Affected by GO-2026-5996 and 2 other vulnerabilities

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

GO-2026-6526: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive

syncutil

package

v0.28.2 Latest Latest Go to latest Published: May 21, 2026 License: Apache-2.0 Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/stacklok/toolhive

Links

Documentation ¶

Overview ¶

Package syncutil provides concurrency utilities.

Index ¶

type AtMost
- func NewAtMost(interval time.Duration) *AtMost
- func (a *AtMost) Do(fn func())

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type AtMost ¶

type AtMost struct {
	// contains filtered or unexported fields
}

AtMost executes a function at most once per the configured interval. Subsequent calls within the interval are silently skipped. Safe for concurrent use from multiple goroutines.

func NewAtMost ¶

func NewAtMost(interval time.Duration) *AtMost

NewAtMost creates an AtMost that allows execution at most once per interval. The first call to Do always executes.

func (*AtMost) Do ¶

func (a *AtMost) Do(fn func())

Do calls fn if at least interval has elapsed since the last successful invocation. Otherwise the call is silently skipped. The first call always executes because last is initialized to zero, which is treated as "never called".

Source Files ¶

View all Source files

atmost.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL