← All posts
malwatch Roscoe Skeens

malwatch 1.5.3

malwatch

Security

  • sec: update x/text to 0.39.0
  • sec: update go-git to v5.19.2
  • sec: update crypto to v0.56.0

Refactors

  • refactor: add IsUnder zero alloc IsRel alt fn
  • refactor: eliminate redundant monitor file validation syscalls
  • refactor: eliminate redundant scan walk validation syscalls
  • refactor: preprocess skips

Tests

  • test: add IsUnder benchmarks
  • test: add IsUnder tests

Docs

  • doc: bump download release
  • doc: list directadmin

Skip handling is now zero alloc, with a new IsUnder function providing IsRel semantics without any allocations. Redundant validation syscalls have also been eliminated from both the scan walk and monitor file paths.

BenchmarkOld/hit-4       5728287       214.5 ns/op       0 B/op       0 allocs/op
BenchmarkOld/miss-4       482607      2207.0 ns/op     448 B/op       8 allocs/op
BenchmarkOld/sibling-4   1620154       734.3 ns/op      96 B/op       2 allocs/op

BenchmarkNew/hit-4     149614582         8.007 ns/op      0 B/op       0 allocs/op
BenchmarkNew/miss-4     55846681        20.06 ns/op       0 B/op       0 allocs/op
BenchmarkNew/sibling-4  79791308        12.77 ns/op       0 B/op       0 allocs/op

Performance gains of approximately 5% faster scan times along with over 5% cpu and 1% memory reductions:

8 Runs / Warm Cache (100 000 Files)

Scan Duration
before 423.2 ± 4.9 ms
after 403.3 ± 21.6 ms
~5% Faster

CPU
before: User 677.3 ms, System 147.8 ms
after: User 628.7 ms, System 152.4 ms
~5.3% Reduction

Memory (Max RSS)
before: 23,572.5 KB (~23 MiB)
after: 23,191.0 KB (~22.7 MiB)
~1.3% Reduction

Vulnerabilities affecting x/text as GO-2026-5970, go-git as GO-2026-6213 and GO-2026-6214 as well as crypto as GO-2026-6354 and GO-2026-6355 resolved

https://pkg.go.dev/vuln/GO-2026-5970

https://pkg.go.dev/vuln/GO-2026-6213

https://pkg.go.dev/vuln/GO-2026-6214

https://pkg.go.dev/vuln/GO-2026-6354

https://pkg.go.dev/vuln/GO-2026-6355

This project was unaffected by these third party vulnerabilities.

Further information is available at the GitHub release or project page.