dalli 4.3.10 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41490f01a85678506bed8f5e234cbbea7dadee8d5369f8c9800206a63a82260c
-  data.tar.gz: 5176f61b9332988912f0216f516caedcfe0fb8a86f0eeea4d129e52ec7a6f183
+  metadata.gz: 16d7d5950137f4a51ae41392eaa576732595ac4020ae7be972d6fb4b33b9861d
+  data.tar.gz: ebb799522259a9a32a86e1dbfd13e810427f787f8110415509288655a5a5460b
 SHA512:
-  metadata.gz: abccb3715898dcb8c1f6f3581f807253c91cf0190a2ff7ec44c70aea73d4312e5f39faebce3f510b47686cce02c8545806397cb8fb574801b36a6077a06582a2
-  data.tar.gz: 468fa248795f1e7c4905bf47c365e0807428ca2b05e5499d4686ea94b506584d818c5bd03b09d822182def1b3cb76ac97feab8977b8a906d5362d891f7120185
+  metadata.gz: 74e32eace9001bd50be0617f10234f1440f86e506facc7247cf6041cf81fa85e966a5721e2a7ff364eb89da19bd46cc92b2631d99d4cbb21aee8240a475a76b5
+  data.tar.gz: 8e2bc294a1fa08a04f0bdfa300394751e63a7c1a21cac6aa1080a37e9491fe33091150047f664607ae42596d0bb2ac60f05c06ad97aee83165de754b9cceeed2

data/CHANGELOG.md

@@ -1,178 +1,34 @@
 Dalli Changelog
 =====================
 
-Unreleased
+5.0.0
 ==========
 
-4.3.10
-==========
-
-Bug fixes:
-
-- `set_multi` across more than one server stored `nil` for a Symbol key or a key over 250 bytes, in place of the value given
-
-4.3.9
-==========
-
-Security:
-
-- Keep a connection shared by several threads or fibers in step during a `quiet` block (GHSA-5xvx-r8rg-5qm2)
-  - A `quiet` (or `multi`) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an `add` of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
-- Don't let a `get_multi` that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
-  - A pipelined `get_multi` stopped by a non-network exception (its block raising or breaking, `Timeout.timeout`, or a value that can't be deserialized) left its unread replies in the response buffer, and a later `get_multi` large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
-  - Affects every supported line (the `get_multi` issue, 4.3 and later), with both protocols; with the binary protocol the connection stayed out of step after the block ended. Fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15
-
-Bug fixes:
-
-- A per-request `raw: true` write no longer compresses the value (backport of #1213)
-  - Values at or above the compression threshold (4 KB by default) were compressed and flagged even with `raw: true`. Raw reads ignore flags, so reading them back with `raw: true` returned the compressed bytes
-  - Raw values are now stored exactly as given. Callers that pass `raw: true` without `compress: false` store large values uncompressed; Rails' `MemCacheStore` passes `compress: false` and isn't affected
-- Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (backport of #1215)
-  - A failed or timed-out handshake left the TCP socket open until GC and raised `OpenSSL::SSL::SSLError` directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and `socket_max_failures` handling, raising `Dalli::NetworkError` (or `Dalli::RingError` once no server is available)
-  - Certificate and hostname checks come only from the `ssl_context` you pass, and a bare `OpenSSL::SSL::SSLContext.new` checks neither. Dalli now logs a warning once per process when `verify_mode` doesn't include `VERIFY_PEER` or `verify_hostname` is false; see the new TLS section in the README
-- A reply line longer than 8 KiB without a CRLF, or one cut short by the connection closing, is now a network error that closes the connection. Before, the line had no length limit (backport of #1216)
-- One value that can't be stored no longer discards other buffered writes (backport of #1218)
-  - A value that raised `Dalli::MarshalError` or `Dalli::ValueOverMaxSize` closed the connection, which dropped writes still buffered from the same `quiet` block or `set_multi`, and `set_multi` did this without raising
-  - `set_multi` now stores every other key, skips the bad one, and then raises
-
-4.3.8
-==========
-
-Security:
-
-- Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
-  - memcached stores an item made by auto-create (`ma` with `N`/`J`, or `mg` with `N`) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
-  - `incr` and `decr` with an initial value now create such counters with an add instead. Return values are unchanged
-  - The new `verify_reply_keys` option makes `get_multi` and `get_multi_cas` ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
-  - Affects `protocol: :meta` since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes
-
-4.3.7
-==========
-
-Security:
-
-- Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)
-  - With a `namespace`, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key
-  - Affects `get_with_metadata` and `fetch_with_lock` since 4.1.0 (single-key operations on 4.x aren't affected); fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected
-- Complete the fix for per-request `raw: true` on reads (GHSA-wr87-m4jw-29x5)
-  - `cas` and `cas!` (both protocols) and `fetch_with_lock` (meta protocol) accepted `raw: true` but didn't pass it to the read, so the value was still deserialized. They now honor it
-  - A read made with `raw: true` doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Meta protocol raw reads now ignore flags in the reply
-  - Affects 4.3.6 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13
-- Complete the fork-safety fix (GHSA-w39f-xq2m-4g8x)
-  - Fork detection used a pid cache refreshed by a `Process._fork` hook. When another library's fork hook ran first in the child (connection_pool, loaded before Dalli as in Rails, closes its connections there), Dalli didn't know it was in a forked child and ended the parent's TLS session. It now checks `Process.pid`
-  - 4.3.6's write buffer kept a reference to the caller's value string with the meta protocol, so changing the string before the buffer was sent (for example, reusing one buffer inside a `quiet` block) changed the bytes sent, losing values or adding commands. The buffer now holds a copy
-  - Fixed in 4.3.7 and 3.2.13
-
-Bug fixes:
-
-- `get_with_metadata` and `fetch_with_lock` retried the final error raised when a server is marked down, so with `down_retry_delay: 0` they retried an unresponsive server forever. They now retry only retryable errors, like other operations
-- Fix a regression in 4.3.6: a `get_multi` that didn't finish within `socket_timeout` counted toward `socket_max_failures`, so two slow `get_multi` calls in a row marked a healthy server down. It now just closes the connection
-- Fix a regression in 4.3.6: over TLS, every request buffered in a `quiet` block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again
-- Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no `s` flag could leave the connection out of step or raise a non-Dalli error
-- With `decompressed_max_bytes` in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit
-- With a `digest_class` whose digests aren't short hex strings, shortening a long key could loop forever. It now raises `ArgumentError`
-
-Development:
-
-- Run the Tests, RuboCop and Profiles workflows on pushes to `main` and the `*-stable` branches only, so a pull request's branch isn't tested twice (backport of #1198)
-
-4.3.6
-==========
-
-Security:
+**Breaking Changes:**
 
-- Fix pipelined `get_multi` returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)
-  - The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (`CLIENT_ERROR`, `SERVER_ERROR`, or `EN` from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a `get` could return another key's value
-  - Keys are now measured in bytes as sent (after base64 encoding when the meta protocol needs it). A key under 250 characters but over 250 bytes, for example one with many non-ASCII characters, passed validation:
-    - with the meta protocol, memcached rejected it with the error reply above
-    - with the binary protocol, memcached dropped the connection, and `get` or `get_multi` with that key retried forever
-  - Such keys are now truncated like other long keys; keys that worked before are unchanged
-  - The reply parser affects `protocol: :meta` since 3.2.0; the key length affects both protocols; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
-- Stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)
-  - A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after `socket_max_failures` attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after `down_retry_delay`
-  - Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
-- Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)
-  - Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's `compress` or `serializer` settings. The new `decompressed_max_bytes` option (default 128 MiB; `nil` disables it) makes a read that would pass it raise `Dalli::UnmarshalError`. Custom compressors whose `decompress` takes only the data keep working, without the limit
-  - The value size in a reply (a meta `VA` size or a binary body length) was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise `Dalli::DalliError` before reading
-  - Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
-- Honor per-request `raw: true` on reads, and add `Dalli::JSONSerializer` (GHSA-wr87-m4jw-29x5)
-  - With the binary protocol, `get`, `gat` and `fetch`, and with the meta protocol, `get_with_metadata`, ignored a per-request `raw: true` and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have `Marshal.load` run on data someone else wrote to memcached. They now return the stored bytes
-  - The `raw` part affects binary `get` and `gat` in all versions, and `get_with_metadata` since 4.2.0
-  - `serializer: JSON` reads values with `JSON.load`, which on json gem versions before 3.0 creates an object of the class named in a stored `json_class` key when the json additions are loaded. The new `Dalli::JSONSerializer` reads with `JSON.parse` and only returns plain JSON types. The README and the Marshal security warning now recommend it; `serializer: JSON` itself is unchanged
-  - The `serializer: JSON` part affects any version used with the json gem before 3.0
-- Keep a forked child from writing to or closing the parent's connection (GHSA-w39f-xq2m-4g8x)
-  - A child forked while the parent had requests buffered but not yet sent, such as quiet writes inside a `quiet` block, sent them again when it closed the client or reconnected: quiet writes ran twice, and the parent's later replies could be read as the replies to other requests, returning one key's value for another. Dalli now buffers requests itself and a forked child discards them
-  - Affects 4.2.0 and later; fixed in 5.2.1, 5.1.3, 5.0.9 and 4.3.6
-  - With TLS, a forked child that closed the client (or reconnected after detecting the fork) sent a TLS close on the connection the parent was still using, ending the parent's session. A forked child now closes only its own copy of the socket
-  - Affects all versions with TLS; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
+- **Removed binary protocol** - The meta protocol is now the only supported protocol
+  - The `:protocol` option is no longer used
+  - Requires memcached 1.6+ (for meta protocol support)
+  - Users on older memcached versions must upgrade or stay on Dalli 4.x
 
-Bug fixes:
+- **Removed SASL authentication** - The meta protocol does not support authentication
+  - Use network-level security (firewall rules, VPN) or memcached's TLS support instead
+  - Users requiring SASL authentication must stay on Dalli 4.x with binary protocol
 
-- An exception raised by a `get_multi` block (such as `Timeout::Error`) was treated as a network failure: swallowed, with the whole `get_multi` retried and keys yielded twice. It now reaches the caller
-- Fix `set_multi` with the binary protocol
-  - Each quiet `setq` waited for a reply memcached never sends for a successful write, so `set_multi` timed out on its first key without storing anything (and, with retries, hung or marked the server down). Affects 4.2.0 and later
-
-Notes:
-
-- Document [Ruby bug 21195](https://bugs.ruby-lang.org/issues/21195), a VM crash (`[BUG] rb_sys_fail_path_in(io_fillbuf, ...) - errno == 0`) when a socket read using `IO#timeout` is interrupted by a signal, in the README (#1188)
-  - Affects Ruby 3.2.x, 3.3.0–3.3.7 and 3.4.0–3.4.2. Fixed in 3.3.8 and 3.4.3; Ruby 3.2 reached end of life without the fix
-  - Ruby 3.1 doesn't use `IO#timeout` and isn't affected
-
-Development:
-
-- Drop Ruby 3.2 from the CI matrix, since that bug intermittently crashed its test runs (#1188)
-- Fix three flaky tests: the `KeyManager` namespace key-length test, the Rack session freshness test, and `MemcachedManager`'s start and stop handling (backport of #1141, #1182)
-- Fix flaky failover tests: move their ports out of Linux's ephemeral port range, and wait for memcached to accept connections after starting it (backport of #1184)
-
-4.3.5
-==========
-
-Bug fixes:
-
-- Fix multi-server `get_multi` stopping at an empty value (#1170)
-  - The pipelined reply parser took a hit on a zero-length value (`VA 0`) for the terminating `MN`, so that server's remaining keys were silently missing from the result
-  - Its value terminator and any replies not yet parsed stayed on the connection and were read as the replies to later commands on it. Those commands could fail with `Dalli::DalliError: Response error`, or a single-key `get` could silently return another key's value
-  - An empty value is now returned as `''`, like a single-key `get` and single-server `get_multi`
-  - Affects only clients using `protocol: :meta`; the default binary protocol is not affected
-  - Thanks to Julian Richard Contreras for this contribution
-
-Development:
-
-- Fix offenses reported by RuboCop 1.91 and require `rubocop >= 1.91` (backport of #1162)
-
-4.3.4
-==========
-
-Security:
-
-- Fix memcached command injection through numeric arguments with the meta protocol (GHSA-6wmv-xq9m-fmp7)
-  - With `protocol: :meta`, the `default` argument of `incr`/`decr`, and `fetch_with_lock`'s `lock_ttl` and `recache_threshold`, were written into the command without conversion, so a String containing CRLF injected additional memcached commands (e.g. `set`, `flush_all`) on the connection. The default binary protocol is not affected
-  - These arguments must now be Integers, or Strings of decimal digits; anything else raises `ArgumentError` before a request is sent
-  - As defense in depth, the meta `RequestFormatter` now converts every numeric flag it writes (`D`, `J`, `N`, `R`, `T`) to an Integer
-  - Thanks to oss-security-shop for the report
-
-4.3.3
-==========
+- **Ruby 3.3+ required** - Dropped support for Ruby 3.1 and 3.2
+  - Ruby 3.2 reached end-of-life in March 2026
+  - JRuby remains supported
 
 Performance:
 
-- Reduce object allocations in pipelined get response processing (#1072)
-  - Offset-based `ResponseBuffer`: track a read offset instead of slicing a new string after every parsed response; compact only when the consumed portion exceeds 4KB and more than half the buffer
-  - Inline response processor parsing: avoid intermediate array allocations from `split`-based header parsing in both binary and meta protocols
-  - Block-based `pipeline_next_responses`: yield `(key, value, cas)` directly when a block is given, avoiding per-call Hash allocation
-  - `PipelinedGetter`: replace Hash-based socket-to-server mapping with linear scan (faster for typical 1-5 server counts); use `Process.clock_gettime(CLOCK_MONOTONIC)` instead of `Time.now`
-- Add cross-version benchmark script (`bin/compare_versions`) for reproducible performance comparisons across Dalli versions
-
-Bug Fixes:
-
-- Skip OTel integration tests when meta protocol is unavailable (#1072)
-
-4.3.2
-==========
+- **~7% read performance improvement** (CRuby only)
+  - Use native `IO#read` instead of custom `readfull` implementation
+  - Enabled by Ruby 3.3's `IO#timeout=` support
+  - JRuby continues to use `readfull` for compatibility
 
 OpenTelemetry:
 
-- Migrate to stable OTel semantic conventions
+- Migrate to stable OTel semantic conventions (#1070)
   - `db.system` renamed to `db.system.name`
   - `db.operation` renamed to `db.operation.name`
   - `server.address` now contains hostname only; `server.port` is a separate integer attribute
@@ -182,6 +38,12 @@ OpenTelemetry:
 - Add `peer.service` span attribute
   - `:otel_peer_service` option for logical service naming
 
+Internal:
+
+- Simplified protocol directory structure: moved `lib/dalli/protocol/meta/*` to `lib/dalli/protocol/`
+- Removed deprecated binary protocol files and SASL authentication code
+- Removed `require 'set'` (autoloaded in Ruby 3.3+)
+
 4.3.1
 ==========
 

data/Gemfile

@@ -18,7 +18,7 @@ group :development, :test do
   gem 'rack', '~> 3'
   gem 'rack-session'
   gem 'rake', '~> 13.0'
-  gem 'rubocop', '>= 1.91' # disable-next directives require 1.91+
+  gem 'rubocop'
   gem 'rubocop-minitest'
   gem 'rubocop-performance'
   gem 'rubocop-rake'

data/README.md

@@ -10,38 +10,14 @@ Dalli supports:
 * Fine-grained control of data serialization and compression
 * Thread-safe operation (either through use of a connection pool, or by using the Dalli client in threadsafe mode)
 * SSL/TLS connections to memcached
-* SASL authentication
 * OpenTelemetry distributed tracing (automatic when SDK is present)
 
 The name is a variant of Salvador Dali for his famous painting [The Persistence of Memory](http://en.wikipedia.org/wiki/The_Persistence_of_Memory).
 
 ## Requirements
 
-* Ruby 3.1 or later
-* memcached 1.4 or later (1.6+ recommended for meta protocol support)
-
-### Known Ruby issue: crash on an interrupted socket read
-
-On Ruby 3.2 and later, Dalli sets socket timeouts with `IO#timeout`. Ruby 3.2.x, 3.3.0–3.3.7 and 3.4.0–3.4.2 have a bug ([Ruby #21195](https://bugs.ruby-lang.org/issues/21195)) where a timed read interrupted by a signal aborts the whole process:
-
-```
-[BUG] rb_sys_fail_path_in(io_fillbuf, fd:N ) - errno == 0
-```
-
-The crash is inside Ruby itself, so it can't be rescued. It was fixed in Ruby 3.3.8 and 3.4.3. Ruby 3.2 reached end of life without the fix. If you see this crash, upgrade to Ruby 3.3.8+ or 3.4.3+. Ruby 3.1 doesn't use `IO#timeout` and isn't affected.
-
-Ruby 3.2 is no longer part of this branch's CI matrix for the same reason.
-
-## Protocol Options
-
-Dalli supports two protocols for communicating with memcached:
-
-* `:binary` (default) - Works with all memcached versions, supports SASL authentication
-* `:meta` - Requires memcached 1.6+, better performance for some operations, no authentication support
-
-```ruby
-Dalli::Client.new('localhost:11211', protocol: :meta)
-```
+* Ruby 3.3 or later (JRuby also supported)
+* memcached 1.6 or later
 
 ## Configuration Options
 
@@ -73,37 +49,10 @@ The separator must be a single non-alphanumeric character. Valid examples: `:`,
 By default, Dalli uses Ruby's Marshal for serialization. Deserializing untrusted data with Marshal can lead to remote code execution. If you cache user-controlled data, consider using a safer serializer:
 
 ```ruby
-Dalli::Client.new('localhost:11211', serializer: Dalli::JSONSerializer)
-```
-
-`Dalli::JSONSerializer` reads values with `JSON.parse`, so it only ever returns plain hashes, arrays, strings, numbers, booleans and `nil`. Passing the `JSON` module itself (`serializer: JSON`) reads values with `JSON.load`, which can create objects of other classes from a stored `json_class` key and is not recommended for data an attacker might write.
-
-Per-request `raw: true` returns the stored bytes without deserializing or decompressing them, on every read method that accepts it (`get`, `get_with_metadata` and `fetch`).
-
-See the [4.0-Upgrade.md](4.0-Upgrade.md) guide for more information.
-
-### Counters and verify_reply_keys
-
-memcached names an item made by auto-create for a base64-encoded key (one with whitespace, control or non-ASCII characters) by its raw key bytes in later replies (with `protocol: :meta`). Since 4.3.8, Dalli creates counters for such keys with an add rather than auto-create. Items created before then, or by other clients, can still be named that way until memcached releases a fix (1.6.45 and earlier behave this way). If keys passed to `incr` or `decr` with an initial value can contain untrusted input, set `verify_reply_keys: true` until then: multi-gets then ignore replies for keys they didn't request, at a cost of about 15% per multi-get.
-
-## TLS
-
-Pass an `OpenSSL::SSL::SSLContext` as `ssl_context:` to connect over TLS. Certificate and hostname verification come only from that context: Dalli adds no checks of its own. A bare `OpenSSL::SSL::SSLContext.new` verifies nothing, so it accepts any certificate from any server. Configure the context to verify both:
-
-```ruby
-ssl_context = OpenSSL::SSL::SSLContext.new
-ssl_context.set_params(
-  verify_mode: OpenSSL::SSL::VERIFY_PEER,
-  verify_hostname: true,
-  ca_file: '/path/to/ca.crt' # omit to use the system's trusted certificates
-)
-
-Dalli::Client.new('memcached.example.com:11211', ssl_context: ssl_context)
+Dalli::Client.new('localhost:11211', serializer: JSON)
 ```
 
-Dalli logs a warning once per process when the context's `verify_mode` is `VERIFY_NONE`, or when it is `VERIFY_PEER` but `verify_hostname` is false.
-
-A failed TLS handshake counts as a failed connection attempt, like a refused connection: once `socket_max_failures` attempts have failed, the server is marked down and requests fail over to the other servers.
+See the [5.0-Upgrade.md](5.0-Upgrade.md) guide for upgrade information.
 
 ## OpenTelemetry Tracing
 

data/lib/dalli/client.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 require 'digest/md5'
-require 'set'
 
+# encoding: ascii
 module Dalli
   ##
   # Dalli::Client is the main class which developers will use to interact with
@@ -42,30 +42,22 @@ module Dalli
     #                 #fetch operations.
     # - :raw        - If set, disables serialization and compression entirely at the client level.
     #                 Only String values are supported. This is useful when the caller handles its own
-    #                 serialization (e.g., Rails' ActiveSupport::Cache). The per-request :raw option
-    #                 (e.g. set(key, value, ttl, raw: true)) does the same for a single call: String
-    #                 values are stored as-is, uncompressed, and non-String values raise
-    #                 Dalli::MarshalError.
+    #                 serialization (e.g., Rails' ActiveSupport::Cache). Note: this is different from
+    #                 the per-request :raw option which converts values to strings but still uses the
+    #                 serialization pipeline.
     # - :digest_class - defaults to Digest::MD5, allows you to pass in an object that responds to the hexdigest method,
     #                   useful for injecting a FIPS compliant hash object.
-    # - :protocol - one of either :binary or :meta, defaulting to :binary.  This sets the protocol that Dalli uses
-    #               to communicate with memcached.
     # - :otel_db_statement - controls the +db.query.text+ span attribute when OpenTelemetry is loaded.
     #                        +:include+ logs the full operation and key(s), +:obfuscate+ replaces keys with "?",
     #                        +nil+ (default) omits the attribute entirely.
     # - :otel_peer_service - when set, adds a +peer.service+ span attribute with this value for logical service naming.
-    # - :verify_reply_keys - defaults to false. When true, get_multi and get_multi_cas only accept replies for the keys
-    #                        they requested; after a reply naming another key, the rest of that server's replies are
-    #                        treated as misses. With the meta protocol, memcached can name an item by its raw key bytes
-    #                        when the item was created by auto-create from a base64-encoded key, which Dalli no longer
-    #                        does. Costs a multi-get about 15%.
     #
     def initialize(servers = nil, options = {})
       @normalized_servers = ::Dalli::ServersArgNormalizer.normalize_servers(servers)
       @options = normalize_options(options)
+      warn_removed_options(@options)
       @key_manager = ::Dalli::KeyManager.new(@options)
       @ring = nil
-      emit_deprecation_warnings
     end
 
     #
@@ -107,10 +99,7 @@ module Dalli
     end
 
     ##
-    # Get value with extended metadata using the meta protocol.
-    #
-    # IMPORTANT: This method requires memcached 1.6+ and the meta protocol (protocol: :meta).
-    # It will raise an error if used with the binary protocol.
+    # Get value with extended metadata.
     #
     # @param key [String] the cache key
     # @param options [Hash] options controlling what metadata to return
@@ -138,20 +127,14 @@ module Dalli
     #   # => { value: "data", cas: 123, hit_before: true, last_access: 42 }
     #
     def get_with_metadata(key, options = {})
-      raise_unless_meta_protocol!
-
-      # A retry re-runs this method with its original arguments, so `key` must
-      # stay as the caller gave it; reassigning it would add the namespace again.
-      validated_key = @key_manager.validate_key(key.to_s)
+      key = key.to_s
+      key = @key_manager.validate_key(key)
 
-      server = ring.server_for_key(validated_key)
-      Instrumentation.trace('get_with_metadata', trace_attrs('get_with_metadata', validated_key, server)) do
-        server.request(:meta_get, validated_key, options)
+      server = ring.server_for_key(key)
+      Instrumentation.trace('get_with_metadata', trace_attrs('get_with_metadata', key, server)) do
+        server.request(:meta_get, key, options)
       end
-    # Only a retryable error is retried. The NetworkError raised when a server
-    # is marked down is final, as in #perform; retrying it looped forever once
-    # down_retry_delay let the same server be tried again.
-    rescue RetryableNetworkError => e
+    rescue NetworkError => e
       Dalli.logger.debug { e.inspect }
       Dalli.logger.debug { 'retrying get_with_metadata with new server' }
       retry
@@ -161,7 +144,7 @@ module Dalli
     # Fetch multiple keys efficiently.
     # If a block is given, yields key/value pairs one at a time.
     # Otherwise returns a hash of { 'key' => 'value', 'key2' => 'value1' }
-    # rubocop:disable-next Style/ExplicitBlockArgument
+    # rubocop:disable Style/ExplicitBlockArgument
     def get_multi(*keys)
       keys.flatten!
       keys.compact!
@@ -173,6 +156,7 @@ module Dalli
         get_multi_hash(keys)
       end
     end
+    # rubocop:enable Style/ExplicitBlockArgument
 
     ##
     # Fetch multiple keys efficiently, including available metadata such as CAS.
@@ -216,9 +200,6 @@ module Dalli
     # cache entry (the "thundering herd" problem). Only one client wins the right to
     # regenerate; other clients receive the stale value (if available) or wait.
     #
-    # IMPORTANT: This method requires memcached 1.6+ and the meta protocol (protocol: :meta).
-    # It will raise an error if used with the binary protocol.
-    #
     # @param key [String] the cache key
     # @param ttl [Integer] time-to-live for the cached value in seconds
     # @param lock_ttl [Integer] how long the lock/stub lives (default: 30 seconds)
@@ -244,21 +225,14 @@ module Dalli
     def fetch_with_lock(key, ttl: nil, lock_ttl: 30, recache_threshold: nil, req_options: nil, &block)
       raise ArgumentError, 'Block is required for fetch_with_lock' unless block_given?
 
-      raise_unless_meta_protocol!
-      validate_integer!(:lock_ttl, lock_ttl)
-      validate_integer!(:recache_threshold, recache_threshold)
-
-      # Left unchanged for the retry below; see get_with_metadata
-      validated_key = @key_manager.validate_key(key.to_s)
+      key = key.to_s
+      key = @key_manager.validate_key(key)
 
-      server = ring.server_for_key(validated_key)
-      Instrumentation.trace('fetch_with_lock', trace_attrs('fetch_with_lock', validated_key, server)) do
-        fetch_with_lock_request(validated_key, ttl, lock_ttl, recache_threshold, req_options, &block)
+      server = ring.server_for_key(key)
+      Instrumentation.trace('fetch_with_lock', trace_attrs('fetch_with_lock', key, server)) do
+        fetch_with_lock_request(key, ttl, lock_ttl, recache_threshold, req_options, &block)
       end
-    # Only a retryable error is retried. The NetworkError raised when a server
-    # is marked down is final, as in #perform; retrying it looped forever once
-    # down_retry_delay let the same server be tried again.
-    rescue RetryableNetworkError => e
+    rescue NetworkError => e
       Dalli.logger.debug { e.inspect }
       Dalli.logger.debug { 'retrying fetch_with_lock with new server' }
       retry
@@ -307,11 +281,6 @@ module Dalli
     # Any error replies will be discarded at the end of the block, and
     # Dalli client methods invoked inside the block will not
     # have return values
-    #
-    # The block is quiet only for the thread or fiber that runs it. Another
-    # thread or fiber sharing this client can make requests meanwhile; a
-    # non-quiet one first sends the block's buffered requests and discards
-    # their replies, so it reads only its own.
     def quiet
       old = Thread.current[::Dalli::QUIET]
       Thread.current[::Dalli::QUIET] = true
@@ -420,8 +389,6 @@ module Dalli
     ##
     # Incr adds the given amount to the counter on the memcached server.
     # Amt must be a positive integer value.
-    # Default, if given, must be an Integer (or a String of decimal digits);
-    # anything else raises ArgumentError.
     #
     # If default is nil, the counter must already exist or the operation
     # will fail and will return nil.  Otherwise this method will return
@@ -434,7 +401,6 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def incr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
-      validate_integer!(:default, default)
 
       perform(:incr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -442,8 +408,6 @@ module Dalli
     ##
     # Decr subtracts the given amount from the counter on the memcached server.
     # Amt must be a positive integer value.
-    # Default, if given, must be an Integer (or a String of decimal digits);
-    # anything else raises ArgumentError.
     #
     # memcached counters are unsigned and cannot hold negative values.  Calling
     # decr on a counter which is 0 will just return 0.
@@ -459,7 +423,6 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def decr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
-      validate_integer!(:default, default)
 
       perform(:decr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -538,10 +501,6 @@ module Dalli
 
     private
 
-    # Records hit/miss metrics on a span for cache observability.
-    # @param span [OpenTelemetry::Trace::Span, nil] the span to record on
-    # @param key_count [Integer] total keys requested
-    # @param hit_count [Integer] keys found in cache
     def record_hit_miss_metrics(span, key_count, hit_count)
       return unless span
 
@@ -601,17 +560,8 @@ module Dalli
       raise ArgumentError, "Positive values only: #{amt}" if amt.negative?
     end
 
-    # Numeric arguments that become meta protocol flags (GHSA-6wmv-xq9m-fmp7).
-    # Checked before the request starts so a bad value raises a clean
-    # ArgumentError, instead of Protocol::Base#request logging it as
-    # unexpected and closing the connection.
-    def validate_integer!(name, value)
-      Dalli::Protocol::Meta::RequestFormatter.integer_flag(name, value) unless value.nil?
-    end
-
     def cas_core(key, always_set, ttl = nil, req_options = nil)
-      # req_options reaches the read too, so raw: true returns the stored bytes
-      (value, cas) = perform(:cas, key, req_options)
+      (value, cas) = perform(:cas, key)
       return if value.nil? && !always_set
 
       newvalue = yield(value)
@@ -620,12 +570,7 @@ module Dalli
 
     def fetch_with_lock_request(key, ttl, lock_ttl, recache_threshold, req_options)
       server = ring.server_for_key(key)
-      # req_options (e.g. raw: true) reaches the read too. It's the base, not
-      # the override: fetch_with_lock's own lock_ttl/recache_threshold win.
-      meta_options = req_options.is_a?(Hash) ? req_options.dup : {}
-      meta_options[:vivify_ttl] = lock_ttl
-      meta_options[:recache_ttl] = recache_threshold
-      result = server.request(:meta_get, key, meta_options)
+      result = server.request(:meta_get, key, { vivify_ttl: lock_ttl, recache_ttl: recache_threshold })
 
       return result[:value] unless result[:won_recache]
 
@@ -645,16 +590,7 @@ module Dalli
     end
 
     def ring
-      @ring ||= Dalli::Ring.new(@normalized_servers, protocol_implementation, @options)
-    end
-
-    def protocol_implementation
-      @protocol_implementation ||= case @options[:protocol]&.to_s
-                                   when 'meta'
-                                     Dalli::Protocol::Meta
-                                   else
-                                     Dalli::Protocol::Binary
-                                   end
+      @ring ||= Dalli::Ring.new(@normalized_servers, @options)
     end
 
     ##
@@ -665,7 +601,7 @@ module Dalli
     #
     # This method also forces retries on network errors - when
     # a particular memcached instance becomes unreachable, or the
-    # operational times out.
+    # operation times out.
     ##
     def perform(*all_args)
       return yield if block_given?
@@ -692,6 +628,21 @@ module Dalli
       raise ArgumentError, "cannot convert :expires_in => #{opts[:expires_in].inspect} to an integer"
     end
 
+    REMOVED_OPTIONS = {
+      protocol: 'Dalli 5.0 only supports the meta protocol. The :protocol option has been removed.',
+      username: 'Dalli 5.0 removed SASL authentication support. The :username option is ignored.',
+      password: 'Dalli 5.0 removed SASL authentication support. The :password option is ignored.'
+    }.freeze
+    private_constant :REMOVED_OPTIONS
+
+    def warn_removed_options(opts)
+      REMOVED_OPTIONS.each do |key, message|
+        next unless opts.key?(key)
+
+        Dalli.logger.warn(message)
+      end
+    end
+
     def pipelined_getter
       PipelinedGetter.new(ring, @key_manager)
     end
@@ -703,15 +654,5 @@ module Dalli
     def pipelined_deleter
       PipelinedDeleter.new(ring, @key_manager)
     end
-
-    def raise_unless_meta_protocol!
-      return if protocol_implementation == Dalli::Protocol::Meta
-
-      raise Dalli::DalliError,
-            'This operation requires the meta protocol (memcached 1.6+). ' \
-            'Use protocol: :meta when creating the client.'
-    end
-
-    include ProtocolDeprecations
   end
 end