René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Medium][reactive] Composables create effects/computeds with no disposal path (memory leaks)","articleBody":"## Severity: 🟡 Medium (memory leaks)\n\nSeveral composables create long-lived reactive primitives with **no disposal path**, so they (and the timers/subscriptions they hold) leak whenever they are not created inside an active `effectScope`.\n\n## Locations \u0026 details\n\n### 1. `deferred()` leaks its internal effect\n[`src/concurrency/scheduling.ts:141-161`](../blob/main/src/concurrency/scheduling.ts#L141-L161) — `deferred(source)` creates an `effect(() =\u003e …)` subscribing to `source` and returns only `readonly(mirror)`. There is no returned dispose and no `onScopeDispose` registration. Outside a scope, the effect (plus the scheduled timer/idle callback it manages) stays subscribed to `source` for the source's lifetime.\n\n### 2. `persistedSignal()` persistence effect has no disposer\n[`src/reactive/persisted.ts:63-71`](../blob/main/src/reactive/persisted.ts#L63-L71) — the persistence `effect()` returns no disposer. There is no way to stop persistence; and because `effect()` auto-registers with the ambient `effectScope`, calling `persistedSignal()` inside a scope means `scope.stop()` silently stops persistence while the signal keeps living.\n\n### 3. Unscoped `computed()` retained by a long-lived signal\n[`src/reactive/core.ts:23`](../blob/main/src/reactive/core.ts#L23), [`src/reactive/computed.ts:137-142`](../blob/main/src/reactive/computed.ts#L137-L142) — a `Signal` holds subscribers in a strong `Set`, and `computed()` only auto-disposes when created inside an active `effectScope`. A `computed` created at module/function scope, read once, depending on a long-lived signal, keeps its `markDirty` in the signal's subscriber set forever even after all user references drop.\n\n## Suggested fix\n- `deferred()`: return a `dispose()` (stop the effect + `scheduled.cancel()`), or register cleanup via `onScopeDispose` when a scope is active (mirroring `usePolling`/`suspense`).\n- `persistedSignal()`: isolate the persistence watcher from the ambient scope and/or return a `dispose`.\n- `computed()`: document the must-dispose contract prominently and/or provide auto-cleanup (`FinalizationRegistry`/`WeakRef`-based pruning), or have composables that internally create computeds aggregate their disposal.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:21.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/173/bQuery/issues/173"}