fix: Prevent closure memory leaks in setTimeout/setInterval

[yamadashy]

Replace arrow functions with .bind() in setTimeout/setInterval callbacks to prevent closures from capturing the surrounding scope and retaining references to large objects (response bodies, streams, deps), which delays garbage collection.

Changes

src/core/git/gitHubArchive.ts

• setTimeout(() => controller.abort(), timeout) → setTimeout(controller.abort.bind(controller), timeout)

website/client/composables/usePackRequest.ts

• setTimeout(() => { requestController.abort('timeout') }, ...) → setTimeout(controller.abort.bind(controller, 'timeout'), ...)

website/server/src/domains/pack/utils/cache.ts

• setInterval(() => this.cleanup(), ...) → setInterval(this.cleanup.bind(this), ...)
• Save interval ID for proper cleanup
• Add .unref() so the timer doesn't prevent process exit
• Add dispose() method for resource cleanup

Reference

Based on the pattern identified by Jarred Sumner (Bun): replacing () => controller.abort() with controller.abort.bind(controller) to avoid closure-based memory leaks.

Checklist

• Run npm run test
• Run npm run lint

---

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0e598520-293c-4797-81f8-33a059c422b5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Refactors timeout and interval handling across three files by binding context-preserving functions and adds a new dispose() method to the RequestCache class for explicit resource cleanup. The changes ensure correct this context binding in timeout/interval callbacks and enable proper cleanup of interval timers.

Changes

Cohort / File(s)	Summary
Timeout/Abort Refactoring src/core/git/gitHubArchive.ts, website/client/composables/usePackRequest.ts	Refactors setTimeout callbacks to use bound functions instead of inline callbacks. Binds controller.abort and requestController.abort to preserve correct this context before passing to setTimeout.
RequestCache Resource Management website/server/src/domains/pack/utils/cache.ts	Stores interval ID in private field, binds cleanup method, calls unref() on interval for process exit handling, and adds new public dispose() method for manual resource cleanup.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• perf(core): Replace ZIP archive with streaming tar.gz extraction #1153: Modifies timeout/abort handling in src/core/git/gitHubArchive.ts with similar context binding refactoring.
• feat(website): add cancel functionality for pack requests #864: Updates timeout/abort callback pattern in website/client/composables/usePackRequest.ts with bound function approach.
• refactor(website): Remove ZIP file caching and extend remote repo cache #1106: Changes RequestCache implementation and usage including TTL handling and cache behavior modifications.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title clearly and specifically summarizes the main change: preventing closure memory leaks in setTimeout/setInterval callbacks through binding.
Description check	✅ Passed	The pull request description is comprehensive and well-structured, covering the motivation, specific changes across all modified files, references, and completion of the required checklist items.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/prevent-closure-memory-leak-in-timeout

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on optimizing memory usage by refactoring setTimeout and setInterval callbacks. By switching from arrow functions to .bind(), the changes prevent closures from retaining unnecessary references to their surrounding scope, which can delay garbage collection. Additionally, the RequestCache class now includes better control over its cleanup interval, ensuring that background timers do not hinder application shutdown and providing a clear mechanism for resource disposal.

Highlights

• Memory Leak Prevention: Replaced arrow functions with .bind() for setTimeout and setInterval callbacks across the codebase to prevent closures from inadvertently capturing and retaining references to large objects, thereby improving garbage collection efficiency.
• Enhanced Resource Management: Improved the RequestCache class by saving the setInterval ID, applying .unref() to prevent the timer from blocking process exit, and introducing a dispose() method for explicit resource cleanup.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• src/core/git/gitHubArchive.ts
  • Replaced setTimeout(() => controller.abort(), timeout) with setTimeout(controller.abort.bind(controller), timeout) to prevent closure-based memory leaks.
• website/client/composables/usePackRequest.ts
  • Refactored setTimeout(() => { requestController.abort('timeout') }, ...) to setTimeout(requestController.abort.bind(requestController, 'timeout'), ...) to avoid capturing the surrounding scope.
• website/server/src/domains/pack/utils/cache.ts
  • Replaced setInterval(() => this.cleanup(), ...) with setInterval(this.cleanup.bind(this), ...) to prevent closure-based memory leaks.
  • Stored the setInterval ID in this.cleanupIntervalId for proper management.
  • Applied .unref() to the cleanupIntervalId to allow the Node.js event loop to exit if no other events are pending.
  • Implemented a dispose() method to clear the interval and the cache, ensuring explicit resource cleanup.

Activity

• The author completed the checklist items, running npm run test and npm run lint.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.14%. Comparing base (76d4b17) to head (cf9e7c9).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1233   +/-   ##
=======================================
  Coverage   87.14%   87.14%           
=======================================
  Files         115      115           
  Lines        4310     4310           
  Branches      998      998           
=======================================
  Hits         3756     3756           
  Misses        554      554           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Code Review

Overall this is a clean, well-scoped PR. The .bind() pattern is a valid approach for avoiding closure-based memory retention in timer callbacks. A few observations:

Positive

• Focused scope — each change is minimal and targeted
• cache.ts improvements are great — saving the interval ID, adding .unref(), and providing a dispose() method are all meaningful improvements beyond just the .bind() change
• The PR description clearly explains the motivation and references

Observations

1. Practical impact of the closure change

For the gitHubArchive.ts and usePackRequest.ts cases, the arrow functions being replaced only captured controller/requestController — they didn't close over large response bodies or streams. The setTimeout callbacks are also cleared in finally blocks, so objects are released promptly in the happy path. The .bind() pattern is still slightly better (avoids the closure object allocation), but the memory savings here are marginal. The cache.ts change with setInterval is the one with real impact since that timer persists for the lifetime of the process.

2. `dispose()` is not called anywhere

The new dispose() method on RequestCache is a good addition, but the shared instance in sharedInstance.ts (export const cache = new RequestCache<PackResult>(600)) never calls it. Consider adding a process shutdown hook (e.g., process.on('SIGTERM', ...)) or documenting that .unref() makes explicit disposal optional for the current use case. Since .unref() is applied, this is not a blocker — just something to be aware of.

3. No test coverage for the changes

There are no existing tests for RequestCache or for the timeout behavior in gitHubArchive.ts. While the changes are straightforward behavioral equivalents, adding a basic test for dispose() (verifying the interval is cleared and cache is emptied) would strengthen confidence, especially since RequestCache now has richer lifecycle semantics.

4. Minor: Original code in `usePackRequest.ts` had a null guard

The original code had if (requestController) { requestController.abort('timeout') }, but the new code binds requestController.abort immediately after creating the controller, so the null check is no longer needed — this is correct. Just noting that the semantic is preserved because requestController is guaranteed non-null at that point in the code.

Premortem / Edge Cases

• AbortController.abort.bind() compatibility: .bind() on AbortController.abort works in modern Node.js and browsers. In older environments where abort() was not a regular method (it relied on internal slots), .bind() could fail. This is unlikely to be an issue given the project's target environments, but worth noting.
• No deployment risk: These are behavioral equivalents with no API changes.

Verdict

Approve — clean, low-risk improvements. The cache.ts changes (interval tracking, .unref(), dispose()) are the most valuable part.

---

🤖 Generated with Claude Code

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[cloudflare-workers-and-pages]

Deploying repomix with    Cloudflare Pages

Latest commit:	cf9e7c9
Status:	✅  Deploy successful!
Preview URL:	https://5bf52588.repomix.pages.dev
Branch Preview URL:	https://fix-prevent-closure-memory-l.repomix.pages.dev

View logs