Skip to content

chore(s3-store): replace @shopify/semaphore with async-mutex#829

Open
Emperiusm wants to merge 1 commit into
tus:mainfrom
Emperiusm:chore/replace-shopify-semaphore-with-async-mutex
Open

chore(s3-store): replace @shopify/semaphore with async-mutex#829
Emperiusm wants to merge 1 commit into
tus:mainfrom
Emperiusm:chore/replace-shopify-semaphore-with-async-mutex

Conversation

@Emperiusm
Copy link
Copy Markdown

Why

@shopify/semaphore@3.1.0 was archived by Shopify and surfaces as a Package no longer supported deprecation on every npm install of @tus/s3-store. There is no successor release planned, and downstream projects taking dependency hygiene seriously (e.g. via npm audit / install-log linting) need a path off it.

async-mutex is actively maintained (~17M weekly downloads), MIT-licensed, has zero runtime deps, and exposes a counting Semaphore with an equivalent contract.

What

packages/s3-store/src/index.ts is the only consumer. The diff is small:

-import {Semaphore, type Permit} from '@shopify/semaphore'
+import {Semaphore} from 'async-mutex'

API delta this PR adapts to:

@shopify/semaphore async-mutex
await sem.acquire() returns Permit await sem.acquire() returns [value, releaseFn]
permit.release(): Promise<void> releaseFn(): void (sync)

The previous permit?.release().catch(() => {}) calls were defending against a Promise rejection that async-mutex.release does not have (it's a sync fn that only throws on programmer error — over-release of a permit). The .catch no-ops collapse to direct release() calls.

Verified

  • tsc --build is clean for @tus/s3-store after the change.
  • Local mocha dist/test/*.js: the 12 tests that don't need real AWS credentials pass; the 21 Region is missing integration failures are pre-existing and unaffected.

Notes

  • Found via dependency-deprecation cleanup in a downstream consumer (Second Opinion). Filing both the issue context and the patch since the change is small enough to ship together.
  • No semver-major behavior change in @tus/s3-store's public surface — only the internal concurrency primitive.

🤖 Generated with Claude Code

@shopify/semaphore@3.1.0 was archived/deprecated by Shopify and shows
"Package no longer supported" on every npm install. async-mutex provides
the equivalent counting Semaphore primitive with active maintenance,
similar API surface, and zero runtime deps.

API mapping in src/index.ts:
- `Semaphore` from @shopify/semaphore → `Semaphore` from async-mutex
- `permit = await sem.acquire()` (returns Permit, with `.release(): Promise`)
  → `const [, release] = await sem.acquire()` (returns [value, releaseFn])
- `permit.release().catch(() => {})` (Promise) → `release()` (sync, no Promise)
  The previous `.catch(() => {})` no-ops were defensive against a Permit
  Promise rejection that async-mutex doesn't have — release is a sync
  function that throws only on programmer error, so the swallow becomes a
  direct call.
- The `permit: Permit | undefined` slot becomes `releasePermit: (() => void) | undefined`
  since we no longer hold a Permit object, just its release fn.

Verified: tsc --build is clean for @tus/s3-store; the unit-test subset
(12 tests that don't need real AWS) pass; the 21 S3-integration failures
("Region is missing") are pre-existing and require AWS credentials —
unaffected by this change.
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 7, 2026

⚠️ No Changeset found

Latest commit: dca353d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@Emperiusm Emperiusm requested a deployment to external-testing May 7, 2026 05:48 — with GitHub Actions Waiting
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 7, 2026

Review Change Stack
No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 53fb58bd-8920-4104-ac21-bc720e677224

📥 Commits

Reviewing files that changed from the base of the PR and between 57b1be9 and dca353d.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (2)
  • packages/s3-store/package.json
  • packages/s3-store/src/index.ts

Walkthrough

The S3 store's multipart upload concurrency control is refactored to replace @shopify/semaphore with async-mutex. The dependency is updated, the import is switched, and the uploadParts method is adapted to use the new library's callback-based release API instead of permit objects.

Changes

Semaphore library replacement

Layer / File(s) Summary
Dependency & Import Migration
packages/s3-store/package.json, packages/s3-store/src/index.ts
Dependency declaration replaced with async-mutex and import statement updated to use the new library instead of @shopify/semaphore.
Semaphore API Implementation
packages/s3-store/src/index.ts
uploadParts method refactored to track and invoke a releasePermit callback instead of storing and calling .release() on a Permit object; cleanup and error handlers adapted to use optional chaining with the release function.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

  • tus/tus-node-server#728: Modifies packages/s3-store multipart upload permit release logic; directly related refactoring of semaphore/concurrency handling.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main change: replacing @shopify/semaphore with async-mutex in the s3-store package.
Description check ✅ Passed The description provides clear rationale (archived dependency), implementation details, API differences, and verification steps directly related to the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedasync-mutex@​0.5.010010010080100

View full report

@Murderlon
Copy link
Copy Markdown
Collaborator

Perhaps we should just copy the class from @shopify/semaphore, it's been working well for us, it's not a moving target the datastructure isn't going to change, and then we own it and reduce dependency problems and security.

Can you update?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants