fix(shared/http): close idle connections to stop updater connection leak - #2648
Merged
Merged
Conversation
Each Download call built a fresh http.Transport whose pool was discarded on return, so net/http returned the keep-alive connection to a pool that nothing ever reclaimed. The updater polls the dependencies endpoint every 5 minutes, leaking one idle connection per poll until endpoints accumulated thousands of ESTABLISHED sockets. DownloadAndVerify doubles the leak (two downloads per call). Close idle connections explicitly on return (DisableCompression already set to match the per-call transport). Same fix as the v11 backport.
3 tasks
🛑 AI review — High/critical findingsOne or more high/critical issues were found. Please review and fix before merging if they're real. 🛑
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Same connection leak as the v11 backport: Download builds a fresh http.Transport per call and never reclaims its pooled keep-alive connection, so every download leaks an ESTABLISHED socket. The updater polls the dependencies endpoint every 5 minutes, accumulating one idle connection per poll until endpoints hit thousands.
Root Cause
net/http returns a fully-read response's connection to the transport's idle pool instead of closing the socket. The per-call transport is discarded on return, so nothing calls CloseIdleConnections() and the socket stays open until the server-side keep-alive timeout (or forever).