Uber's goleak Library Helps Go Developers Detect Goroutine Leaks During Tests

·1 views

Goroutine leaks in Go services can cause memory to grow silently over time, yet standard tools like go test and go vet fail to detect them. Uber's open-source goleak library addresses this gap by checking for lingering goroutines after tests complete. Developers can integrate it package-wide via TestMain or guard individual tests using a deferred VerifyNone call. When a leak is found, goleak reports the goroutine's spawn site, current stack frame, and scheduler state, giving developers a precise diagnosis. Known long-running background goroutines, such as those from database/sql, can be whitelisted using the IgnoreTopFunction option to avoid false positives.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Real-World Prompt Injection Attack Nearly Hijacks Developer's AI Coding Agent

A developer recently reported that their AI coding agent was almost compromised by a prompt injection attack during an automated, unsupervised task. The malicious input attempted to override the agent's original instructions and redirect its behavior toward unintended actions. Unlike prompt injection in simple chatbots, attacks on coding agents carry far greater risk because these tools can execute code, access filesystems, make API calls, and interact with repositories. Security experts warn that AI agents cannot reliably distinguish between data they should process and instructions they should follow, making every external input a potential attack vector. Developers are urged to apply minimal privilege principles, treat external data sources as untrusted inputs, and maintain human oversight during agentic tasks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Coding Agents Lack a Shared Workspace, Forcing Developers to Rebuild Context Repeatedly

Developers frequently lose accumulated project context—rules, decisions, and agent findings—each time they switch AI coding tools, because no persistent shared workspace exists across models. Current AI coding setups consist of chat windows, codebases, and IDE extensions, but nothing centrally holds the collective thinking or reasoning behind the code. When a new model is adopted, users must re-explain their entire project from scratch, since chat histories are siloed within individual tools and disappear when sessions close. A shared workspace—where multiple agents like Claude, ChatGPT, and Codex read from and write to a common source of truth—could eliminate redundant work and preserve continuity across sessions. The author states this gap is what their product, Memeri, aims to address, positioning it as a persistent workspace layer that sits above individual AI models.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Channels vs Mutexes in Go: How to Choose the Right Concurrency Tool

A technical guide for Go developers clarifies a commonly misunderstood concurrency proverb: 'share memory by communicating' is a design hint, not a strict rule. Mutexes are best when data stays in one place and multiple goroutines need guarded access, such as counters, caches, or connection pools. Channels are more appropriate when data moves from one owner to another, as in worker pools or pipelines, where a send effectively transfers ownership. A key pitfall highlighted is modifying data after sending it over a channel, which can cause data races since the sender no longer owns the underlying memory. The practical takeaway is to ask whether data 'stays put' or 'moves,' then choose the tool that matches that behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Detect Honeypot Crypto Tokens Before Buying Using On-Chain Tools

Honeypot tokens allow purchases but block sellers through hidden contract conditions, making them one of the few crypto scams detectable before investing. Key red flags include high sell taxes, owner powers to pause or blacklist transfers, mintable supply, upgradeable proxy contracts, and deployer wallets with a history of scams. Free tools like honeypot.is and the GoPlus token security API can simulate trades and audit contract permissions without requiring an account. A Telegram bot called @RugLens_bot automates the entire checklist for both EVM and TON chains, returning a scored safety report within seconds. Analysts caution that a clean report rules out mechanical traps but does not guarantee a token is a sound investment, as developers can still dump holdings through legitimate contracts.

0 comments Read more at DEV Community