next-leak 0.11.2 → 0.12.0

package/README.md

@@ -29,22 +29,43 @@ next-leak found the growth, the retaining object and the chain that holds it —
 without being told what to look for. Next.js 16.3.0 has since fixed it.
 
 **Verified against real Next.js issues**, not synthetic fixtures. Issue states
-checked 2026-09-05:
+checked 2026-09-19:
 
 | Issue | What it is | Measured | State today |
 |---|---|---|---|
-| [#97776](https://github.com/vercel/next.js/issues/97776) | `use cache`: `AbortSignal.any` composites never released (canonical issue; #97938 and #97464 are duplicates) | +705 KB per request on 16.3.3, flat on 16.2.6 (the #97938 run) | **open** — fix [#97476](https://github.com/vercel/next.js/pull/97476) merged Aug 19, in no stable release as of 16.3.4 |
-| [#97938](https://github.com/vercel/next.js/issues/97938) | `cacheComponents`: composite abort signal never released | +705 KB per request on 16.3.3, flat on 16.2.6 | closed Aug 31 as a duplicate of #97776; fix in no stable release |
+| [#97938](https://github.com/vercel/next.js/issues/97938) | `use cache` / `cacheComponents`: `AbortSignal.any` composites never released (canonical issue since Sep 9; #97776 and #97464 are duplicates) | +705 KB per request on 16.3.3, flat on 16.2.6 | fixed in **16.3.5** (Sep 11) by [#98448](https://github.com/vercel/next.js/pull/98448), the backport of [#97476](https://github.com/vercel/next.js/pull/97476); re-measured Sep 14: +709 KB per request on 16.3.4, flat on 16.3.5 |
+| [#97776](https://github.com/vercel/next.js/issues/97776) | `use cache`: the same composites, reported from production | the #97938 run above | closed Sep 9 as a duplicate of #97938; fixed in 16.3.5 |
 | [#96533](https://github.com/vercel/next.js/issues/96533) | ISR revalidation holds RSC buffers between collections | 4–5 MB of `arrayBuffers` held vs 0.32 MB retained | **open** |
-| [#97464](https://github.com/vercel/next.js/issues/97464) | Static-gen worker retains per prerendered page | OOM after 1617 and 1525 of 2504 pages on 16.3.3; 16.2.12 finishes at 0.05 MB/page | closed Aug 31 as a duplicate of #97776; fix in no stable release |
-| [#97802](https://github.com/vercel/next.js/issues/97802) | Turbopack compilation saturates the container before rendering anything | Reporter's reproduction in a 2 CPU / 4 GB container: 16.2.12 peaks ~2 GB and finishes; 16.3.0 pins 4 GB and stalls | **open** — bisected to 16.3.0; no fix known |
+| [#97464](https://github.com/vercel/next.js/issues/97464) | Static-gen worker retains per prerendered page | OOM after 1617 and 1525 of 2504 pages on 16.3.3; 16.2.12 finishes at 0.05 MB/page | closed Aug 31 as a duplicate; same fix, in 16.3.5 — not re-measured here yet |
+| [#97802](https://github.com/vercel/next.js/issues/97802) | Turbopack compilation saturates the container before rendering anything | not attributable to a version: see below. [#98581](https://github.com/vercel/next.js/pull/98581) (merged Sep 16, in `16.4.0-canary.34`) doesn't move it: cold build peak 5,161 MB on canary.33 and 5,279 MB on canary.35 (`next-leak build`); under 4 GB neither finishes compiling in 600 s, under 5 GB both compile in about a minute | **open** — the other fix from Vercel, [#98611](https://github.com/vercel/next.js/pull/98611), is still a draft |
+| [#98707](https://github.com/vercel/next.js/issues/98707) | `next dev`: a route handler compiled after N pages costs ~16 MB × N | reproduced independently (10 pages, 34 handlers, Node 24.18): 851 MB on `16.3.0-canary.100`, **2,354 MB on canary.101**, 1,704 MB on 16.3.5; 1,461 MB requesting the handlers first | **open** — the reporter's bisect to `16.3.0-canary.101` holds |
 | [#92287](https://github.com/vercel/next.js/issues/92287) | Cache Components: unbounded `arrayBuffers` under load | 37.5 MB of arrayBuffers held between collections, 37x what it retains (16.3.1) | **open** |
-| [#84884](https://github.com/vercel/next.js/issues/84884) | axios + `AbortSignal` in middleware | 32.8 → 369.9 MB | **open** |
+| [#84884](https://github.com/vercel/next.js/issues/84884) | axios + `AbortSignal` in middleware: a reference cycle through undici's `Request` finalizer, closed when Turbopack's scope hoisting inlines axios's `composeSignals` | +17.02 MB/1000 req on 16.3.5 (Node 24.18), +4.62 (Node 24.21); flat with scope hoisting off | **open** — still leaks on 16.3.5 and 16.4.0-canary.29; fix proposed in undici ([nodejs/undici#5822](https://github.com/nodejs/undici/pull/5822)); workaround: `experimental: { turbopackScopeHoisting: false }` |
 | [#89091](https://github.com/vercel/next.js/issues/89091) | zlib retention on mid-stream aborts | +42.5 MB/1000 aborted req on 16.1.5; **+0.03 on 16.3.1** | closed |
 | [#95094](https://github.com/vercel/next.js/issues/95094) | Middleware `setTimeout` ids retained by the sandbox | 112 MB retained; flat after the fix | fixed in 16.3.0 |
 | [#94890](https://github.com/vercel/next.js/issues/94890) | Router LRU cache doesn't count its keys | 26.7 → 71.9 MB | fixed in 16.3.0 |
 | [#94919](https://github.com/vercel/next.js/issues/94919) | Retention on client aborts | 39 → 139 MB · [with a caveat](#scope-and-limits-read-before-filing-issues) | fixed in 16.3.0 |
 
+**#97802, and a measurement of ours that did not hold up.** Earlier versions of this
+table said the regression was bisected to 16.3.0, on the strength of a 16.2.12 arm
+that peaked around 2 GB while 16.3.x pinned the 4 GB ceiling. Re-measured on
+2026-09-16 in a real cgroup, that comparison falls apart:
+`turbopackRustReactCompiler` does not exist before 16.3, so 16.2.12 rejects the key
+and silently compiles through the Babel React Compiler while every 16.3 arm uses the
+Rust one. Hold the version fixed and change only the compiler and
+`16.3.0-canary.100` goes from 4,096 MiB with 12.3M at-limit events to 2,250 MiB with
+zero. Give the Babel arms 2,400 s and neither 16.2.12 (2,180 MiB) nor 16.3.5
+(1,692 MiB) ever reaches `Compiled successfully` — the low peak was unfinished work,
+not headroom. With the compiler equalised and 6 GB of room, 16.3.5 is the only arm
+that finishes the build at all, and what kills 16.2.12 and `canary.0` happens after
+compilation, in prerendering. So this row no longer claims a version: the fixture
+does not separate 16.2 from 16.3.
+
+Two things worth taking from this if you measure builds yourself: when every arm
+pins at exactly the cgroup ceiling, the ceiling is the measurement and not the
+versions, so the peak cannot be the verdict; and an arm that never reaches the end
+of compilation is not an arm that fits, however low its peak looks.
+
 The closed ones are kept deliberately: a tool that only lists open bugs
 looks impressive until the bugs close, and what those rows show is that the
 measurements matched what the fixes turned out to be. #94919 is the sharpest —
@@ -220,6 +241,7 @@ separates them, because each one has a different fix:
 | A route that is expensive, not leaky | `failed` under load it cannot sustain, flat once concurrency fits | Real leaks survive forced GC at any concurrency; saturation disappears when load drops |
 | Growth that pauses and resumes (stepwise) | `leak` | A healthy route gives back 20-30% of its growth; a stepwise leak gives back nothing |
 | A cache filling up under the load that measures it | `saturating` | A bounded store grows by less each cycle as new keys get rarer; a leak does not decelerate |
+| Memory a forced GC reclaims that production never reclaims in time | `pressure` | Every verdict sample is post-GC; the peaks are sampled under load, and a ceiling every settled cycle comes back to is a regime, not an episode |
 | Native/buffer memory with a flat JS heap | `leak (external)` or an explicit RSS note | Heap, `external` and RSS are sampled and judged separately |
 | A leak in your code vs a dependency vs Next itself | `culprit: src/app/x/page.tsx (your code)` — or the package, or framework internals | Retainer chains mapped through the build's source maps |
 | A run whose own evidence is weak | `low confidence` warnings, or the verdict is withdrawn | Every run audits itself: did the load land, did the heap settle, does one cycle carry the average, did the heap run into its own ceiling |
@@ -256,6 +278,27 @@ separates them, because each one has a different fix:
   draft is generated. When the load was driving a cache with keys it had never
   served, the report says so on any growing route and points at `{n%N}` to
   bound the key set — measure again that way before believing the number.
+- **`pressure`** — nothing is retained, and the process is still heading for a
+  ceiling. Every sample a verdict is computed from is taken after a forced GC,
+  and production runs none of those, so the retention verdicts above are
+  structurally blind to memory a full collection *does* reclaim but that the
+  runtime does not reclaim fast enough on its own. This is that case: the
+  post-GC curve is flat or falling, the peak sampled under load is far above
+  what the route retains, **and** every settled cycle reaches that height. On
+  the reproduction for [#92287](https://github.com/vercel/next.js/issues/92287)
+  the app allocated about 1 MB of `arrayBuffers` per request, passed 3 GB and
+  was OOM-killed — and the old verdict was `stable`, which is precisely the trap
+  this tool exists to warn other people about. A single high peak is *not* this:
+  one cycle that reached a ceiling for a reason that did not repeat stays
+  `stable` with a peak note, because an episode is not a regime. What separates
+  this from an app entitled to a large working set is not the shape of the
+  curve, it is that a working set survives the forced collection and lands in
+  what the route retains, which acquits it on the ratio alone. These
+  routes are not measured again (the run already saw the ceiling it is
+  reporting) and get no issue draft: the finding is real, but it is not
+  retention, so there is nothing for a snapshot diff to name. The fix is
+  usually allocation rate, response size or concurrency, not a missing
+  `delete`.
 - **`inconclusive`** — the evidence does not decide. The run does not stop there: any inconclusive route is **measured again automatically**, with twice the cycles, and the second pass is what you see (`resolved at 8 cycles` next to the verdict). On the reproduction for [#95094](https://github.com/vercel/next.js/issues/95094), `--quick` alone reports `inconclusive` on three deltas and then comes back with the leak. `--no-resolve` turns the second pass off; when even that is undecided, the re-run command is still printed.
 - **`failed`** — the route errored under load (auth redirects, POST-only endpoints). >1% non-2xx aborts measurement instead of measuring garbage. That's by design. A process that died of **heap exhaustion** is not one of these: it reports `leak`, because a route that could not survive its own load did not fail to be measured — it was measured right up to the point where it stopped fitting. The verdict comes from that outcome, not from the shape of the truncated curve, which is the same rule `next-leak build` applies to a static-generation worker that dies. The run prints the cycles it survived and the growth up to the death, and exits 0 with a finding rather than 1 with an error.
 
@@ -282,9 +325,26 @@ That is a real measurement of the reproduction in
 app on 16.3.1 under a shorter profile still reaches 544 MB against 33.8 MB
 retained, so the shape has not gone anywhere. The note fires when the peak heap comes within
 75% of `--max-old-space`, or when peak RSS is at least 8× the retained heap
-and above 512 MB. It never changes the verdict — retention and peak are
-different questions, and only one of them is a leak. A peak is the highest
-value *sampled* (every 250 ms), so it is a lower bound.
+and above 512 MB. A peak is the highest value *sampled* (every 250 ms), so it
+is a lower bound.
+
+A single high peak stays a note and leaves the verdict alone: one cycle that
+reached a ceiling may have reached it for a reason that will not happen again.
+When **every settled cycle** comes back to that height the verdict becomes
+[`pressure`](#reading-the-verdicts) instead, because at that point the run is no
+longer describing an episode, it is describing what the route does under load —
+which is the number a container is sized against. The peak is not required to
+climb, and asking it to would make the verdict unreachable: each cycle is
+preceded by a forced collection and runs the same traffic, so the peak converges
+on traffic × cost-per-request rather than ramping. Measured on the #92287
+reproduction on 2026-09-24, the rss peaks across four cycles were 1229, 1344,
+1369 and 1379 MB — an asymptote.
+
+What the route retains, for this ratio, is the **floor** of its post-GC cycle
+samples rather than the last of them. Those samples follow a forced collection
+but can still carry memory the collector had not reached yet, and on that same
+reproduction they swung between 45 MB and 217 MB inside a single run, which by
+itself decided whether the note appeared at all.
 
 If the measured process dies at the limit instead of merely approaching it,
 the route fails saying exactly that, with the limit in force and how to raise

package/THIRD-PARTY-NOTICES.md

@@ -56,7 +56,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-## @babel/generator@7.29.7
+## @babel/generator@7.29.8
 
 License: MIT
 https://babel.dev/docs/en/next/babel-generator
@@ -184,7 +184,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-## @babel/parser@7.29.7
+## @babel/parser@7.29.8
 
 License: MIT
 https://babel.dev/docs/en/next/babel-parser
@@ -245,7 +245,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-## @babel/traverse@7.29.7
+## @babel/traverse@7.29.8
 
 License: MIT
 https://babel.dev/docs/en/next/babel-traverse
@@ -460,7 +460,7 @@ SOFTWARE.
 
 ---
 
-## @memlab/core@2.0.4
+## @memlab/core@2.0.5
 
 License: MIT
 https://github.com/facebook/memlab#readme
@@ -491,7 +491,7 @@ SOFTWARE.
 
 ---
 
-## @memlab/e2e@2.0.4
+## @memlab/e2e@2.0.5
 
 License: MIT
 https://github.com/facebook/memlab#readme
@@ -522,7 +522,7 @@ SOFTWARE.
 
 ---
 
-## @memlab/heap-analysis@2.0.4
+## @memlab/heap-analysis@2.0.5
 
 License: MIT
 https://github.com/facebook/memlab#readme
@@ -553,7 +553,7 @@ SOFTWARE.
 
 ---
 
-## @memlab/lens@2.0.4
+## @memlab/lens@2.0.5
 
 License: MIT
 https://github.com/facebook/memlab#readme

package/dist/bootstrap.js

@@ -3,6 +3,8 @@ import "./chunk-6XYFBOL2.js";
 
 // src/bootstrap.ts
 import { mkdir, writeFile } from "fs/promises";
+import http2 from "http";
+import https from "https";
 import path2 from "path";
 
 // src/control-server.ts
@@ -21,6 +23,7 @@ async function forceGc(passes = 3) {
   }
   return true;
 }
+var requestProbe = globalThis;
 function sampleMemory(gcExposed) {
   const usage = process.memoryUsage();
   return {
@@ -28,7 +31,12 @@ function sampleMemory(gcExposed) {
     heapUsed: usage.heapUsed,
     rss: usage.rss,
     external: usage.external,
-    arrayBuffers: usage.arrayBuffers
+    arrayBuffers: usage.arrayBuffers,
+    pid: process.pid,
+    ppid: process.ppid,
+    argv: process.argv,
+    cwd: process.cwd(),
+    ...requestProbe.__nextLeakServedRequests === void 0 ? {} : { servedRequests: requestProbe.__nextLeakServedRequests }
   };
 }
 async function startControlServer(options) {
@@ -88,12 +96,30 @@ async function startControlServer(options) {
   };
 }
 
+// src/request-probe.ts
+function countServedRequests(module) {
+  const original = module.createServer;
+  module.createServer = function patched(...args) {
+    const server = original.apply(this, args);
+    server.on("request", () => {
+      requestProbe.__nextLeakServedRequests = (requestProbe.__nextLeakServedRequests ?? 0) + 1;
+    });
+    return server;
+  };
+}
+
 // src/bootstrap.ts
 var workDir = process.env["NEXT_LEAK_DIR"];
+function installRequestProbe() {
+  requestProbe.__nextLeakServedRequests = 0;
+  countServedRequests(http2);
+  countServedRequests(https);
+}
 if (workDir !== void 0 && workDir !== "") {
   try {
     await mkdir(workDir, { recursive: true });
     const server = await startControlServer({ snapshotDir: workDir });
+    installRequestProbe();
     await writeFile(
       path2.join(workDir, `control-${process.pid}.json`),
       JSON.stringify({ port: server.port, pid: process.pid })

package/dist/{chunk-4FYSLLSX.js → chunk-4NKGNMEA.js}

@@ -106,13 +106,17 @@ function classifyMemoryTrend(heapSamples, externalSamples, options = {}) {
   const external = classifyTrend(externalSamples, options);
   const severity = {
     leak: 0,
-    inconclusive: 1,
-    saturating: 2,
-    stable: 3
+    pressure: 1,
+    inconclusive: 2,
+    saturating: 3,
+    stable: 4
   };
   if (severity[external.verdict] < severity[heap.verdict]) {
     return { ...external, source: "external" };
   }
+  if (severity[external.verdict] === severity[heap.verdict] && external.growthPerCycle > heap.growthPerCycle) {
+    return { ...external, source: "external" };
+  }
   return heap;
 }
 
@@ -125,7 +129,8 @@ var VERDICT_WEAKENING = /* @__PURE__ */ new Set([
   "near-threshold",
   "spiky-growth",
   "thin-evidence",
-  "repetitions-disagree"
+  "repetitions-disagree",
+  "cache-residency"
 ]);
 function warrantsIssueDraft(report) {
   return effectiveVerdict(report) === "leak" && !report.confidence.warnings.some((warning) => VERDICT_WEAKENING.has(warning.code));
@@ -275,6 +280,15 @@ function thinEvidenceWarnings(trend, minGrowth) {
     detail: `judged on ${trend.deltas.length} cycles, and its weakest grew ${mb(smallest)} against a ${mb(minGrowth)} gate \u2014 on that few cycles ordinary oscillation reaches that, and a repeat run often disagrees; measure more cycles to resolve it`
   }];
 }
+function cacheResidencyWarnings(trend, revalidatesFromCache) {
+  if (trend.cacheDriven !== true || trend.verdict !== "leak" || revalidatesFromCache !== true) {
+    return [];
+  }
+  return [{
+    code: "cache-residency",
+    detail: `every request asked this ISR route for a key it had never cached, so storing them is part of the ${mb(trend.growthPerCycle)}/cycle \u2014 and here the usual remedy does not apply: bounding the keys ({n%N}) hands the requests back to the ISR cache, so the run would drive revalidation and measure Next's other path rather than a cleaner version of this one. Run it both ways and compare before attributing this to anyone`
+  }];
+}
 function isVerdictInvalid(input) {
   if (input.trend.verdict !== "leak") {
     return false;
@@ -295,6 +309,7 @@ function assessConfidence(input) {
     ...growthShapeWarnings(input.trend),
     ...noiseFloorWarnings(input.trend, minGrowth),
     ...thinEvidenceWarnings(input.trend, minGrowth),
+    ...cacheResidencyWarnings(input.trend, input.revalidatesFromCache),
     ...heapCeilingWarnings(input),
     ...warmUpBaselineWarnings(input)
   ];