next-leak 0.10.0 → 0.11.0

package/README.md

@@ -115,6 +115,7 @@ Every report prints the gate it used.
 |---|---|---|
 | `--routes <list>` | all | Only measure these routes (comma-separated templates or prefixes) |
 | `--cycles <n>` | 4 | Load cycles per route (min 3). The first is dropped as warm-up, so the verdict sees `n − 1` deltas — at 3 it sees two |
+| `--repeat <n>` | 1 | Measure each route `n` times, each from a fresh server, and judge it on all of them (max 10). The run takes `n` times as long. Routes whose repetitions disagree are reported `inconclusive`, and the spread of growth rates is printed either way. More cycles watch one process for longer; repetitions watch different ones, which is where the variance lives — three runs of one Next build measured 602, 826 and 875 MB retained, and a fourth measured 39 MB |
 | `--requests <n>` | 5000 | Requests per cycle. Raises sensitivity as well as duration: the growth gate scales with it, down to a noise floor around 5000 |
 | `--connections <n>` | 100 | Concurrent connections |
 | `--idle <seconds>` | 30 | **Maximum** wait before each sample; the run continues as soon as the heap settles |
@@ -440,6 +441,17 @@ through the build's source maps.
   that is almost nothing. A 1342.9 MB capture of a leaking route parsed 2.4 MB
   of JSON and diffs fine; a 2227.5 MB one whose `strings` section alone was
   868.9 MB is refused, and the message names 869 MB rather than 2227 MB.
+- **A slow snapshot is not a failed route.** `v8.writeHeapSnapshot` blocks the
+  measured process until the file is on disk, so the control channel goes
+  silent for as long as the write takes — and the worse the leak, the longer
+  that is. The wait is judged by bytes reaching disk, not by a clock: a
+  snapshot that is still growing is given as long as it needs, while five
+  minutes with nothing written is treated as a wedged process and said so. If
+  the final snapshot cannot be taken at all, the run keeps its verdict — the
+  curve is already complete by then — and reports the missing attribution
+  instead of discarding the route. Measured on the
+  [#84648](https://github.com/vercel/next.js/issues/84648) reproduction, whose
+  4.2 GB capture outlasted every fixed deadline worth setting.
 - **Architectures:** verified on **arm64 and x64** (linux/amd64 in Docker) — same app, same parameters, same verdicts.
 - **Attribution** (naming the file) needs a Turbopack build with server sourcemaps — the Next 15+ default. On webpack builds the registry is empty by design and findings degrade to `unattributed` with raw retainer chains; measurement itself does not depend on it. Note that `output: "standalone"` + `--webpack` produced a bundle that could not start at all on `16.3.0-canary.90` (missing `@swc/helpers`), independently of this tool.
 - Empirically validated on Next **15.5.4, 16.0.x, 16.1.5, 16.2.x, 16.3.0/16.3.1 and 16.3-canary** (incl. Sentry, OpenTelemetry, PPR and i18n apps), against the public reproductions attached to real issues (open and since-fixed). Most recent measurements, 2026-08-17/18: the runtime path on 16.2.12 and 16.3.1-canary.18, the build path on 16.2.12 and 16.3.1. The contracts it relies on are stable since Next 13–14, but older versions are untested.

package/THIRD-PARTY-NOTICES.md

@@ -277,7 +277,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-## @babel/types@7.29.7
+## @babel/types@7.29.8
 
 License: MIT
 https://babel.dev/docs/en/next/babel-types

package/dist/{chunk-5ZBIS5WM.js → chunk-4FYSLLSX.js}

@@ -31,23 +31,32 @@ function isStepwiseGrowth(samples, deltas, growingCycles, mean, minGrowth) {
   }
   return maxDrawdown(samples) <= netGrowth * STEPWISE_MAX_DRAWDOWN_RATIO;
 }
-function isSaturating(deltas) {
+function isSaturating(deltas, minGrowth) {
   if (deltas.length < SATURATION_MIN_CYCLES) {
     return false;
   }
   const first = deltas[0];
   const last = deltas[deltas.length - 1];
-  if (first === void 0 || last === void 0 || first <= 0) {
+  if (first === void 0 || last === void 0 || first < minGrowth) {
     return false;
   }
-  for (let i = 1; i < deltas.length; i += 1) {
-    const current = deltas[i];
-    const previous = deltas[i - 1];
-    if (current === void 0 || previous === void 0 || current >= previous) {
-      return false;
-    }
+  if (!deltas.every((delta) => delta > 0)) {
+    return false;
   }
-  return last <= first * SATURATION_MAX_FINAL_RATIO;
+  if (last > first * SATURATION_MAX_FINAL_RATIO) {
+    return false;
+  }
+  return isHeadingDown(deltas);
+}
+function isHeadingDown(deltas) {
+  const midpoint = Math.floor(deltas.length / 2);
+  const head = deltas.slice(0, midpoint);
+  const tail = deltas.slice(midpoint);
+  if (head.length === 0 || tail.length === 0) {
+    return false;
+  }
+  const mean = (values) => values.reduce((sum, value) => sum + value, 0) / values.length;
+  return mean(tail) < mean(head);
 }
 function isTooLargeToAcquit(deltas, mean, minGrowth) {
   const netGrowth = deltas.reduce((sum, delta) => sum + delta, 0);
@@ -71,10 +80,10 @@ function classifyShape(samples, options) {
   const allGrow = deltas.every((d) => d >= minGrowth);
   const anyFlatOrDown = deltas.some((d) => d <= 0);
   const growingCycles = deltas.filter((d) => d >= minGrowth).length;
+  if (isSaturating(deltas, minGrowth)) {
+    return { verdict: "saturating", growthPerCycle: mean, deltas, source: "heap" };
+  }
   if (allGrow) {
-    if (isSaturating(deltas)) {
-      return { verdict: "saturating", growthPerCycle: mean, deltas, source: "heap" };
-    }
     return { verdict: "leak", growthPerCycle: mean, deltas, source: "heap" };
   }
   if (isStepwiseGrowth(samples, deltas, growingCycles, mean, minGrowth)) {
@@ -115,7 +124,8 @@ function effectiveVerdict(report) {
 var VERDICT_WEAKENING = /* @__PURE__ */ new Set([
   "near-threshold",
   "spiky-growth",
-  "thin-evidence"
+  "thin-evidence",
+  "repetitions-disagree"
 ]);
 function warrantsIssueDraft(report) {
   return effectiveVerdict(report) === "leak" && !report.confidence.warnings.some((warning) => VERDICT_WEAKENING.has(warning.code));