Skip to content

Fix leaks#11241

Merged
abnegate merged 5 commits into1.8.xfrom
fix-leaks
Feb 4, 2026
Merged

Fix leaks#11241
abnegate merged 5 commits into1.8.xfrom
fix-leaks

Conversation

@abnegate
Copy link
Copy Markdown
Member

@abnegate abnegate commented Feb 4, 2026

What does this PR do?

(Provide a description of what this PR does and why it's needed.)

Test Plan

(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your changes work. Screenshots may also be helpful.)

Related PRs and Issues

  • (Related PR or issue)

Checklist

  • Have you read the Contributing Guidelines on issues?
  • If the PR includes a change to an API's metadata (desc, label, params, etc.), does it also include updated API specs and example docs?

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Feb 4, 2026

📝 Walkthrough

Walkthrough

The pull request introduces several improvements across four files. The Realtime adapter refactors subscription storage from simple query strings to composite data objects containing both original strings and pre-parsed Query objects, updating all associated metadata and subscriber resolution methods accordingly. Two worker classes add try-finally blocks for guaranteed resource cleanup: StatsUsage ensures statDocuments are cleared after database writes, and Webhooks ensures cURL handles are closed even if exceptions occur. The Documents Action processor adds a depth parameter with early exit logic to prevent infinite recursion when processing related document relationships beyond a maximum depth threshold. Overall, net change of 78 lines added and 64 removed across diverse modules.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 1 | ❌ 2
❌ Failed checks (1 warning, 1 inconclusive)
Check name Status Explanation Resolution
Description check ⚠️ Warning The description contains only the PR template with unfilled sections; no actual details about the changes, motivation, or test plan were provided by the author. Fill in the description sections with details about what leaks are being fixed, why these changes are needed, and how the fixes were tested.
Title check ❓ Inconclusive The title 'Fix leaks' is vague and generic; while it relates to the changeset, it does not convey meaningful information about what specific leaks are being fixed. Use a more descriptive title that specifies what leaks are being fixed, such as 'Fix resource and memory leaks in Realtime, Workers, and Actions' or 'Fix resource cleanup in webhooks and stats workers'.
✅ Passed checks (1 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix-leaks

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown

github-actions bot commented Feb 4, 2026

Security Scan Results for PR

Docker Image Scan Results

Package Version Vulnerability Severity
libcrypto3 3.5.4-r0 CVE-2025-15467 CRITICAL
libcrypto3 3.5.4-r0 CVE-2025-69419 HIGH
libcrypto3 3.5.4-r0 CVE-2025-69421 HIGH
libpng 1.6.51-r0 CVE-2025-66293 HIGH
libpng 1.6.51-r0 CVE-2026-22695 HIGH
libpng 1.6.51-r0 CVE-2026-22801 HIGH
libpng-dev 1.6.51-r0 CVE-2025-66293 HIGH
libpng-dev 1.6.51-r0 CVE-2026-22695 HIGH
libpng-dev 1.6.51-r0 CVE-2026-22801 HIGH
libssl3 3.5.4-r0 CVE-2025-15467 CRITICAL
libssl3 3.5.4-r0 CVE-2025-69419 HIGH
libssl3 3.5.4-r0 CVE-2025-69421 HIGH
libxml2 2.13.8-r0 CVE-2025-49794 CRITICAL
libxml2 2.13.8-r0 CVE-2025-49796 CRITICAL
libxml2 2.13.8-r0 CVE-2025-49795 HIGH
libxml2 2.13.8-r0 CVE-2025-6021 HIGH
openssl 3.5.4-r0 CVE-2025-15467 CRITICAL
openssl 3.5.4-r0 CVE-2025-69419 HIGH
openssl 3.5.4-r0 CVE-2025-69421 HIGH
openssl-dev 3.5.4-r0 CVE-2025-15467 CRITICAL
openssl-dev 3.5.4-r0 CVE-2025-69419 HIGH
openssl-dev 3.5.4-r0 CVE-2025-69421 HIGH
py3-urllib3 1.26.20-r0 CVE-2026-21441 HIGH
py3-urllib3-pyc 1.26.20-r0 CVE-2026-21441 HIGH
github.com/containerd/containerd/v2 v2.0.2 CVE-2024-25621 HIGH
golang.org/x/crypto v0.31.0 CVE-2025-22869 HIGH
golang.org/x/oauth2 v0.24.0 CVE-2025-22868 HIGH
stdlib 1.22.10 CVE-2025-47907 HIGH
stdlib 1.22.10 CVE-2025-58183 HIGH
stdlib 1.22.10 CVE-2025-61726 HIGH
stdlib 1.22.10 CVE-2025-61728 HIGH
stdlib 1.22.10 CVE-2025-61729 HIGH

Source Code Scan Results

🎉 No vulnerabilities found!

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
src/Appwrite/Messaging/Adapter/Realtime.php (1)

293-312: ⚠️ Potential issue | 🟡 Minor

Handle select(*) anywhere in the query list for empty payloads.

Line 300-301: The empty-payload shortcut only checks the first parsed query. If select() appears later in the list, empty payload events won’t match even though they should. Consider scanning all queries for select().

💡 Suggested fix
-                                $isEmptyPayloadAndSelectAll = !empty($parsedQueries) && RuntimeQuery::isSelectAll($parsedQueries[0]) && empty($payload);
+                                $hasSelectAll = false;
+                                foreach ($parsedQueries as $parsedQuery) {
+                                    if (RuntimeQuery::isSelectAll($parsedQuery)) {
+                                        $hasSelectAll = true;
+                                        break;
+                                    }
+                                }
+                                $isEmptyPayloadAndSelectAll = $hasSelectAll && empty($payload);

@github-actions
Copy link
Copy Markdown

github-actions bot commented Feb 4, 2026

✨ Benchmark results

  • Requests per second: 2,325
  • Requests with 200 status code: 418,577
  • P99 latency: 0.067685695

⚡ Benchmark Comparison

Metric This PR Latest version
RPS 2,325 1,121
200 418,577 201,856
P99 0.067685695 0.182757823

@abnegate abnegate merged commit d45893d into 1.8.x Feb 4, 2026
101 of 104 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant