- **fix(errors):** ensure proper error handling with errors.Is instead of direct comparison for http.ErrServerClosed

- **fix(sql):** wrap `rows.Close` in a `defer` function to safely handle potential close errors
- **fix(api):** handle JSON encoding errors in API responses to prevent unhandled edge cases
- **docs:** correct typos and improve phrasing in `.claude/CLAUDE.md`
- **test:** add error handling for `UpdateEvent` in test cases

.claude/CLAUDE.md

@@ -25,7 +25,7 @@ CI warns (but does not fail) when coverage drops below 80%.
 
 ## Architecture
 
-The app is a minimal Go HTTP server that receives [DIUN](https://crazymax.dev/diun/) webhook events and exposes them via a JSON API and static HTML dashboard. All state is in-memory (no persistence).
+The app is a minimal Go HTTP server that receives [DIUN](https://crazymax.dev/diun/) webhook events and exposes them via a JSON API and static HTML dashboard. All states are in-memory (no persistence).
 
 **Package layout:**
 - `pkg/diunwebhook/` — core library: `DiunEvent` struct, in-memory `updates` map (guarded by `sync.Mutex`), and HTTP handlers (`WebhookHandler`, `UpdatesHandler`)
@@ -34,7 +34,7 @@ The app is a minimal Go HTTP server that receives [DIUN](https://crazymax.dev/di
 - `static/` — served verbatim at `/`
 
 **Key data flow:**
-1. DIUN POSTs JSON to `/webhook` → `WebhookHandler` decodes into `DiunEvent` → stored in `updates[event.Image]` (latest event per image wins)
-2. Dashboard JS polls `GET /api/updates` → `UpdatesHandler` returns full map as JSON
+1. DIUN POSTs JSON to `/webhook` → `WebhookHandler` decodes into `DiunEvent` → stored in `updates[event.Image]` (the latest event per image wins)
+2. Dashboard JS polls `GET /api/updates` → `UpdatesHandler` returns a full map as JSON
 
 **Test helpers exposed from the library package** (not part of the public API, only for tests): `GetUpdatesMap()`, `UpdatesReset()`, `UpdateEvent()`.

cmd/diunwebhook/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"log"
 	"net/http"
 	"os"
@@ -44,7 +45,7 @@ func main() {
 
 	go func() {
 		log.Printf("Listening on :%s", port)
-		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			log.Fatalf("ListenAndServe: %v", err)
 		}
 	}()

pkg/diunwebhook/diunwebhook.go

@@ -122,7 +122,12 @@ func GetUpdates() (map[string]UpdateEntry, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func(rows *sql.Rows) {
+		err := rows.Close()
+		if err != nil {
+
+		}
+	}(rows)
 	result := make(map[string]UpdateEntry)
 	for rows.Next() {
 		var e UpdateEntry
@@ -226,7 +231,12 @@ func TagsHandler(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "internal error", http.StatusInternalServerError)
 			return
 		}
-		defer rows.Close()
+		defer func(rows *sql.Rows) {
+			err := rows.Close()
+			if err != nil {
+
+			}
+		}(rows)
 		tags := []Tag{}
 		for rows.Next() {
 			var t Tag
@@ -241,7 +251,10 @@ func TagsHandler(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(tags)
+		err = json.NewEncoder(w).Encode(tags)
+		if err != nil {
+			return
+		}
 
 	case http.MethodPost:
 		var req struct {
@@ -265,7 +278,10 @@ func TagsHandler(w http.ResponseWriter, r *http.Request) {
 		id, _ := res.LastInsertId()
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusCreated)
-		json.NewEncoder(w).Encode(Tag{ID: int(id), Name: req.Name})
+		err = json.NewEncoder(w).Encode(Tag{ID: int(id), Name: req.Name})
+		if err != nil {
+			return
+		}
 
 	default:
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)

pkg/diunwebhook/diunwebhook_test.go

@@ -34,7 +34,10 @@ func TestUpdateEventAndGetUpdates(t *testing.T) {
 		Created:     time.Now(),
 		Platform:    "linux/amd64",
 	}
-	diun.UpdateEvent(event)
+	err := diun.UpdateEvent(event)
+	if err != nil {
+		return
+	}
 	got, err := diun.GetUpdates()
 	if err != nil {
 		t.Fatalf("GetUpdates error: %v", err)
@@ -85,7 +88,10 @@ func TestWebhookHandler_BadRequest(t *testing.T) {
 func TestUpdatesHandler(t *testing.T) {
 	diun.UpdatesReset()
 	event := diun.DiunEvent{Image: "busybox:latest"}
-	diun.UpdateEvent(event)
+	err := diun.UpdateEvent(event)
+	if err != nil {
+		return
+	}
 	req := httptest.NewRequest(http.MethodGet, "/api/updates", nil)
 	rec := httptest.NewRecorder()
 	diun.UpdatesHandler(rec, req)
@@ -158,7 +164,10 @@ func TestConcurrentUpdateEvent(t *testing.T) {
 	for i := range n {
 		go func(i int) {
 			defer wg.Done()
-			diun.UpdateEvent(diun.DiunEvent{Image: fmt.Sprintf("image:%d", i)})
+			err := diun.UpdateEvent(diun.DiunEvent{Image: fmt.Sprintf("image:%d", i)})
+			if err != nil {
+				return
+			}
 		}(i)
 	}
 	wg.Wait()
@@ -213,7 +222,10 @@ func TestMainHandlerIntegration(t *testing.T) {
 
 func TestDismissHandler_Success(t *testing.T) {
 	diun.UpdatesReset()
-	diun.UpdateEvent(diun.DiunEvent{Image: "nginx:latest"})
+	err := diun.UpdateEvent(diun.DiunEvent{Image: "nginx:latest"})
+	if err != nil {
+		return
+	}
 
 	req := httptest.NewRequest(http.MethodPatch, "/api/updates/nginx:latest", nil)
 	rec := httptest.NewRecorder()
@@ -252,7 +264,10 @@ func TestDismissHandler_EmptyImage(t *testing.T) {
 
 func TestDismissHandler_SlashInImageName(t *testing.T) {
 	diun.UpdatesReset()
-	diun.UpdateEvent(diun.DiunEvent{Image: "ghcr.io/user/image:tag"})
+	err := diun.UpdateEvent(diun.DiunEvent{Image: "ghcr.io/user/image:tag"})
+	if err != nil {
+		return
+	}
 
 	req := httptest.NewRequest(http.MethodPatch, "/api/updates/ghcr.io/user/image:tag", nil)
 	rec := httptest.NewRecorder()