GitHub
10/25/2026, 9:36 PMprovision.sh runs osctrl-cli --db ... user edit -u <admin> -p <password> to update an existing admin password. It crashed with a nil pointer dereference in `EditUserReq`:
[+] Updating admin password
panic: runtime error: invalid memory address or nil pointer dereference
<http://github.com/jmpsec/osctrl/pkg/apiclient.(*OsctrlAPI).EditUserReq(0x0|github.com/jmpsec/osctrl/pkg/apiclient.(*OsctrlAPI).EditUserReq(0x0>, ...)
editUser applied the changes in the database under if dbFlag, then ran the API request under a separate if apiFlag. apiFlag is on by default, and with --db the API client is never created, so the call used a nil client. Every other CLI command uses else if apiFlag. user edit was the only one that didn't.
Change
• `cmd/cli/user.go`: the API request now runs only when --db is not in use (if !dbFlag && apiFlag).
• `cmd/cli/user_edit_test.go`: TestEditUserWithDBDoesNotUseAPIClient runs user edit with --db and the default apiFlag on, a nil API client and SQLite. It checks that the command does not panic, the new password works and the old one stops working.
Validation
• The new test reproduced the panic before the fix and passes after it.
• go test ./cmd/cli, go vet ./cmd/cli, gofmt -l cmd/cli and `golangci-lint run ./cmd/cli/...`: clean.
jmpsec/osctrlGitHub
10/25/2026, 9:41 PM