@rushstack/node-core-library - npm Package Compare versions

Comparing version 5.16.0 to 5.17.0

CHANGELOG.md

 # Change Log - @rushstack/node-core-library
 
-This log was last generated on Fri, 03 Oct 2025 20:09:59 GMT and should not be manually modified.
+This log was last generated on Wed, 08 Oct 2025 00:13:28 GMT and should not be manually modified.
 
+## 5.17.0
+Wed, 08 Oct 2025 00:13:28 GMT
+
+### Minor changes
+
+- Add an `allowOversubscription` option to the `Async` API functions which prevents running tasks from exceeding concurrency.  Change its default to `false`.
+
 ## 5.16.0
@@ -6,0 +13,0 @@ Fri, 03 Oct 2025 20:09:59 GMT

lib/Async.d.ts

@@ -18,6 +18,23 @@ /**
     /**
-     * Optionally used with the {@link (Async:class).(forEachAsync:2)} to enable weighted operations where an operation can
-     * take up more or less than one concurrency unit.
+     * Optionally used with the {@link (Async:class).(forEachAsync:2)} to enable weighted operations where an
+     * operation can take up more or less than one concurrency unit.
      */
     weighted?: boolean;
+    /**
+     * This option affects the handling of task weights, applying a softer policy that favors maximizing parallelism
+     * instead of avoiding overload.
+     *
+     * @remarks
+     * By default, a new task cannot start executing if doing so would push the total weight above the concurrency limit.
+     * Set `allowOversubscription` to true to relax this rule, allowing a new task to start as long as the current
+     * total weight is below the concurrency limit.  Either way, a task cannot start if the total weight already equals
+     * the concurrency limit; therefore, `allowOversubscription` has no effect when all tasks have weight 1.
+     *
+     * Example: Suppose the concurrency limit is 8, and seven tasks are running whose weights are 1, so the current
+     * total weight is 7.  If an available task has weight 2, that would push the total weight to 9, exceeding
+     * the limit.  This task can start only if `allowOversubscription` is true.
+     *
+     * @defaultValue false
+     */
+    allowOversubscription?: boolean;
 }
@@ -170,2 +187,3 @@ /**
      * and the first operation has a weight of 2, then only one more operation can be in progress.
+     * Operations may exceed the concurrency limit based on the `allowOversubscription` option.
      *
@@ -172,0 +190,0 @@ * If `callback` throws a synchronous exception, or if it returns a promise that rejects,

lib/Async.js

@@ -45,3 +45,6 @@ "use strict";
             let promiseHasResolvedOrRejected = false;
+            // iterator that is stored when the loop exits early due to not enough concurrency
+            let nextIterator = undefined;
             async function queueOperationsAsync() {
+                var _a;
                 while (concurrentUnitsInProgress < concurrency &&
@@ -55,3 +58,3 @@ !iteratorIsComplete &&
                     concurrentUnitsInProgress += limitedConcurrency;
-                    const currentIteratorResult = await iterator.next();
+                    const currentIteratorResult = nextIterator !== null && nextIterator !== void 0 ? nextIterator : (await iterator.next());
                     // eslint-disable-next-line require-atomic-updates
@@ -66,4 +69,14 @@ iteratorIsComplete = !!currentIteratorResult.done;
                         //  This should allow other operations to execute.
+                        concurrentUnitsInProgress -= limitedConcurrency;
+                        // Wait until there's enough capacity to run this job, this function will be re-entered as tasks call `onOperationCompletionAsync`
+                        const wouldExceedConcurrency = concurrentUnitsInProgress + weight > concurrency;
+                        const allowOversubscription = (_a = options === null || options === void 0 ? void 0 : options.allowOversubscription) !== null && _a !== void 0 ? _a : false;
+                        if (!allowOversubscription && wouldExceedConcurrency) {
+                            // eslint-disable-next-line require-atomic-updates
+                            nextIterator = currentIteratorResult;
+                            break;
+                        }
+                        // eslint-disable-next-line require-atomic-updates
+                        nextIterator = undefined;
                         concurrentUnitsInProgress += weight;
-                        concurrentUnitsInProgress -= limitedConcurrency;
                         Promise.resolve(callback(currentIteratorValue.element, arrayIndex++))
@@ -70,0 +83,0 @@ .then(async () => {

package.json

 {
   "name": "@rushstack/node-core-library",
-  "version": "5.16.0",
+  "version": "5.17.0",
   "description": "Core libraries that every NodeJS toolchain project should use",
@@ -5,0 +5,0 @@ "main": "lib/index.js",

New alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1252244

0.52%

Lines of code

17815

0.34%

Worsened metrics

Number of low supply chain risk alerts

110

0.92%

No dependency changes