@@ -142,7 +142,7 @@ github.com/gogo/googleapis                          01e0f9cca9b92166042241267ee2

 github.com/cilium/ebpf                              1c8d4c9ef7759622653a1d319284a44652333b28

 # cluster

-github.com/docker/swarmkit                          17d8d4e4d8bdec33d386e6362d3537fa9493ba00

+github.com/docker/swarmkit                          c9afb5fd44bb419bae719f400f31671712bcb99e # bump_20.10

 github.com/gogo/protobuf                            5628607bb4c51c3157aacc3a50f0ab707582b805 # v1.3.1

 github.com/golang/protobuf                          84668698ea25b64748563aa20726db66a6b8d299 # v1.3.5

 github.com/cloudflare/cfssl                         5d63dbd981b5c408effbb58c442d54761ff94fbd # 1.3.2

@@ -204,20 +204,31 @@ func (s *subscription) watch(ch <-chan events.Event) error {

 	}

 	add := func(t *api.Task) {

+		// this mutex does not have a deferred unlock, because there is work

+		// we need to do after we release it.

 		s.mu.Lock()

-		defer s.mu.Unlock()

 		// Un-allocated task.

 		if t.NodeID == "" {

 			s.pendingTasks[t.ID] = struct{}{}

+			s.mu.Unlock()

 			return

 		}

 		delete(s.pendingTasks, t.ID)

 		if _, ok := s.nodes[t.NodeID]; !ok {

 			s.nodes[t.NodeID] = struct{}{}

+

+			s.mu.Unlock()

+

+			// if we try to call Publish before we release the lock, we can end

+			// up in a situation where the receiver is trying to acquire a read

+			// lock on it. it's hard to explain.

 			s.changed.Publish(s)

+			return

 		}

+

+		s.mu.Unlock()

 	}

 	for {