@evanp/activitypub-bot 0.45.16 → 0.45.18

package/CHANGELOG.md

@@ -9,6 +9,26 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.45.18] - 2026-05-12
+
+### Fixed
+
+- Changed how AbortSignal is used in JobQueue to prevent
+  memory leak.
+
+## [0.45.17] - 2026-05-11
+
+### Changed
+
+- Bumped activitypub-nock.
+
+### Fixed
+
+- Look up id in results body even if the the id is not a fragment; fixes
+  problems with gotosocial keys.
+- Retry signature code on more HTTP status
+results, for servers that use (wrong, bad) 400, 404 and 410 results for bad signatures.
+
 ## [0.45.16] - 2026-05-11
 
 ### Changed

package/lib/activitypubclient.js

@@ -24,6 +24,8 @@ const COLLECTION_TYPES = [
   `${NS}OrderedCollection`
 ]
 
+const SIG_ERROR_STATUS = [400, 401, 403, 404, 410]
+
 function normalizeHeaders (headers) {
   if (!headers) {
     return headers
@@ -120,7 +122,7 @@ export class ActivityPubClient {
     try {
       obj = await this.#get(url, this.#urlFormatter.hostname, false, false)
     } catch (err) {
-      if (err.status && [401, 403, 404].includes(err.status)) {
+      if (err.status && SIG_ERROR_STATUS.includes(err.status)) {
         obj = await this.#get(url, this.#urlFormatter.hostname, true, false)
       } else {
         throw err
@@ -205,7 +207,7 @@ export class ActivityPubClient {
       }
     )
     this.#logger.debug({ hostname, status: res.status }, 'response received')
-    if ([400, 401, 403].includes(res.status) &&
+    if (SIG_ERROR_STATUS.includes(res.status) &&
         sign &&
         lastPolicy === SignaturePolicyStorage.RFC9421) {
       const errBody = await res.text()
@@ -279,7 +281,9 @@ export class ActivityPubClient {
       this.#logger.warn({ url: baseUrl, json }, 'Error importing JSON as AS2')
       throw err
     }
-    const resolved = (parsed.hash)
+    // NB: should only test for fragments,
+    // but e.g. gotosocial has this.
+    const resolved = (obj.id !== url)
       ? this.#resolveObject(obj, url)
       : obj
     return resolved
@@ -345,7 +349,7 @@ export class ActivityPubClient {
         body
       }
     )
-    if ([400, 401, 403].includes(res.status) &&
+    if (SIG_ERROR_STATUS.includes(res.status) &&
         lastPolicy === SignaturePolicyStorage.RFC9421) {
       const errBody = await res.text()
       this.#logger.debug(

package/lib/jobqueue.js

@@ -46,17 +46,25 @@ export class JobQueue {
       'dequeueing job'
     )
 
-    while (!res) {
-      res = await this.#claimNextJob(queueId, jobRunnerId)
-      if (res) break
-      delay = Math.min(delay * 2, MAX_DELAY)
-      this.#logger.debug({ method: 'dequeue', delay }, 'sleeping')
-      try {
-        await sleep(delay, null, { signal: AbortSignal.any([this.#ac.signal, this.#wakeAc.signal]) })
-      } catch (err) {
-        if (this.#ac.signal.aborted) throw err
-        delay = 50
+    let armed = this.#armCombined()
+    try {
+      while (!res) {
+        res = await this.#claimNextJob(queueId, jobRunnerId)
+        if (res) break
+        delay = Math.min(delay * 2, MAX_DELAY)
+        this.#logger.debug({ method: 'dequeue', delay }, 'sleeping')
+        try {
+          await sleep(delay, null, { signal: armed.signal })
+        } catch (err) {
+          if (this.#ac.signal.aborted) throw err
+          delay = 50
+          // Wake fired — tear down old listeners and arm a fresh combined signal.
+          this.#disarmCombined(armed)
+          armed = this.#armCombined()
+        }
       }
+    } finally {
+      this.#disarmCombined(armed)
     }
 
     const jobId = res.job_id
@@ -67,6 +75,24 @@ export class JobQueue {
     return { jobId, payload, attempts }
   }
 
+  // Build a combined abort signal manually, avoiding AbortSignal.any() which
+  // registers a FinalizationRegistry callback per call (Node's
+  // sourceSignalsCleanupRegistry). Under the dequeue loop's call rate, those
+  // registrations dominate heap growth.
+  #armCombined () {
+    const combinedAc = new AbortController()
+    const onAbort = () => combinedAc.abort()
+    const wakeAc = this.#wakeAc
+    this.#ac.signal.addEventListener('abort', onAbort, { once: true })
+    wakeAc.signal.addEventListener('abort', onAbort, { once: true })
+    return { signal: combinedAc.signal, onAbort, wakeAc }
+  }
+
+  #disarmCombined (armed) {
+    this.#ac.signal.removeEventListener('abort', armed.onAbort)
+    armed.wakeAc.signal.removeEventListener('abort', armed.onAbort)
+  }
+
   async complete (jobId, jobRunnerId) {
     await this.#connection.query(`
       DELETE FROM job

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.45.16",
+  "version": "0.45.18",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",
@@ -45,7 +45,7 @@
     "sequelize": "^6.37.7"
   },
   "devDependencies": {
-    "@evanp/activitypub-nock": "^0.9.4",
+    "@evanp/activitypub-nock": "^0.9.5",
     "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.29.1",