fix(embedded-sdk): clear fetchGuestToken timers on unmount #35143 #37280

pachara-strike · 2026-01-20T08:26:08Z

SUMMARY

Fixes memory leak in @superset-ui/embedded-sdk where fetchGuestToken refresh timers continue running after unmount().

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

Create a test application that uses embedDashboard()
Call unmount() after embedding
Verify no setTimeout timers continue running
Check browser dev tools for continued network requests (should be none)

ADDITIONAL INFORMATION

Has associated issue: Fixes Embedded Dashboard continues to call fetchGuestToken after unmount() in Angular applications #34529
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

codeant-ai-for-open-source · 2026-01-20T08:26:14Z

CodeAnt AI is reviewing your PR.

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

bito-code-review · 2026-01-20T08:26:19Z

Code Review Agent Run #31b020

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 0a95a42..0a95a42
- superset-embedded-sdk/src/index.ts
Files skipped - 2
- superset-embedded-sdk/package-lock.json - Reason: Filter setting
- superset-embedded-sdk/package.json - Reason: Filter setting
Tools
- Eslint (Linter) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

superset-embedded-sdk/src/index.ts

codeant-ai-for-open-source · 2026-01-20T08:29:15Z

CodeAnt AI finished reviewing your PR.

netlify · 2026-01-20T08:45:34Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`df6a8a8`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/696f3ede178d5b00086420c5
😎 Deploy Preview	https://deploy-preview-37280--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

bito-code-review · 2026-01-20T09:42:51Z

Code Review Agent Run #c29043

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 0a95a42..df6a8a8
- superset-embedded-sdk/src/index.ts
Files skipped - 2
- superset-embedded-sdk/package-lock.json - Reason: Filter setting
- superset-embedded-sdk/package.json - Reason: Filter setting
Tools
- Eslint (Linter) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

pachara-strike · 2026-01-21T10:08:02Z

Hi @msyavuz , could you help review this PR. It's from this issue #34529

Copilot

Pull request overview

This PR fixes a memory leak in the @superset-ui/embedded-sdk package where guest token refresh timers continued running after calling unmount(). The fix introduces timer tracking and cleanup to ensure proper resource disposal.

Changes:

Added timer ID tracking for the fetchGuestToken refresh mechanism
Implemented timer cleanup in the unmount() function
Bumped package version from 0.3.0 to 0.3.1

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
superset-embedded-sdk/src/index.ts	Added `refreshTokenTimerId` variable to track setTimeout timers and clear them in unmount()
superset-embedded-sdk/package.json	Version bump to 0.3.1
superset-embedded-sdk/package-lock.json	Version bump to 0.3.1 (lockfile update)

Files not reviewed (1)

superset-embedded-sdk/package-lock.json: Language not supported

Copilot · 2026-01-21T18:54:06Z

superset-embedded-sdk/src/index.ts

  async function refreshGuestToken() {
    const newGuestToken = await fetchGuestToken();
    ourPort.emit('guestToken', { guestToken: newGuestToken });
-    setTimeout(refreshGuestToken, getGuestTokenRefreshTiming(newGuestToken));
+    refreshTokenTimerId = setTimeout(refreshGuestToken, getGuestTokenRefreshTiming(newGuestToken));
  }


There's a race condition in the timer cleanup logic. If unmount() is called while refreshGuestToken() is executing (after the timer has fired but before the new timer is set at line 256), the new timer won't be cleared.

To fix this, consider adding a flag to prevent setting new timers after unmount is called, or setting refreshTokenTimerId to null immediately when the timer fires, or clearing it at the start of refreshGuestToken before the async operation.

Copilot · 2026-01-21T18:54:07Z

superset-embedded-sdk/src/index.ts

+    if (refreshTokenTimerId) {
+      clearTimeout(refreshTokenTimerId);
+    }


The new timer cleanup functionality in the unmount method lacks test coverage. Consider adding tests to verify that clearTimeout is called when unmount is invoked, and that no timers continue running after unmount.

codeant-ai-for-open-source · 2026-01-22T10:06:11Z

superset-embedded-sdk/src/index.ts

+    clearTimeout(refreshTokenTimerId);
+    refreshTokenTimerId = 'UNMOUNTED';
+
    mountPoint.replaceChildren();


Suggestion: unmount() clears the refresh timer but does not stop or close the Switchboard/message port, so the message channel and any defined methods/listeners can remain active after unmount, causing memory leaks and continued message handling. Stop the switchboard and close its underlying port (if present) during unmount. [resource leak]

Severity Level: Critical 🚨

- ❌ Message ports/listeners may leak after unmount. - ⚠️ Long-running host pages accumulate memory leaks. - ⚠️ Embedded comms may still receive messages unexpectedly.

Suggested change

mountPoint.replaceChildren();

// Stop the switchboard and close the underlying MessagePort if available to avoid

// leaving listeners/ports open after unmount.

try {

(ourPort as any).stop?.();

} catch (e) {

// ignore stop errors

}

try {

(ourPort as any).port?.close?.();

} catch (e) {

// ignore close errors

}

Steps of Reproduction ✅

1. Call embedDashboard() (superset-embedded-sdk/src/index.ts:118) which eventually calls ourPort.start() at line 266 to begin iframe comms. 2. Interact with the embedded dashboard; ourPort.defineMethod(...) is used (lines 267-279) and communication channel remains active. 3. Call unmount() (lines 282-289). Current unmount clears the refresh timer (lines 285-286) and removes iframe (line 288) but does not call any Switchboard stop/port close methods. 4. Because ourPort.was started at line 266 and no stop/close is invoked on unmount, the underlying MessageChannel/handlers defined by Switchboard can remain active, causing retained listeners/ports and potential memory leaks.

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** superset-embedded-sdk/src/index.ts **Line:** 288:288 **Comment:** *Resource Leak: `unmount()` clears the refresh timer but does not stop or close the Switchboard/message port, so the message channel and any defined methods/listeners can remain active after unmount, causing memory leaks and continued message handling. Stop the switchboard and close its underlying port (if present) during unmount. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

bito-code-review · 2026-01-22T11:04:20Z

Code Review Agent Run #f5eb83

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 28387f5..28387f5
- superset-embedded-sdk/src/index.ts
Files skipped - 2
- superset-embedded-sdk/package-lock.json - Reason: Filter setting
- superset-embedded-sdk/package.json - Reason: Filter setting
Tools
- Eslint (Linter) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

msyavuz · 2026-01-22T15:02:33Z

superset-embedded-sdk/src/index.ts

  ourPort.emit('guestToken', { guestToken });
  log('sent guest token');

+  let refreshTokenTimerId: ReturnType<typeof setTimeout> | 'INITIAL' | 'UNMOUNTED' = 'INITIAL';


This looks a bit off. Do we need this and UNMOUNTED check under refreshGuestToken?

It's to fix race condition problem from this comment #37280 (comment)

It will happen when call unmount function during waiting for new guest token response. So unmount function will clear the old setTimeout and refreshGuestToken will create a new setTimeout.

pull-request-size bot added the size/S label Jan 20, 2026

github-actions bot added embedded dependencies:npm labels Jan 20, 2026

codeant-ai-for-open-source bot reviewed Jan 20, 2026

View reviewed changes

superset-embedded-sdk/src/index.ts Outdated Show resolved Hide resolved

sadpandajoe requested review from Vitor-Avila, alexandrusoare and Copilot January 21, 2026 18:50

Copilot started reviewing on behalf of sadpandajoe January 21, 2026 18:50 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

fix(embbed-sdk): clear renew refresh token on unmount

28387f5

pachara-strike force-pushed the embedded-sdk-clear-refresh-token-timer branch from df6a8a8 to 28387f5 Compare January 22, 2026 10:02

codeant-ai-for-open-source bot reviewed Jan 22, 2026

View reviewed changes

msyavuz reviewed Jan 22, 2026

View reviewed changes

-    mountPoint.replaceChildren();
+    // Stop the switchboard and close the underlying MessagePort if available to avoid
+    // leaving listeners/ports open after unmount.
+    try {
+      (ourPort as any).stop?.();
+    } catch (e) {
+      // ignore stop errors
+    }
+    try {
+      (ourPort as any).port?.close?.();
+    } catch (e) {
+      // ignore close errors
+    }

fix(embedded-sdk): clear fetchGuestToken timers on unmount #35143 #37280

Are you sure you want to change the base?

fix(embedded-sdk): clear fetchGuestToken timers on unmount #35143 #37280

Uh oh!

Conversation

pachara-strike commented Jan 20, 2026 • edited by sadpandajoe Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

codeant-ai-for-open-source bot commented Jan 20, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

bito-code-review bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #31b020

Uh oh!

Uh oh!

codeant-ai-for-open-source bot commented Jan 20, 2026

Uh oh!

netlify bot commented Jan 20, 2026

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

bito-code-review bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #c29043

Uh oh!

pachara-strike commented Jan 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

pachara-strike Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

codeant-ai-for-open-source bot Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

bito-code-review bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #f5eb83

Uh oh!

msyavuz Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

pachara-strike Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pachara-strike commented Jan 20, 2026 •

edited by sadpandajoe

Loading

bito-code-review bot commented Jan 20, 2026 •

edited

Loading

bito-code-review bot commented Jan 20, 2026 •

edited

Loading

bito-code-review bot commented Jan 22, 2026 •

edited

Loading