Repository navigation
Fix concurrent limiter accounting and bounded waiting - #103
Merged
Merged
Conversation
jhurliman
marked this pull request as ready for review
September 9, 2026 01:35
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Merged
jhurliman
added a commit
that referenced
this pull request
Sep 9, 2026
Release the merged concurrency and accounting fixes as `limiter@4.0.0`. Use a major version because invalid numeric inputs now reject and waiting requests use FIFO ordering, both observable behavior changes that consumers should opt into. Add a 3.x migration guide to the README, finalize the changelog, and include it in the npm package. Exclude test files and TypeScript build caches from the published archive. No runtime code changes beyond merged PR #103. Validation: lint, all 27 tests, both TypeScript builds, package-content inspection, and CommonJS/ESM smoke checks against the packed package. Publishing follows the merged release commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Concurrent
removeTokens()calls can exceed interval allowances, wait unexpectedly withfireImmediately, or debit a shared parent more than once. Reserve allowance synchronously, recheck after waking, and debit each hierarchy atomically. Waiting calls now use a FIFO queue with one active timer per instance.Validate numeric inputs, detect cyclic parents, retain fractional monotonic time, and cap long platform timers. Handle extreme refill inputs without NaN balances or spurious multi-day waits. Clarify zero-value semantics, local state, synchronous queue bypass, non-rolling intervals, and floating-point limits; fix the byte-throttling example. CI now builds both distributions in addition to linting and testing.
Validation: 27 tests pass, including 10,000 seeded operations against an independent integer reference model, a 1,000-request FIFO backlog, mixed sync/async contention, hierarchy failures, and timer extremes. Lint, TypeScript builds, packed CommonJS/ESM imports, and a TypeScript NodeNext consumer pass locally. An Apple M2 Max / Node 26 microbenchmark measured median synchronous throughput of 13.3M removals/s versus 8.7M on the base commit (five measured rounds of one million calls after warmup); this is a local measurement, not a portable performance guarantee.
Compatibility: invalid numeric input now throws/rejects, async ordering is FIFO per instance, and fractional balances can differ from older whole-millisecond timing. Shared children do not gain global FIFO ordering. Public mutable bucket fields and normal JavaScript floating-point limits remain; this does not introduce distributed or rolling-window guarantees. No npm release is included.
Dependency audit: refreshed the existing semver-compatible development lockfile without adding runtime dependencies or changing declared ranges.
yarn auditnow reports zero advisories, and lint, all 27 tests, and both builds pass with the refreshed toolchain.