fix(secure-fetch): remove abort listener when request settles

The abort listener was registered with `{ once: true }`, which only auto-
removes on signal fire — never on success/timeout/error. Webhook drains
reuse the same Trigger.dev signal across thousands of chunks/retries, so
listeners (each retaining a closed http.ClientRequest) accumulated for the
job's lifetime. Wrap resolve/reject in a settle helper that also calls
removeEventListener.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.server.ts

@@ -311,7 +311,7 @@ export async function secureFetchWithPinnedIP(
         validateUrlWithDNS(redirectUrl, 'redirectUrl', { allowHttp: options.allowHttp })
           .then((validation) => {
             if (!validation.isValid) {
-              reject(new Error(`Redirect blocked: ${validation.error}`))
+              settledReject(new Error(`Redirect blocked: ${validation.error}`))
               return
             }
             return secureFetchWithPinnedIP(
@@ -322,15 +322,15 @@ export async function secureFetchWithPinnedIP(
             )
           })
           .then((response) => {
-            if (response) resolve(response)
+            if (response) settledResolve(response)
           })
-          .catch(reject)
+          .catch(settledReject)
         return
       }
 
       if (isRedirectStatus(statusCode) && location && redirectCount >= maxRedirects) {
         res.resume()
-        reject(new Error(`Too many redirects (max: ${maxRedirects})`))
+        settledReject(new Error(`Too many redirects (max: ${maxRedirects})`))
         return
       }
 
@@ -356,7 +356,7 @@ export async function secureFetchWithPinnedIP(
       })
 
       res.on('error', (error) => {
-        reject(error)
+        settledReject(error)
       })
 
       res.on('end', () => {
@@ -372,7 +372,7 @@ export async function secureFetchWithPinnedIP(
           }
         }
 
-        resolve({
+        settledResolve({
           ok: statusCode >= 200 && statusCode < 300,
           status: statusCode,
           statusText: res.statusMessage || '',
@@ -388,13 +388,29 @@ export async function secureFetchWithPinnedIP(
       })
     })
 
+    let onAbort: (() => void) | null = null
+    const cleanupAbort = () => {
+      if (onAbort && options.signal) {
+        options.signal.removeEventListener('abort', onAbort)
+        onAbort = null
+      }
+    }
+    const settledResolve: typeof resolve = (value) => {
+      cleanupAbort()
+      resolve(value)
+    }
+    const settledReject: typeof reject = (reason) => {
+      cleanupAbort()
+      reject(reason)
+    }
+
     req.on('error', (error) => {
-      reject(error)
+      settledReject(error)
     })
 
     req.on('timeout', () => {
       req.destroy()
-      reject(new Error(`Request timed out after ${requestOptions.timeout}ms`))
+      settledReject(new Error(`Request timed out after ${requestOptions.timeout}ms`))
     })
 
     if (options.signal) {
@@ -403,9 +419,9 @@ export async function secureFetchWithPinnedIP(
         reject(options.signal.reason ?? new Error('Aborted'))
         return
       }
-      const onAbort = () => {
+      onAbort = () => {
         req.destroy()
-        reject(options.signal?.reason ?? new Error('Aborted'))
+        settledReject(options.signal?.reason ?? new Error('Aborted'))
       }
       options.signal.addEventListener('abort', onAbort, { once: true })
     }