chore(deps): bump github.com/v8fg/kit4go in /

[dependabot]

Bumps github.com/v8fg/kit4go in / from 0.9.0 to 0.9.1.

Updates github.com/v8fg/kit4go from 0.9.0 to 0.9.1

Release notes

Sourced from github.com/v8fg/kit4go's releases.

v0.9.1

[0.9.1] — 2026-08-06

Post-v0.9.0 hardening: 10-round comprehensive audit (allocations, docs, API, algorithms, error handling, concurrency, resources, API contracts, dependencies, test quality, semantic correctness) — 19 real bugs + 2 CVEs fixed, 7 dependency bumps, performance + doc improvements. Patch release (no breaking changes).

Security

• grpcclient + grpcserver: google.golang.org/grpc v1.82.0 → v1.82.1 (GO-2026-6061: xDS RBAC + HTTP/2 transport vulnerabilities).
• cert: golang.org/x/text v0.38.0 → v0.39.0 (GO-2026-5970: infinite loop on invalid input, reachable via autocert).

Fixed

• money.Allocate — negative amount + zero ratio: the zero-ratio bucket received a non-zero share (wrong distribution, not lost cents). The remainder selector now skips zero-ratio buckets.
• iterx.Range — step that overflows start+step past MaxInt caused an infinite loop (overflow-guarded now).
• number.Round/RoundTrunc — unbounded precision caused math.Pow10 overflow → NaN and strings.Repeat → multi-GB OOM (capped at 100).
• decimal.Parse/Rescale/New — unbounded scale caused multi-GB allocation via strings.Repeat / big.Int.Exp (capped at 10000).
• wtimer — onPanic hook was a bare func field (data race between the wheel goroutine and SetOnPanic); changed to atomic.Pointer matching the kit convention.
• bloom.Merge — held two locks simultaneously (f→other), deadlocking under concurrent A.Merge(B)+B.Merge(A); now snapshots other's bits under RLock, releases, then merges.
• log4go.FileWriter — Stop nilled w.messages racing with Metrics reading len(messages); Metrics now checks the atomic closing flag instead.
• log4go.FileWriter rotateImpl — when rotation's OpenFile failed after the old file was already Closed, stale file/buf pointers caused use-after-close (records silently dropped); now nil'd so the next write retries cleanly.
• kafka (sarama) consumer group — Close didn't join the drainErrors goroutine; added a WaitGroup.
• consistenthash.New(nil id) — opaque nil-deref on first use; now panics at construction.
• base62.Decode — no uint64 overflow guard; long strings silently wrapped to wrong values (added overflow check, returns ErrInvalid).
• ringbuffer.New(cap<=0) — doc said "must be > 0" but code silently clamped to 1; now panics (matches ringbuf/slidingwindow).
• set.BenchmarkSetAdd — b.RunParallel raced on the non-concurrent-safe Set (concurrent map writes); fixed to single-goroutine.

Performance

... (truncated)

Changelog

Sourced from github.com/v8fg/kit4go's changelog.

[0.9.1] — 2026-08-06

Post-v0.9.0 hardening: 10-round comprehensive audit (allocations, docs, API, algorithms, error handling, concurrency, resources, API contracts, dependencies, test quality, semantic correctness) — 19 real bugs + 2 CVEs fixed, 7 dependency bumps, performance + doc improvements. Patch release (no breaking changes).

Security

• grpcclient + grpcserver: google.golang.org/grpc v1.82.0 → v1.82.1 (GO-2026-6061: xDS RBAC + HTTP/2 transport vulnerabilities).
• cert: golang.org/x/text v0.38.0 → v0.39.0 (GO-2026-5970: infinite loop on invalid input, reachable via autocert).

Fixed

• money.Allocate — negative amount + zero ratio: the zero-ratio bucket received a non-zero share (wrong distribution, not lost cents). The remainder selector now skips zero-ratio buckets.
• iterx.Range — step that overflows start+step past MaxInt caused an infinite loop (overflow-guarded now).
• number.Round/RoundTrunc — unbounded precision caused math.Pow10 overflow → NaN and strings.Repeat → multi-GB OOM (capped at 100).
• decimal.Parse/Rescale/New — unbounded scale caused multi-GB allocation via strings.Repeat / big.Int.Exp (capped at 10000).
• wtimer — onPanic hook was a bare func field (data race between the wheel goroutine and SetOnPanic); changed to atomic.Pointer matching the kit convention.
• bloom.Merge — held two locks simultaneously (f→other), deadlocking under concurrent A.Merge(B)+B.Merge(A); now snapshots other's bits under RLock, releases, then merges.
• log4go.FileWriter — Stop nilled w.messages racing with Metrics reading len(messages); Metrics now checks the atomic closing flag instead.
• log4go.FileWriter rotateImpl — when rotation's OpenFile failed after the old file was already Closed, stale file/buf pointers caused use-after-close (records silently dropped); now nil'd so the next write retries cleanly.
• kafka (sarama) consumer group — Close didn't join the drainErrors goroutine; added a WaitGroup.
• consistenthash.New(nil id) — opaque nil-deref on first use; now panics at construction.
• base62.Decode — no uint64 overflow guard; long strings silently wrapped to wrong values (added overflow check, returns ErrInvalid).
• ringbuffer.New(cap<=0) — doc said "must be > 0" but code silently clamped to 1; now panics (matches ringbuf/slidingwindow).
• set.BenchmarkSetAdd — b.RunParallel raced on the non-concurrent-safe Set (concurrent map writes); fixed to single-goroutine.

Performance

• errcode — errors.Is / CodeOf now use Go 1.26's generic errors.AsType

... (truncated)

Commits

• 377d86b docs(changelog): cut v0.9.1 — 2026-08-06
• 2f8f394 fix(money): Allocate gives zero-ratio bucket a non-zero share on negative amo...
• 725cbda test: fill 4 HIGH-value test-quality gaps (test-quality audit)
• fcda8ce deps: security CVE fixes + routine minor bumps (dependency audit)
• 0d07b44 fix: API contract boundary hardening (8 packages, input-validation audit)
• df1f953 fix(kafka): join drainErrors goroutine in Close (resource audit)
• 7f396ad fix(log4go): nil stale file pointers on rotation open failure (resource audit)
• dd7bb21 fix(log4go): eliminate FileWriter Metrics/Stop data race (concurrency audit)
• 79cfce3 fix(wtimer,bloom): concurrency safety — atomic hook + deadlock-free Merge
• 21f5057 fix(decimal): cap scale to prevent OOM (error-handling audit)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions