From 1e8ebaf20d581cf5aab7c74acc3c32a60d224a1f Mon Sep 17 00:00:00 2001
From: AMATH <116212274+amathxbt@users.noreply.github.com>
Date: Sun, 21 Jun 2026 20:34:30 +0100
Subject: [PATCH] fix: close HTTP response body explicitly instead of defer
 inside loop

Using "defer resp.Body.Close()" inside the "for _, checkURI := range uris" loop
means the bodies from all loop iterations are only closed when the outer
Load() function returns, not at the end of each iteration. Under a long
URI list this leaks open HTTP connections and file descriptors for the
entire duration of the function.

Fix: close the body immediately after io.ReadAll returns (and also in
the DecodeResponse error branch) so each iteration cleans up after itself.
---
 cli/api.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cli/api.go b/cli/api.go
index 1b72a20..494e680 100644
--- a/cli/api.go
+++ b/cli/api.go
@@ -307,10 +307,11 @@ func Load(entrypoint string, root *cobra.Command) (API, error) {
 			return API{}, err
 		}
 		if err := DecodeResponse(resp); err != nil {
+			resp.Body.Close()
 			return API{}, err
 		}
-		defer resp.Body.Close()
 		body, err := io.ReadAll(resp.Body)
+		resp.Body.Close()
 		if err != nil {
 			return API{}, err
 		}