Fix memory leak in background token refresh

- Replace `AbortSignal.any()` with `linkSignals()` to properly clean up
  event listeners
- Pass `signal` from retry callback into `#client.login()` for proper
  RPC cancellation
- Update `@ydbjs/retry` dependency to ^6.2.0 for signal-handling fixes
- Add `@ydbjs/abortable` ^6.1.0 dependency

Signed-off-by: Vladislav Polyakov <polRk@ydb.tech>

Author: polRk

.changeset/pcrhshgrdb.md

@@ -0,0 +1,12 @@
+---
+'@ydbjs/auth': minor
+---
+
+Fix memory leak in background token refresh caused by `AbortSignal.any()`
+
+`AbortSignal.any()` registers event listeners on source signals but never removes them, causing a listener leak each time background token refresh is started. Replace it with `linkSignals` from `@ydbjs/abortable@^6.1.0`, which uses `Symbol.dispose` to clean up listeners when the refresh loop exits.
+
+Additional fixes:
+
+- Pass `signal` from the retry callback into `#client.login()` so the login RPC is properly cancelled on abort instead of running unchecked
+- Update `@ydbjs/retry` dependency to `^6.2.0` to pick up the same signal-handling fixes in the retry loop

packages/auth/package.json

@@ -55,9 +55,10 @@
 		"@bufbuild/protobuf": "2.10.1",
 		"@grpc/grpc-js": "^1.14.0",
 		"@ydbjs/api": "^6.0.0",
+		"@ydbjs/abortable": "^6.1.0",
 		"@ydbjs/debug": "^6.0.0",
 		"@ydbjs/error": "^6.0.0",
-		"@ydbjs/retry": "^6.0.0",
+		"@ydbjs/retry": "^6.2.0",
 		"nice-grpc": "^2.1.13"
 	},
 	"engines": {

packages/auth/src/static.ts

@@ -10,6 +10,7 @@ import { defaultRetryConfig, retry } from '@ydbjs/retry'
 import { type Client, ClientError, Status, createChannel, createClient } from 'nice-grpc'
 
 import { CredentialsProvider } from './index.js'
+import { linkSignals } from '@ydbjs/abortable'
 
 let debug = loggers.auth.extend('static')
 
@@ -79,6 +80,7 @@ export class StaticCredentialsProvider extends CredentialsProvider {
 		let channelCredentials = secureOptions
 			? credentials.createFromSecureContext(tls.createSecureContext(secureOptions))
 			: credentials.createInsecure()
+
 		this.#client = createClient(
 			AuthServiceDefinition,
 			createChannel(address, channelCredentials, channelOptions)
@@ -148,13 +150,9 @@ export class StaticCredentialsProvider extends CredentialsProvider {
 		}
 
 		debug.log('starting background token refresh')
-		// Combine user signal with timeout signal
-		let combinedSignal = AbortSignal.any([
-			signal,
-			AbortSignal.timeout(BACKGROUND_REFRESH_TIMEOUT_MS),
-		])
+		using linkedSignal = linkSignals(signal, AbortSignal.timeout(BACKGROUND_REFRESH_TIMEOUT_MS))
 
-		void this.#refreshToken(combinedSignal)
+		void this.#refreshToken(linkedSignal.signal)
 	}
 
 	/**
@@ -172,7 +170,7 @@ export class StaticCredentialsProvider extends CredentialsProvider {
 					debug.log('retry attempt #%d after error: %s', ctx.attempt, ctx.error)
 				},
 			},
-			async () => {
+			async (signal) => {
 				debug.log('attempting login with user: %s', this.#username)
 
 				let response = await this.#client.login(