bug: disableProgress global variable has data race (no atomic/mutex protection)

[aftersnow]

Description

In internal/pb/pb.go:33-40, the global disableProgress bool is written by SetDisableProgress() and read by Add() without any synchronization — no mutex, no sync/atomic.

During concurrent pull/push operations where multiple goroutines call Add() while SetDisableProgress() may also be called, this causes a data race detectable by go test -race.

Code

var (
    disableProgress bool  // unprotected global variable
)

func SetDisableProgress(disable bool) {
    disableProgress = disable  // unsynchronized write
}

func (p *ProgressBar) Add(...) io.Reader {
    if disableProgress {  // unsynchronized read
        return reader
    }
    // ...
}

Fix

Replace with atomic.Bool:

var disableProgress atomic.Bool

func SetDisableProgress(disable bool) {
    disableProgress.Store(disable)
}

// In Add():
if disableProgress.Load() {
    return reader
}

Severity

Critical — data race under concurrent usage, undefined behavior per Go memory model.