@evanp/activitypub-bot 0.45.17 → 0.45.19

package/CHANGELOG.md

@@ -9,6 +9,24 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.45.19] - 2026-05-14
+
+### Changed
+
+- Use connection keep-alive for outgoing requests in SafeAgent.
+
+### Fixed
+
+- Use AbortSignal.timeout() in fetch() in ActivityPubClient instead of obsolete
+  and ignored `timeout` option.
+
+## [0.45.18] - 2026-05-12
+
+### Fixed
+
+- Changed how AbortSignal is used in JobQueue to prevent
+  memory leak.
+
 ## [0.45.17] - 2026-05-11
 
 ### Changed

package/lib/activitypubclient.js

@@ -538,7 +538,7 @@ export class ActivityPubClient {
     const fullOptions = {
       ...options,
       agent: this.#agent ?? undefined,
-      timeout: 10000,
+      signal: options?.signal ?? AbortSignal.timeout(10000),
       size: 1024 * 1024,
       follow: 10
     }

package/lib/jobqueue.js

@@ -46,17 +46,25 @@ export class JobQueue {
       'dequeueing job'
     )
 
-    while (!res) {
-      res = await this.#claimNextJob(queueId, jobRunnerId)
-      if (res) break
-      delay = Math.min(delay * 2, MAX_DELAY)
-      this.#logger.debug({ method: 'dequeue', delay }, 'sleeping')
-      try {
-        await sleep(delay, null, { signal: AbortSignal.any([this.#ac.signal, this.#wakeAc.signal]) })
-      } catch (err) {
-        if (this.#ac.signal.aborted) throw err
-        delay = 50
+    let armed = this.#armCombined()
+    try {
+      while (!res) {
+        res = await this.#claimNextJob(queueId, jobRunnerId)
+        if (res) break
+        delay = Math.min(delay * 2, MAX_DELAY)
+        this.#logger.debug({ method: 'dequeue', delay }, 'sleeping')
+        try {
+          await sleep(delay, null, { signal: armed.signal })
+        } catch (err) {
+          if (this.#ac.signal.aborted) throw err
+          delay = 50
+          // Wake fired — tear down old listeners and arm a fresh combined signal.
+          this.#disarmCombined(armed)
+          armed = this.#armCombined()
+        }
       }
+    } finally {
+      this.#disarmCombined(armed)
     }
 
     const jobId = res.job_id
@@ -67,6 +75,24 @@ export class JobQueue {
     return { jobId, payload, attempts }
   }
 
+  // Build a combined abort signal manually, avoiding AbortSignal.any() which
+  // registers a FinalizationRegistry callback per call (Node's
+  // sourceSignalsCleanupRegistry). Under the dequeue loop's call rate, those
+  // registrations dominate heap growth.
+  #armCombined () {
+    const combinedAc = new AbortController()
+    const onAbort = () => combinedAc.abort()
+    const wakeAc = this.#wakeAc
+    this.#ac.signal.addEventListener('abort', onAbort, { once: true })
+    wakeAc.signal.addEventListener('abort', onAbort, { once: true })
+    return { signal: combinedAc.signal, onAbort, wakeAc }
+  }
+
+  #disarmCombined (armed) {
+    this.#ac.signal.removeEventListener('abort', armed.onAbort)
+    armed.wakeAc.signal.removeEventListener('abort', armed.onAbort)
+  }
+
   async complete (jobId, jobRunnerId) {
     await this.#connection.query(`
       DELETE FROM job

package/lib/safeagent.js

@@ -19,6 +19,16 @@ class PrivateNetworkError extends Error {
 }
 
 export class SafeAgent extends https.Agent {
+  constructor (options = {}) {
+    super({
+      keepAlive: true,
+      keepAliveMsecs: 1000,
+      maxSockets: 64,
+      maxFreeSockets: 256,
+      ...options
+    })
+  }
+
   createConnection (options, callback) {
     dns.lookup(options.hostname, (err, address) => {
       if (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.45.17",
+  "version": "0.45.19",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",