go/pkg
Snider bf1f8e51ad fix: Codex review round 2 — path traversal, shutdown order, races
High:
- embed.Extract: safePath validates all rendered paths stay under targetDir
- embed.path: reject .. traversal on arbitrary fs.FS
- ServiceShutdown: drain background tasks BEFORE stopping services

Medium:
- cli.Run: command lookup holds registry RLock (race fix)
- NewWithFactories: propagate factory/registration failures

Co-Authored-By: Virgil <virgil@lethean.io>
2026-03-20 17:35:09 +00:00
..
core fix: Codex review round 2 — path traversal, shutdown order, races 2026-03-20 17:35:09 +00:00