From e1ea26d386e18f7b8fa9c60eb8e8d8696933442a Mon Sep 17 00:00:00 2001 From: Yadian Llada Lopez Date: Sat, 19 Sep 2026 11:30:14 -0400 Subject: [PATCH] fix(shared/http): close idle connections to stop updater connection leak Each Download call built a fresh http.Transport whose pool was discarded on return, so net/http returned the keep-alive connection to a pool that nothing ever reclaimed. The updater polls the dependencies endpoint every 5 minutes, leaking one idle connection per poll until endpoints accumulated thousands of ESTABLISHED sockets. DownloadAndVerify doubles the leak (two downloads per call). Close idle connections explicitly on return (DisableCompression already set to match the per-call transport). Same fix as the v11 backport. --- shared/http/download.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/shared/http/download.go b/shared/http/download.go index d00dcc49c..657da7a67 100644 --- a/shared/http/download.go +++ b/shared/http/download.go @@ -43,6 +43,7 @@ func Download(url, destDir, filename string, opts DownloadOptions) error { TLSClientConfig: &tls.Config{ InsecureSkipVerify: opts.SkipTLSVerify, }, + DisableCompression: true, } client := &http.Client{ @@ -50,6 +51,8 @@ func Download(url, destDir, filename string, opts DownloadOptions) error { Transport: transport, } + defer transport.CloseIdleConnections() + req, err := http.NewRequest(http.MethodGet, url, nil) if err != nil { return fmt.Errorf("error creating request: %w", err)