diff --git a/Gopkg.lock b/Gopkg.lock
index 7c2cfbfbda..cf1b45e365 100644
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -1312,11 +1312,11 @@
 
 [[projects]]
   branch = "master"
-  digest = "1:3c2ee66e652654aae64107ab7e0087cfb05a959b2e22ff75880d0cd7b47e695d"
+  digest = "1:30c2a461ac89edba03106741bfd399b5b19354f5a1c8879816e459775e762ae7"
   name = "yunion.io/x/jsonutils"
   packages = ["."]
   pruneopts = "UT"
-  revision = "0233c7b766f65b0ebbe6f72717f141405afbb496"
+  revision = "3dc94f21b85b0975a07c9cbe6854acf6fd63b77d"
 
 [[projects]]
   branch = "master"
diff --git a/vendor/yunion.io/x/jsonutils/marshal.go b/vendor/yunion.io/x/jsonutils/marshal.go
index 97630bb987..f1e60f0388 100644
--- a/vendor/yunion.io/x/jsonutils/marshal.go
+++ b/vendor/yunion.io/x/jsonutils/marshal.go
@@ -130,51 +130,48 @@ func struct2JSONPairs(val reflect.Value) []JSONPair {
 	structType := val.Type()
 	objPairs := make([]JSONPair, 0)
 	for i := 0; i < structType.NumField(); i += 1 {
-		fieldType := structType.Field(i)
-		if !gotypes.IsFieldExportable(fieldType.Name) { // unexportable field, ignore
+		sf := structType.Field(i)
+
+		// ignore unexported field altogether
+		if !gotypes.IsFieldExportable(sf.Name) {
 			continue
 		}
-		if fieldType.Anonymous {
-			nextVal := val.Field(i)
-			switch fieldType.Type.Kind() {
-			case reflect.Struct: // embbed struct
-				nextVal = val.Field(i)
-			case reflect.Interface: // embbed interface
-			CHECKINTERFACE:
-				for {
-					switch nextVal.Type().Kind() {
-					case reflect.Interface:
-						nextVal = nextVal.Elem()
-					case reflect.Ptr:
-						nextVal = reflect.Indirect(nextVal)
-					case reflect.Struct:
-						break CHECKINTERFACE
-					default:
-						log.Warningf("embeded interface point to a non struct data %s", nextVal.Type())
-						break CHECKINTERFACE
-					}
-				}
-			default:
-				log.Warningf("unsupport anonymous embeded type %s", fieldType.Type.Name())
-				continue
-			}
-			newPairs := struct2JSONPairs(nextVal)
-			objPairs = append(objPairs, newPairs...)
-		} else {
-			jsonInfo := parseJsonMarshalInfo(fieldType.Tag)
 
-			if jsonInfo.ignore {
+		if sf.Anonymous {
+			fv := val.Field(i)
+
+			// T, *T
+			switch fv.Kind() {
+			case reflect.Ptr, reflect.Interface:
+				// ignore nil values completely
+				if !fv.IsValid() || fv.IsNil() {
+					continue
+				}
+				fv = fv.Elem()
+			}
+			// note that we regard anonymous interface field the
+			// same as with anonymous struct field.  This is
+			// different from how encoding/json handles struct
+			// field of interface type.
+			if fv.Kind() == reflect.Struct {
+				newPairs := struct2JSONPairs(fv)
+				objPairs = append(objPairs, newPairs...)
 				continue
 			}
-			key := jsonInfo.name
-			if len(key) == 0 {
-				key = utils.CamelSplit(fieldType.Name, "_")
-			}
-			val := marshalValue(val.Field(i), &jsonInfo)
-			if val != nil && val != JSONNull {
-				objPair := JSONPair{key: key, val: val}
-				objPairs = append(objPairs, objPair)
-			}
+		}
+
+		jsonInfo := parseJsonMarshalInfo(sf.Tag)
+		if jsonInfo.ignore {
+			continue
+		}
+		key := jsonInfo.name
+		if len(key) == 0 {
+			key = utils.CamelSplit(sf.Name, "_")
+		}
+		val := marshalValue(val.Field(i), &jsonInfo)
+		if val != nil && val != JSONNull {
+			objPair := JSONPair{key: key, val: val}
+			objPairs = append(objPairs, objPair)
 		}
 	}
 	return objPairs
diff --git a/vendor/yunion.io/x/pkg/util/secrules/secrules.go b/vendor/yunion.io/x/pkg/util/secrules/secrules.go
index 037bb62d45..6437ff1ae9 100644
--- a/vendor/yunion.io/x/pkg/util/secrules/secrules.go
+++ b/vendor/yunion.io/x/pkg/util/secrules/secrules.go
@@ -127,21 +127,12 @@ func ParseSecurityRule(pattern string) (*SecurityRule, error) {
 				return nil, ErrInvalidAction
 			}
 		} else if status == SEG_IP {
-			// NOTE regutils.MatchCIDR actually also matches IP address without prefix length
 			if regutils.MatchCIDR(seg) {
-				if idx := strings.Index(seg, "/"); idx > -1 {
-					if _, ipnet, err := net.ParseCIDR(seg); err != nil {
-						return nil, ErrInvalidNet
-					} else {
-						rule.IPNet = ipnet
-					}
-				} else if ip := net.ParseIP(seg); ip != nil {
-					rule.IPNet = &net.IPNet{
-						IP:   ip,
-						Mask: net.CIDRMask(32, 32),
-					}
-				} else {
-					return nil, ErrInvalidIPAddr
+				_, rule.IPNet, _ = net.ParseCIDR(seg)
+			} else if regutils.MatchIPAddr(seg) {
+				rule.IPNet = &net.IPNet{
+					IP:   net.ParseIP(seg),
+					Mask: net.CIDRMask(32, 32),
 				}
 			} else {
 				rule.IPNet = &net.IPNet{
diff --git a/vendor/yunion.io/x/sqlchemy/query.go b/vendor/yunion.io/x/sqlchemy/query.go
index 60b2cd7cd5..b72b412856 100644
--- a/vendor/yunion.io/x/sqlchemy/query.go
+++ b/vendor/yunion.io/x/sqlchemy/query.go
@@ -450,7 +450,6 @@ func (q *SQuery) AllStringMap() ([]map[string]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
 	results := make([]map[string]string, 0)
 	for rows.Next() {
 		result, err := q.rowScan2StringMap(rows)