Skip to content

Fix medium-severity audit issues in core query and React bindings#4

Merged
ConsoleTVs merged 2 commits intomainfrom
fix/audit-medium-severity-issues
Apr 12, 2026
Merged

Fix medium-severity audit issues in core query and React bindings#4
ConsoleTVs merged 2 commits intomainfrom
fix/audit-medium-severity-issues

Conversation

@ConsoleTVs
Copy link
Copy Markdown
Member

Summary

Resolves 7 medium-severity issues identified during the codebase audit. These fixes address event listener leaks, race conditions, error handling gaps, and cross-environment compatibility.

Core Query Engine (query.ts)

  • Wrapped BroadcastChannel.postMessage() in try-catch to prevent DataCloneError crashes when emitting non-cloneable data
  • Added AbortSignal support to once(), enabling stream() and sequence() generators to clean up event listeners when consumers break out of iteration
  • Added abort race condition guard in trigger() — checks controller.signal.aborted after fetch resolves to prevent writing stale data to cache after an abort() call
  • Captured broadcast reference at call time in subscribeBroadcast() to prevent stale closure if configure() replaces the broadcast channel
  • Wrapped await item.item in forget() with try-catch so rejected promises don't prevent remaining keys from being forgotten

Type Definitions (options.ts)

  • Updated OnceFunction type to accept optional AbortSignal parameter (non-breaking — parameter is optional)

React Bindings (QueryProvider.tsx)

  • Added typeof BroadcastChannel guard in useEffect for edge runtime compatibility

Tests (query.test.ts)

  • Fixed tautological assertions in cache access test — was comparing items to itself instead of itemsCache

…dings

- Wrap BroadcastChannel.postMessage() in try-catch to prevent DataCloneError crashes
- Add abort signal support to once() to fix event listener leaks in stream()/sequence() generators
- Guard against abort race condition in trigger() by checking signal.aborted before cache write
- Capture broadcast reference in subscribeBroadcast() to prevent stale closure after configure()
- Handle rejected promises in forget() to prevent hanging or throwing on pending cache items
- Add BroadcastChannel availability guard in QueryProvider for edge runtime compatibility
- Fix tautological test assertions comparing variables to themselves in cache access test
…detected

The abort guard in trigger() was returning without resolving or
rejecting the outer promise, which would leave callers hanging
indefinitely. Now properly rejects with the abort reason.
@ConsoleTVs ConsoleTVs marked this pull request as ready for review April 12, 2026 12:29
@ConsoleTVs ConsoleTVs merged commit 79217a5 into main Apr 12, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant