next-leak 0.11.0 → 0.11.2

package/README.md

@@ -29,13 +29,15 @@ next-leak found the growth, the retaining object and the chain that holds it —
 without being told what to look for. Next.js 16.3.0 has since fixed it.
 
 **Verified against real Next.js issues**, not synthetic fixtures. Issue states
-checked 2026-08-27:
+checked 2026-09-05:
 
 | Issue | What it is | Measured | State today |
 |---|---|---|---|
-| [#97938](https://github.com/vercel/next.js/issues/97938) | `cacheComponents`: composite abort signal never released | +705 KB per request on 16.3.3, flat on 16.2.6 | **open** |
+| [#97776](https://github.com/vercel/next.js/issues/97776) | `use cache`: `AbortSignal.any` composites never released (canonical issue; #97938 and #97464 are duplicates) | +705 KB per request on 16.3.3, flat on 16.2.6 (the #97938 run) | **open** — fix [#97476](https://github.com/vercel/next.js/pull/97476) merged Aug 19, in no stable release as of 16.3.4 |
+| [#97938](https://github.com/vercel/next.js/issues/97938) | `cacheComponents`: composite abort signal never released | +705 KB per request on 16.3.3, flat on 16.2.6 | closed Aug 31 as a duplicate of #97776; fix in no stable release |
 | [#96533](https://github.com/vercel/next.js/issues/96533) | ISR revalidation holds RSC buffers between collections | 4–5 MB of `arrayBuffers` held vs 0.32 MB retained | **open** |
-| [#97464](https://github.com/vercel/next.js/issues/97464) | Static-gen worker retains per prerendered page | OOM after 1617 and 1525 of 2504 pages on 16.3.3; 16.2.12 finishes at 0.05 MB/page | **open** |
+| [#97464](https://github.com/vercel/next.js/issues/97464) | Static-gen worker retains per prerendered page | OOM after 1617 and 1525 of 2504 pages on 16.3.3; 16.2.12 finishes at 0.05 MB/page | closed Aug 31 as a duplicate of #97776; fix in no stable release |
+| [#97802](https://github.com/vercel/next.js/issues/97802) | Turbopack compilation saturates the container before rendering anything | Reporter's reproduction in a 2 CPU / 4 GB container: 16.2.12 peaks ~2 GB and finishes; 16.3.0 pins 4 GB and stalls | **open** — bisected to 16.3.0; no fix known |
 | [#92287](https://github.com/vercel/next.js/issues/92287) | Cache Components: unbounded `arrayBuffers` under load | 37.5 MB of arrayBuffers held between collections, 37x what it retains (16.3.1) | **open** |
 | [#84884](https://github.com/vercel/next.js/issues/84884) | axios + `AbortSignal` in middleware | 32.8 → 369.9 MB | **open** |
 | [#89091](https://github.com/vercel/next.js/issues/89091) | zlib retention on mid-stream aborts | +42.5 MB/1000 aborted req on 16.1.5; **+0.03 on 16.3.1** | closed |
@@ -121,6 +123,7 @@ Every report prints the gate it used.
 | `--idle <seconds>` | 30 | **Maximum** wait before each sample; the run continues as soon as the heap settles |
 | `--warmup <n>` | 200 | Requests before the baseline snapshot. Lower it on apps that cache per request: warm-up fills those caches and the baseline then measures the warm-up, not the app. The run says so when it happens |
 | `--max-old-space <mb>` | 512 | Heap cap of each measured process. Raise it for apps whose legitimate working set is larger, or they die under measurement |
+| `--ready-timeout <seconds>` | 60 | How long each measured process gets to start listening. Raise it for apps that boot slowly. A process that never listens reports whatever it wrote to stderr while trying |
 | `--quick` | off | Fast preset (2000 requests × 4 cycles, 8s idle) — the exact profile the real-app validation ran with. Same cycle count as the default; what it trades away is traffic per cycle, so it sits on the noise floor and is less sensitive to slow leaks. Explicit flags override it |
 | `--no-resolve` | off | Skip the second pass on inconclusive routes |
 | `--self-check` | off | Measure a planted leak first to prove the harness works here. Costs one route's worth of time; a run that cannot detect 8 KB per request produces verdicts worth nothing |
@@ -407,6 +410,17 @@ through the build's source maps.
 
 
 - **Supported (default command):** App Router · `output: "standalone"` · Node ≥ 22 · Linux/macOS. Pages Router, non-standalone, and Windows are rejected with a clear message.
+- **Monorepos work unchanged.** A workspace build does not put `server.js` at
+  the root of `.next/standalone`: Next keeps the app's path relative to the
+  workspace root, so an app in `client/` ships its server at
+  `.next/standalone/client/server.js` with `node_modules` hoisted above it.
+  Point the tool at the app directory as usual — it looks there too. Do not
+  flatten that tree by hand: on a pnpm workspace the moved `server.js` cannot
+  resolve `next` any more, because what sits in `standalone/<app>/node_modules`
+  are relative symlinks into `../../node_modules/.pnpm/`, and a level up they
+  point outside the tree. An npm workspace survives the move — it puts no
+  `node_modules` beside the app at all — which is why the same build can serve
+  by hand and still be unmeasurable.
 - **Sample values can vary per request.** `"slug": "post-{n}"` gives every
   request its own URL — the shape of bot traffic and of a cache that never
   repeats a key. `"slug": "post-{n%200}"` cycles through exactly 200 distinct

package/dist/{chunk-JHOE2RCM.js → chunk-QNYUT2XF.js}

@@ -92698,6 +92698,26 @@ async function readManifest(file, parse2) {
     );
   }
 }
+async function findStandaloneServer(appDir, standaloneDir) {
+  const atRoot = path2.join(standaloneDir, "server.js");
+  if (await exists(atRoot)) {
+    return atRoot;
+  }
+  let current = path2.resolve(appDir);
+  let suffix = "";
+  for (; ; ) {
+    const parent = path2.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    suffix = suffix === "" ? path2.basename(current) : path2.join(path2.basename(current), suffix);
+    const candidate = path2.join(standaloneDir, suffix, "server.js");
+    if (await exists(candidate)) {
+      return candidate;
+    }
+    current = parent;
+  }
+}
 async function validateTarget(appDir) {
   const nextDir = path2.resolve(appDir, ".next");
   if (!await exists(nextDir)) {
@@ -92706,11 +92726,11 @@ async function validateTarget(appDir) {
       `No .next directory in ${appDir}. Run "next build" first.`
     );
   }
-  const standaloneServer = path2.join(nextDir, "standalone", "server.js");
-  if (!await exists(standaloneServer)) {
+  const standaloneServer = await findStandaloneServer(appDir, path2.join(nextDir, "standalone"));
+  if (standaloneServer === void 0) {
     throw new TargetError(
       "NO_STANDALONE",
-      `No ${standaloneServer}.
+      `No ${path2.join(nextDir, "standalone", "server.js")}.
 next-leak measures the standalone server bundle. Enable it once in next.config:
 
     const nextConfig = {
@@ -92754,6 +92774,7 @@ import { pathToFileURL } from "url";
 import { z as z3 } from "zod";
 var controlFileSchema = z3.object({ port: z3.number(), pid: z3.number() });
 var DEFAULT_MAX_OLD_SPACE_MB = 512;
+var DEFAULT_READY_TIMEOUT_MS = 6e4;
 var LaunchError = class extends Error {
   constructor(message) {
     super(message);
@@ -92794,8 +92815,38 @@ function explainRuntimeFailure(stderr, maxOldSpaceMb) {
   }
   return `the measured process exited mid-run. ${explainStartupFailure(stderr)}`;
 }
+function appNeverListened(hostname, port, budgetMs, stderr, lastFailure = void 0) {
+  const refused = lastFailure === void 0 ? "" : ` (${lastFailure})`;
+  const head = `app on ${hostname}:${port} \u2014 the process started and answered on its control channel, but never accepted a connection${refused} within ${Math.round(budgetMs / 1e3)}s`;
+  if (stderr.trim() !== "") {
+    return `${head}. It wrote this while starting:
+${stderr.trim()}`;
+  }
+  return `${head}, and wrote nothing to stderr. An app that boots slower than that needs a larger budget: --ready-timeout <seconds>. Otherwise it is hanging during startup \u2014 starting the same server.js by hand, with PORT set, hangs the same way and can be interrupted to see where`;
+}
+var NOT_LISTENING_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ENOTFOUND"
+]);
+function probeFailure(cause) {
+  const inner = cause?.cause;
+  const code = inner?.code;
+  if (typeof code === "string") {
+    return code;
+  }
+  const message = inner?.message;
+  if (typeof message === "string" && message !== "") {
+    return message;
+  }
+  return cause instanceof Error ? cause.message : String(cause);
+}
+function meansNotListening(failure) {
+  return NOT_LISTENING_CODES.has(failure);
+}
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function pollUntil(deadline, what, probe, failed) {
+async function pollUntil(deadline, describe, probe, failed) {
   for (; ; ) {
     const failure = failed();
     if (failure !== void 0) {
@@ -92806,14 +92857,14 @@ async function pollUntil(deadline, what, probe, failed) {
       return result;
     }
     if (Date.now() > deadline) {
-      throw new LaunchError(`timed out waiting for ${what}`);
+      throw new LaunchError(`timed out waiting for ${describe()}`);
     }
     await sleep(100);
   }
 }
 async function launchInstrumented(options) {
   const hostname = options.hostname ?? "127.0.0.1";
-  const deadline = Date.now() + (options.readyTimeoutMs ?? 15e3);
+  const readyTimeoutMs = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
   const child = spawn(
     process.execPath,
     [
@@ -92857,8 +92908,8 @@ ${stderrTailBuffer}`;
   const failed = () => exited ? `server exited before becoming ready. ${explainStartupFailure(stderrWindow())}` : void 0;
   try {
     const controlPort = await pollUntil(
-      deadline,
-      `control channel in ${options.workDir}`,
+      Date.now() + readyTimeoutMs,
+      () => `control channel in ${options.workDir}`,
       // Several processes may announce a channel (clustered servers); accept
       // the first one that actually answers instead of trusting a filename.
       async () => {
@@ -92887,15 +92938,20 @@ ${stderrTailBuffer}`;
       },
       failed
     );
+    let lastFailure;
     await pollUntil(
-      deadline,
-      `app on ${hostname}:${options.appPort}`,
+      Date.now() + readyTimeoutMs,
+      () => appNeverListened(hostname, options.appPort, readyTimeoutMs, stderrWindow(), lastFailure),
       async () => {
+        const url = `http://${hostname}:${options.appPort}${options.readyPath ?? "/"}`;
         try {
-          await fetch(`http://${hostname}:${options.appPort}/`, { method: "HEAD" });
+          const response = await fetch(url, { method: "GET", redirect: "manual" });
+          await response.body?.cancel();
           return true;
-        } catch {
-          return void 0;
+        } catch (cause) {
+          const failure = probeFailure(cause);
+          lastFailure = failure;
+          return meansNotListening(failure) ? void 0 : true;
         }
       },
       failed
@@ -92945,6 +93001,7 @@ var RUN_ONLY_FLAGS = [
   ["idleSeconds", "--idle"],
   ["warmupRequests", "--warmup"],
   ["maxOldSpaceMb", "--max-old-space"],
+  ["readyTimeoutSeconds", "--ready-timeout"],
   ["quick", "--quick"],
   ["noResolve", "--no-resolve"],
   ["selfCheck", "--self-check"],
@@ -92989,6 +93046,12 @@ var FLAGS = [
     argName: "<mb>",
     help: "Heap cap of each measured process (default 512) \u2014 raise it for apps whose working set is larger"
   },
+  {
+    flag: "--ready-timeout",
+    value: "int",
+    argName: "<seconds>",
+    help: "Seconds each measured process gets to start listening (default 60) \u2014 raise it for slow-booting apps"
+  },
   {
     flag: "--quick",
     value: "none",
@@ -93060,7 +93123,8 @@ var LIMITS = {
   "--connections": 1e4,
   "--idle": 3600,
   "--warmup": 1e6,
-  "--max-old-space": 65536
+  "--max-old-space": 65536,
+  "--ready-timeout": 600
 };
 var MIN_MAX_OLD_SPACE_MB = 128;
 function findSpec(argument) {
@@ -93102,6 +93166,7 @@ function applyNumericFlag(flag, value, options) {
   if (flag === "--idle") options.idleSeconds = parsed;
   if (flag === "--warmup") options.warmupRequests = parsed;
   if (flag === "--max-old-space") options.maxOldSpaceMb = parsed;
+  if (flag === "--ready-timeout") options.readyTimeoutSeconds = parsed;
   return FLAG_OK;
 }
 function applyFlag(spec, value, options) {
@@ -93115,6 +93180,7 @@ function applyFlag(spec, value, options) {
     case "--idle":
     case "--warmup":
     case "--max-old-space":
+    case "--ready-timeout":
       return applyNumericFlag(spec.flag, value, options);
     case "--quick":
       options.quick = true;
@@ -93187,6 +93253,7 @@ function parseCliArgs(argv) {
     idleSeconds: null,
     warmupRequests: null,
     maxOldSpaceMb: null,
+    readyTimeoutSeconds: null,
     quick: false,
     noResolve: false,
     selfCheck: false,
@@ -93869,7 +93936,12 @@ async function runRitual(options, deps = defaultDeps) {
     serverPath: options.serverPath,
     workDir: options.workDir,
     bootstrapPath: options.bootstrapPath,
-    ...options.maxOldSpaceMb !== void 0 && { maxOldSpaceMb: options.maxOldSpaceMb }
+    // Wait on the route this ritual is about to measure. `/` is a different
+    // page with different failure modes, and readiness judged on it withdrew
+    // routes that were serving fine (#74).
+    readyPath: options.route,
+    ...options.maxOldSpaceMb !== void 0 && { maxOldSpaceMb: options.maxOldSpaceMb },
+    ...options.readyTimeoutMs !== void 0 && { readyTimeoutMs: options.readyTimeoutMs }
   };
   let app;
   try {
@@ -94780,6 +94852,7 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
     ...pass?.cycles !== void 0 ? { cycles: pass.cycles } : options.cycles !== void 0 && { cycles: options.cycles },
     ...options.idleMs !== void 0 && { idleMs: options.idleMs },
     ...options.maxOldSpaceMb !== void 0 && { maxOldSpaceMb: options.maxOldSpaceMb },
+    ...options.readyTimeoutMs !== void 0 && { readyTimeoutMs: options.readyTimeoutMs },
     ...headers !== void 0 && { headers },
     ...routeConfig.abandonAfterMs !== void 0 && {
       abandonAfterMs: routeConfig.abandonAfterMs

package/dist/cli-args.d.ts

@@ -16,6 +16,8 @@ export type CliRunOptions = {
     idleSeconds: number | null;
     warmupRequests: number | null;
     maxOldSpaceMb: number | null;
+    /** Seconds each measured process gets to boot before the route is failed. */
+    readyTimeoutSeconds: number | null;
     quick: boolean;
     noResolve: boolean;
     selfCheck: boolean;

package/dist/cli.js

@@ -22,7 +22,7 @@ import {
   runSelfCheck,
   unregisterChild,
   validateTarget
-} from "./chunk-JHOE2RCM.js";
+} from "./chunk-QNYUT2XF.js";
 import {
   classifyTrend
 } from "./chunk-4FYSLLSX.js";
@@ -933,6 +933,9 @@ async function main() {
     ...options.idleSeconds !== null && { idleMs: options.idleSeconds * 1e3 },
     ...options.warmupRequests !== null && { warmupRequests: options.warmupRequests },
     ...options.maxOldSpaceMb !== null && { maxOldSpaceMb: options.maxOldSpaceMb },
+    ...options.readyTimeoutSeconds !== null && {
+      readyTimeoutMs: options.readyTimeoutSeconds * 1e3
+    },
     ...options.diffAll && { diffAll: true },
     ...options.noResolve && { resolveInconclusive: false },
     ...options.output !== null && { outputDir: options.output },

package/dist/index.js

@@ -41,7 +41,7 @@ import {
   sourceIndexAt,
   summarizeBaseline,
   validateTarget
-} from "./chunk-JHOE2RCM.js";
+} from "./chunk-QNYUT2XF.js";
 import {
   renderHtmlReport
 } from "./chunk-YLHE4N5G.js";

package/dist/launcher.d.ts

@@ -8,6 +8,18 @@ import { type ChildProcess } from "node:child_process";
  * so `--max-old-space` exists and the chosen value is recorded in `run.json`.
  */
 export declare const DEFAULT_MAX_OLD_SPACE_MB = 512;
+/**
+ * How long each startup wait gets before the route is called failed.
+ *
+ * It was 15 s, shared between waiting for the control channel and waiting for
+ * the app to listen — so a slow channel spent the app's budget too. Both
+ * numbers were also invisible: a real app that needs longer to boot than the
+ * tool was willing to wait had no way to say so, and got
+ * `timed out waiting for app` on every route (#71). 60 s is what a cold
+ * standalone bundle of a couple of thousand modules takes on a laptop with
+ * a busy disk, with room to spare; `--ready-timeout` moves it.
+ */
+export declare const DEFAULT_READY_TIMEOUT_MS = 60000;
 export type LaunchOptions = {
     /** Absolute path to the standalone `server.js` (or any PORT/HOSTNAME-honoring server). */
     serverPath: string;
@@ -18,7 +30,18 @@ export type LaunchOptions = {
     /** Path to the built bootstrap module loaded with `--import`. */
     bootstrapPath: string;
     hostname?: string;
+    /**
+     * Path the readiness probe asks for. Defaults to `/`, but a run should pass
+     * the route it is about to measure: an app can serve that route perfectly
+     * and still fail on `/` — an i18n redirect, an auth wall, a rewrite — and
+     * the wait would then be judging a page nobody asked about (#74).
+     */
+    readyPath?: string;
     maxOldSpaceMb?: number;
+    /**
+     * Budget for each of the two waits below, not for the pair. Default:
+     * `DEFAULT_READY_TIMEOUT_MS`.
+     */
     readyTimeoutMs?: number;
     env?: Record<string, string>;
 };
@@ -81,6 +104,21 @@ export declare function explainStartupFailure(stderr: string): string;
  */
 export declare function stderrShowsHeapExhaustion(stderr: string): boolean;
 export declare function explainRuntimeFailure(stderr: string, maxOldSpaceMb: number): string;
+/**
+ * What to say when the process is alive and answering on its control channel,
+ * but never opened the app port. The old message named the port and stopped
+ * there, which reads like the tool failed to connect to something that was
+ * running. The process is up: what did not happen is the listen.
+ */
+export declare function appNeverListened(hostname: string, port: number, budgetMs: number, stderr: string, lastFailure?: string | undefined): string;
+/**
+ * `fetch` rejects with a bare `TypeError: fetch failed`; what happened is one
+ * level down, and not always as a `code` — a redirect loop arrives as a
+ * message with none.
+ */
+export declare function probeFailure(cause: unknown): string;
+/** Whether a probe failure means the port is not open yet. */
+export declare function meansNotListening(failure: string): boolean;
 /**
  * Spawns the measured server in a fresh child process with GC exposed and the
  * control-channel bootstrap preloaded, and waits until both the app port and

package/dist/ritual.d.ts

@@ -20,6 +20,8 @@ export type RitualOptions = {
     idleMs?: number;
     /** Old-space cap for the measured process (MB). Default: 512. */
     maxOldSpaceMb?: number;
+    /** How long the process gets to start listening (ms). Default: 60_000. */
+    readyTimeoutMs?: number;
     /** Headers sent with every request during warm-up and load. */
     headers?: Record<string, string>;
     /**

package/dist/runner.d.ts

@@ -230,6 +230,11 @@ export type RunOptions = {
     idleMs?: number;
     /** Old-space cap for each measured process (MB). Default 512. */
     maxOldSpaceMb?: number;
+    /**
+     * How long each measured process gets to start listening, in milliseconds.
+     * Default: `DEFAULT_READY_TIMEOUT_MS`.
+     */
+    readyTimeoutMs?: number;
     /** Also diff routes with a stable verdict. Default false: diffs are slow. */
     diffAll?: boolean;
     /** Only measure routes matching these templates or prefixes. */

package/dist/target.d.ts

@@ -6,7 +6,11 @@ export declare class TargetError extends Error {
 }
 export type ValidatedTarget = {
     appDir: string;
-    /** Absolute path to `.next/standalone/server.js`. */
+    /**
+     * Absolute path to the standalone `server.js`. At the root of
+     * `.next/standalone` for a single-package app; under the app's path relative
+     * to the workspace root for a monorepo.
+     */
     standaloneServer: string;
     appPaths: AppPathsManifest;
     pages: PagesManifest;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-leak",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Find out whether your Next.js app actually leaks memory — how much, on which route, and whose fault it is.",
   "keywords": [
     "nextjs",