@blamejs/core - npm Package Compare versions

Comparing version 0.15.24 to 0.15.25

lib/sandbox.js

@@ -269,6 +269,19 @@ "use strict";
 
+    // Terminate the worker and only settle the caller's promise once the
+    // termination resolves. worker.terminate() is asynchronous: settling
+    // before it completes leaves the worker thread's MessagePort alive past
+    // the resolve, keeping the event loop open (a leaked handle that delays
+    // a shut-down on a slow runner). Awaiting terminate() releases it.
+    function _terminateThen(finish) {
+      var done = false;
+      function _once() { if (done) return; done = true; finish(); }
+      var p;
+      try { p = worker.terminate(); } catch (_e) { p = null; }
+      if (p && typeof p.then === "function") { p.then(_once, _once); }
+      else { _once(); }
+    }
+
     var timer = setTimeout(function () {
       if (settled) return;
       settled = true;
-      try { worker.terminate(); } catch (_e) { /* terminate best-effort */ }
       var elapsed = Date.now() - startedAt;
@@ -278,4 +291,6 @@ _emitAudit("sandbox.run.refused", "failure", {
       });
-      reject(new SandboxError("sandbox/timeout",
-        "sandbox.run: worker exceeded timeoutMs=" + timeoutMs + " (elapsed " + elapsed + "ms)"));
+      _terminateThen(function () {
+        reject(new SandboxError("sandbox/timeout",
+          "sandbox.run: worker exceeded timeoutMs=" + timeoutMs + " (elapsed " + elapsed + "ms)"));
+      });
     }, timeoutMs);
@@ -287,3 +302,6 @@
       clearTimeout(timer);
-      try { worker.terminate(); } catch (_e) { /* terminate best-effort */ }
+      _terminateThen(function () { _handleMessage(msg); });
+    });
+
+    function _handleMessage(msg) {
       if (!msg || typeof msg !== "object") {
@@ -318,3 +336,3 @@ _emitAudit("sandbox.run.refused", "failure", {
         msg.message || "sandbox.run: worker reported a refusal"));
-    });
+    }
 
@@ -321,0 +339,0 @@ worker.on("error", function (err) {

package.json

 {
   "name": "@blamejs/core",
-  "version": "0.15.24",
+  "version": "0.15.25",
   "description": "The Node framework that owns its stack.",
@@ -5,0 +5,0 @@ "license": "Apache-2.0",

sbom.cdx.json

@@ -5,6 +5,6 @@ {
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5b226dcb-1966-4142-a095-772bae1e5753",
+  "serialNumber": "urn:uuid:5197f455-603c-4d3d-b5eb-39adf581713f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-25T15:12:34.590Z",
+    "timestamp": "2026-06-25T20:36:43.824Z",
     "lifecycles": [
@@ -23,10 +23,10 @@ {
     "component": {
-      "bom-ref": "@blamejs/core@0.15.24",
+      "bom-ref": "@blamejs/core@0.15.25",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.24",
+      "version": "0.15.25",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.24",
+      "purl": "pkg:npm/%40blamejs/core@0.15.25",
       "properties": [],
@@ -59,3 +59,3 @@ "externalReferences": [
     {
-      "ref": "@blamejs/core@0.15.24",
+      "ref": "@blamejs/core@0.15.25",
       "dependsOn": []
@@ -62,0 +62,0 @@ }

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

17235900

0.01%

Lines of code

300379

0.01%

No dependency changes