileboth readcr.dataChannelfrom the struct field on each access.Reset()replaces bothcr.dataChannelandcr.oncewithout any synchronization. This created three independent race conditions that together produce the panic:Reset()had swapped the channelfield. The producer's next send would land on the new channel, which could already have been closed by the next cycle's
defer close.NextRecordcould fireonce.Doagainst the oldonce, then readcr.dataChannelafterReset()had swapped both fields, causing the receiverand producer to operate on different channels (deadlock).
defer close(cr.dataChannel)evaluates the channel argument at defer-registration time, butcr.dataChannel <- itemre-reads the field on everysend. The defer and the send could refer to two different channels.
The race is timing-dependent; it surfaces in CI under load (e.g.
TestPushFatManifestImageWithNestedPathin the docker test suite) but is hard to reproduce locally without-raceand concurrent stress.
Stack trace from the failing CI run:
panic: send on closed channel
goroutine 2699 [running]:
github.com/jfrog/jfrog-client-go/utils/io/content.(*ContentReader).readSingleFile
.../utils/io/content/contentreader.go:216 +0x492
github.com/jfrog/jfrog-client-go/utils/io/content.(*ContentReader).run(...)
.../utils/io/content/contentreader.go:178
github.com/jfrog/jfrog-client-go/utils/io/content.(*ContentReader).NextRecord.func1.1()
.../utils/io/content/contentreader.go:78 +0x7a