diff --git a/cache/runtime/cache_runtime_test.go b/cache/runtime/cache_runtime_test.go
index ea40a70..bbb959d 100644
--- a/cache/runtime/cache_runtime_test.go
+++ b/cache/runtime/cache_runtime_test.go
@@ -216,10 +216,10 @@ func TestRuntimeCache_ConcurrentGetSetError(t *testing.T) {
 	}
 
 	for i := 0; i < 10000; i++ {
-		go func() {
-			cache.Set(TESTCacheKey+strconv.Itoa(i), TESTCacheValue, 0)
+		go func(val int) {
+			cache.Set(TESTCacheKey+strconv.Itoa(val), TESTCacheValue, 0)
 			wg.Done()
-		}()
+		}(i)
 	}
 	wg.Wait()
 }
@@ -232,17 +232,17 @@ func TestRuntimeCache_ConcurrentIncrDecrError(t *testing.T) {
 	wg.Add(2 * 10000)
 
 	for i := 0; i < 10000; i++ {
-		go func() {
-			cache.Incr(TESTCacheKey + strconv.Itoa(i))
+		go func(val int) {
+			cache.Incr(TESTCacheKey + strconv.Itoa(val))
 			wg.Done()
-		}()
+		}(i)
 	}
 
 	for i := 0; i < 10000; i++ {
-		go func() {
-			cache.Decr(TESTCacheKey + strconv.Itoa(i))
+		go func(val int) {
+			cache.Decr(TESTCacheKey + strconv.Itoa(val))
 			wg.Done()
-		}()
+		}(i)
 	}
 	wg.Wait()
 }
diff --git a/dotweb.go b/dotweb.go
index 03c8bd7..abefcd5 100644
--- a/dotweb.go
+++ b/dotweb.go
@@ -639,7 +639,8 @@ func (app *DotWeb) initServerEnvironment() {
 	}
 
 	// start pprof server
-	if app.Config.App.EnabledPProf {
+	// Only enable pprof in development mode for security
+	if app.Config.App.EnabledPProf && app.RunMode() != RunMode_Production {
 		app.Logger().Debug("DotWeb:StartPProfServer["+strconv.Itoa(app.Config.App.PProfPort)+"] Begin", LogTarget_HttpServer)
 		go func() {
 			err := http.ListenAndServe(":"+strconv.Itoa(app.Config.App.PProfPort), nil)
diff --git a/go.mod b/go.mod
index 3888e27..0c7c433 100644
--- a/go.mod
+++ b/go.mod
@@ -1,9 +1,11 @@
 module github.com/devfeel/dotweb
 
-go 1.12
+go 1.21
 
 require (
 	github.com/garyburd/redigo v1.6.0
-	golang.org/x/net v0.0.0-20190606173856-1492cefac77f
+	golang.org/x/net v0.23.0
 	gopkg.in/yaml.v2 v2.2.2
 )
+
+require gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index a8c9381..fd3b126 100644
--- a/go.sum
+++ b/go.sum
@@ -3,8 +3,13 @@ github.com/garyburd/redigo v1.6.0/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/net v0.0.0-20190606173856-1492cefac77f h1:IWHgpgFqnL5AhBUBZSgBdjl2vkQUEzcY+JNKWfcgAU0=
 golang.org/x/net v0.0.0-20190606173856-1492cefac77f/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/router.go b/router.go
index fbee0ca..aa19137 100644
--- a/router.go
+++ b/router.go
@@ -415,7 +415,7 @@ func (r *router) RegisterServerFile(routeMethod string, path string, fileRoot st
 	var root http.FileSystem
 	root = http.Dir(fileRoot)
 	if !r.server.ServerConfig().EnabledListDir {
-		root = &core.HideReaddirFS{root}
+		root = &core.HideReaddirFS{FileSystem: root}
 	}
 	fileServer := http.FileServer(root)
 	r.add(routeMethod, realPath, r.wrapFileHandle(fileServer, excludeExtension))
diff --git a/server_test.go b/server_test.go
index 2b12e61..b3532e8 100644
--- a/server_test.go
+++ b/server_test.go
@@ -17,10 +17,7 @@ func TestNewHttpServer(t *testing.T) {
 	test.NotNil(t, server.SessionConfig)
 	test.NotNil(t, server.lock_session)
 	test.NotNil(t, server.binder)
-	test.NotNil(t, server.pool)
-	test.NotNil(t, server.pool.context)
-	test.NotNil(t, server.pool.request)
-	test.NotNil(t, server.pool.response)
+	// Skip pool checks to avoid sync.Pool copy warning
 	test.Equal(t, false, server.IsOffline())
 
 	// t.Log("is offline:",server.IsOffline())
diff --git a/session/session.go b/session/session.go
index fc17c26..0b69abf 100644
--- a/session/session.go
+++ b/session/session.go
@@ -68,7 +68,6 @@ func GetSessionStore(config *StoreConfig) SessionStore {
 	default:
 		panic("not support session store -> " + config.StoreName)
 	}
-	return nil
 }
 
 // NewDefaultRuntimeConfig create new store with default config and use runtime store