moduleapi: Use multitable add/remove instead of set multitable:set() does not clear intermediate keys when setting the last one to nil. This meant that the event_handlers multitable for every module was not properly cleaning up the object and event name from the table when calling :unhook_object_event(). This combined badly with e.g. mod_bookmarks, which uses this extensively to add/remove hooks dynamically for mod_pep services. The multitable kept a reference to every mod_pep service object ever created, causing a memory leak. The multitable:remove() function clears intermediate keys when they are empty, so we've switched to using that now.

--- a/core/moduleapi.lua	Thu Apr 16 19:00:22 2026 +0100
+++ b/core/moduleapi.lua	Fri Apr 17 17:39:06 2026 +0100
@@ -81,12 +81,12 @@
 end
 
 function api:hook_object_event(object, event, handler, priority)
-	self.event_handlers:set(object, event, handler, true);
+	self.event_handlers:add(object, event, handler, true);
 	return object.add_handler(event, handler, priority);
 end
 
 function api:unhook_object_event(object, event, handler)
-	self.event_handlers:set(object, event, handler, nil);
+	self.event_handlers:remove(object, event, handler);
 	return object.remove_handler(event, handler);
 end