dalli 4.3.4 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d296cbb71a7d6d7f57969a942e7270bd3b7145160c2ba4c971426dfbdb352368
-  data.tar.gz: 14929b5d79fa9d709dd7ccf5b633a44a91fdb2cbc7139eecaa1687e0e63751db
+  metadata.gz: 16d7d5950137f4a51ae41392eaa576732595ac4020ae7be972d6fb4b33b9861d
+  data.tar.gz: ebb799522259a9a32a86e1dbfd13e810427f787f8110415509288655a5a5460b
 SHA512:
-  metadata.gz: 04d254a2ea7d37a29634aab3441634ec660fe430efcdf64e3ae547bd456f53a2d9a0c47eb17ae8b8a5407d0fdd6c811d8e4b681213f5089011b217465265388f
-  data.tar.gz: 55928535640b642c258efecfbede5a423638d0a45b1c814b7aaff03af67ae65feb5d344e9ab31fa963c25fcb318a25538c7e6e495dec1ae9e2b85c6bcfcc06aa
+  metadata.gz: 74e32eace9001bd50be0617f10234f1440f86e506facc7247cf6041cf81fa85e966a5721e2a7ff364eb89da19bd46cc92b2631d99d4cbb21aee8240a475a76b5
+  data.tar.gz: 8e2bc294a1fa08a04f0bdfa300394751e63a7c1a21cac6aa1080a37e9491fe33091150047f664607ae42596d0bb2ac60f05c06ad97aee83165de754b9cceeed2

data/CHANGELOG.md

@@ -1,42 +1,34 @@
 Dalli Changelog
 =====================
 
-Unreleased
+5.0.0
 ==========
 
-4.3.4
-==========
+**Breaking Changes:**
 
-Security:
+- **Removed binary protocol** - The meta protocol is now the only supported protocol
+  - The `:protocol` option is no longer used
+  - Requires memcached 1.6+ (for meta protocol support)
+  - Users on older memcached versions must upgrade or stay on Dalli 4.x
 
-- Fix memcached command injection through numeric arguments with the meta protocol (GHSA-6wmv-xq9m-fmp7)
-  - With `protocol: :meta`, the `default` argument of `incr`/`decr`, and `fetch_with_lock`'s `lock_ttl` and `recache_threshold`, were written into the command without conversion, so a String containing CRLF injected additional memcached commands (e.g. `set`, `flush_all`) on the connection. The default binary protocol is not affected
-  - These arguments must now be Integers, or Strings of decimal digits; anything else raises `ArgumentError` before a request is sent
-  - As defense in depth, the meta `RequestFormatter` now converts every numeric flag it writes (`D`, `J`, `N`, `R`, `T`) to an Integer
-  - Thanks to oss-security-shop for the report
+- **Removed SASL authentication** - The meta protocol does not support authentication
+  - Use network-level security (firewall rules, VPN) or memcached's TLS support instead
+  - Users requiring SASL authentication must stay on Dalli 4.x with binary protocol
 
-4.3.3
-==========
+- **Ruby 3.3+ required** - Dropped support for Ruby 3.1 and 3.2
+  - Ruby 3.2 reached end-of-life in March 2026
+  - JRuby remains supported
 
 Performance:
 
-- Reduce object allocations in pipelined get response processing (#1072)
-  - Offset-based `ResponseBuffer`: track a read offset instead of slicing a new string after every parsed response; compact only when the consumed portion exceeds 4KB and more than half the buffer
-  - Inline response processor parsing: avoid intermediate array allocations from `split`-based header parsing in both binary and meta protocols
-  - Block-based `pipeline_next_responses`: yield `(key, value, cas)` directly when a block is given, avoiding per-call Hash allocation
-  - `PipelinedGetter`: replace Hash-based socket-to-server mapping with linear scan (faster for typical 1-5 server counts); use `Process.clock_gettime(CLOCK_MONOTONIC)` instead of `Time.now`
-- Add cross-version benchmark script (`bin/compare_versions`) for reproducible performance comparisons across Dalli versions
-
-Bug Fixes:
-
-- Skip OTel integration tests when meta protocol is unavailable (#1072)
-
-4.3.2
-==========
+- **~7% read performance improvement** (CRuby only)
+  - Use native `IO#read` instead of custom `readfull` implementation
+  - Enabled by Ruby 3.3's `IO#timeout=` support
+  - JRuby continues to use `readfull` for compatibility
 
 OpenTelemetry:
 
-- Migrate to stable OTel semantic conventions
+- Migrate to stable OTel semantic conventions (#1070)
   - `db.system` renamed to `db.system.name`
   - `db.operation` renamed to `db.operation.name`
   - `server.address` now contains hostname only; `server.port` is a separate integer attribute
@@ -46,6 +38,12 @@ OpenTelemetry:
 - Add `peer.service` span attribute
   - `:otel_peer_service` option for logical service naming
 
+Internal:
+
+- Simplified protocol directory structure: moved `lib/dalli/protocol/meta/*` to `lib/dalli/protocol/`
+- Removed deprecated binary protocol files and SASL authentication code
+- Removed `require 'set'` (autoloaded in Ruby 3.3+)
+
 4.3.1
 ==========
 

data/README.md

@@ -10,26 +10,14 @@ Dalli supports:
 * Fine-grained control of data serialization and compression
 * Thread-safe operation (either through use of a connection pool, or by using the Dalli client in threadsafe mode)
 * SSL/TLS connections to memcached
-* SASL authentication
 * OpenTelemetry distributed tracing (automatic when SDK is present)
 
 The name is a variant of Salvador Dali for his famous painting [The Persistence of Memory](http://en.wikipedia.org/wiki/The_Persistence_of_Memory).
 
 ## Requirements
 
-* Ruby 3.1 or later
-* memcached 1.4 or later (1.6+ recommended for meta protocol support)
-
-## Protocol Options
-
-Dalli supports two protocols for communicating with memcached:
-
-* `:binary` (default) - Works with all memcached versions, supports SASL authentication
-* `:meta` - Requires memcached 1.6+, better performance for some operations, no authentication support
-
-```ruby
-Dalli::Client.new('localhost:11211', protocol: :meta)
-```
+* Ruby 3.3 or later (JRuby also supported)
+* memcached 1.6 or later
 
 ## Configuration Options
 
@@ -64,7 +52,7 @@ By default, Dalli uses Ruby's Marshal for serialization. Deserializing untrusted
 Dalli::Client.new('localhost:11211', serializer: JSON)
 ```
 
-See the [4.0-Upgrade.md](4.0-Upgrade.md) guide for more information.
+See the [5.0-Upgrade.md](5.0-Upgrade.md) guide for upgrade information.
 
 ## OpenTelemetry Tracing
 

data/lib/dalli/client.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require 'digest/md5'
-require 'set'
 
 # encoding: ascii
 module Dalli
@@ -48,8 +47,6 @@ module Dalli
     #                 serialization pipeline.
     # - :digest_class - defaults to Digest::MD5, allows you to pass in an object that responds to the hexdigest method,
     #                   useful for injecting a FIPS compliant hash object.
-    # - :protocol - one of either :binary or :meta, defaulting to :binary.  This sets the protocol that Dalli uses
-    #               to communicate with memcached.
     # - :otel_db_statement - controls the +db.query.text+ span attribute when OpenTelemetry is loaded.
     #                        +:include+ logs the full operation and key(s), +:obfuscate+ replaces keys with "?",
     #                        +nil+ (default) omits the attribute entirely.
@@ -58,9 +55,9 @@ module Dalli
     def initialize(servers = nil, options = {})
       @normalized_servers = ::Dalli::ServersArgNormalizer.normalize_servers(servers)
       @options = normalize_options(options)
+      warn_removed_options(@options)
       @key_manager = ::Dalli::KeyManager.new(@options)
       @ring = nil
-      emit_deprecation_warnings
     end
 
     #
@@ -102,10 +99,7 @@ module Dalli
     end
 
     ##
-    # Get value with extended metadata using the meta protocol.
-    #
-    # IMPORTANT: This method requires memcached 1.6+ and the meta protocol (protocol: :meta).
-    # It will raise an error if used with the binary protocol.
+    # Get value with extended metadata.
     #
     # @param key [String] the cache key
     # @param options [Hash] options controlling what metadata to return
@@ -133,8 +127,6 @@ module Dalli
     #   # => { value: "data", cas: 123, hit_before: true, last_access: 42 }
     #
     def get_with_metadata(key, options = {})
-      raise_unless_meta_protocol!
-
       key = key.to_s
       key = @key_manager.validate_key(key)
 
@@ -208,9 +200,6 @@ module Dalli
     # cache entry (the "thundering herd" problem). Only one client wins the right to
     # regenerate; other clients receive the stale value (if available) or wait.
     #
-    # IMPORTANT: This method requires memcached 1.6+ and the meta protocol (protocol: :meta).
-    # It will raise an error if used with the binary protocol.
-    #
     # @param key [String] the cache key
     # @param ttl [Integer] time-to-live for the cached value in seconds
     # @param lock_ttl [Integer] how long the lock/stub lives (default: 30 seconds)
@@ -236,10 +225,6 @@ module Dalli
     def fetch_with_lock(key, ttl: nil, lock_ttl: 30, recache_threshold: nil, req_options: nil, &block)
       raise ArgumentError, 'Block is required for fetch_with_lock' unless block_given?
 
-      raise_unless_meta_protocol!
-      validate_integer!(:lock_ttl, lock_ttl)
-      validate_integer!(:recache_threshold, recache_threshold)
-
       key = key.to_s
       key = @key_manager.validate_key(key)
 
@@ -404,8 +389,6 @@ module Dalli
     ##
     # Incr adds the given amount to the counter on the memcached server.
     # Amt must be a positive integer value.
-    # Default, if given, must be an Integer (or a String of decimal digits);
-    # anything else raises ArgumentError.
     #
     # If default is nil, the counter must already exist or the operation
     # will fail and will return nil.  Otherwise this method will return
@@ -418,7 +401,6 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def incr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
-      validate_integer!(:default, default)
 
       perform(:incr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -426,8 +408,6 @@ module Dalli
     ##
     # Decr subtracts the given amount from the counter on the memcached server.
     # Amt must be a positive integer value.
-    # Default, if given, must be an Integer (or a String of decimal digits);
-    # anything else raises ArgumentError.
     #
     # memcached counters are unsigned and cannot hold negative values.  Calling
     # decr on a counter which is 0 will just return 0.
@@ -443,7 +423,6 @@ module Dalli
     # If the value already exists, it must have been set with raw: true
     def decr(key, amt = 1, ttl = nil, default = nil)
       check_positive!(amt)
-      validate_integer!(:default, default)
 
       perform(:decr, key, amt.to_i, ttl_or_default(ttl), default)
     end
@@ -522,10 +501,6 @@ module Dalli
 
     private
 
-    # Records hit/miss metrics on a span for cache observability.
-    # @param span [OpenTelemetry::Trace::Span, nil] the span to record on
-    # @param key_count [Integer] total keys requested
-    # @param hit_count [Integer] keys found in cache
     def record_hit_miss_metrics(span, key_count, hit_count)
       return unless span
 
@@ -585,14 +560,6 @@ module Dalli
       raise ArgumentError, "Positive values only: #{amt}" if amt.negative?
     end
 
-    # Numeric arguments that become meta protocol flags (GHSA-6wmv-xq9m-fmp7).
-    # Checked before the request starts so a bad value raises a clean
-    # ArgumentError, instead of Protocol::Base#request logging it as
-    # unexpected and closing the connection.
-    def validate_integer!(name, value)
-      Dalli::Protocol::Meta::RequestFormatter.integer_flag(name, value) unless value.nil?
-    end
-
     def cas_core(key, always_set, ttl = nil, req_options = nil)
       (value, cas) = perform(:cas, key)
       return if value.nil? && !always_set
@@ -623,16 +590,7 @@ module Dalli
     end
 
     def ring
-      @ring ||= Dalli::Ring.new(@normalized_servers, protocol_implementation, @options)
-    end
-
-    def protocol_implementation
-      @protocol_implementation ||= case @options[:protocol]&.to_s
-                                   when 'meta'
-                                     Dalli::Protocol::Meta
-                                   else
-                                     Dalli::Protocol::Binary
-                                   end
+      @ring ||= Dalli::Ring.new(@normalized_servers, @options)
     end
 
     ##
@@ -643,7 +601,7 @@ module Dalli
     #
     # This method also forces retries on network errors - when
     # a particular memcached instance becomes unreachable, or the
-    # operational times out.
+    # operation times out.
     ##
     def perform(*all_args)
       return yield if block_given?
@@ -670,6 +628,21 @@ module Dalli
       raise ArgumentError, "cannot convert :expires_in => #{opts[:expires_in].inspect} to an integer"
     end
 
+    REMOVED_OPTIONS = {
+      protocol: 'Dalli 5.0 only supports the meta protocol. The :protocol option has been removed.',
+      username: 'Dalli 5.0 removed SASL authentication support. The :username option is ignored.',
+      password: 'Dalli 5.0 removed SASL authentication support. The :password option is ignored.'
+    }.freeze
+    private_constant :REMOVED_OPTIONS
+
+    def warn_removed_options(opts)
+      REMOVED_OPTIONS.each do |key, message|
+        next unless opts.key?(key)
+
+        Dalli.logger.warn(message)
+      end
+    end
+
     def pipelined_getter
       PipelinedGetter.new(ring, @key_manager)
     end
@@ -681,15 +654,5 @@ module Dalli
     def pipelined_deleter
       PipelinedDeleter.new(ring, @key_manager)
     end
-
-    def raise_unless_meta_protocol!
-      return if protocol_implementation == Dalli::Protocol::Meta
-
-      raise Dalli::DalliError,
-            'This operation requires the meta protocol (memcached 1.6+). ' \
-            'Use protocol: :meta when creating the client.'
-    end
-
-    include ProtocolDeprecations
   end
 end

data/lib/dalli/instrumentation.rb

@@ -8,7 +8,7 @@ module Dalli
   # When OpenTelemetry is loaded, Dalli automatically creates spans for cache operations.
   # When OpenTelemetry is not available, all tracing methods are no-ops with zero overhead.
   #
-  # Dalli 4.3.2 uses the stable OTel semantic conventions for database spans.
+  # Dalli 5.0 uses the stable OTel semantic conventions for database spans.
   #
   # == Span Attributes
   #

data/lib/dalli/options.rb

@@ -6,7 +6,7 @@ module Dalli
   # Make Dalli threadsafe by using a lock around all
   # public server methods.
   #
-  # Dalli::Protocol::Binary.extend(Dalli::Threadsafe)
+  # Dalli::Protocol::Meta.extend(Dalli::Threadsafe)
   #
   module Threadsafe
     def self.extended(obj)

data/lib/dalli/pipelined_getter.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'set'
-
 module Dalli
   ##
   # Contains logic for the pipelined gets implemented by the client.
@@ -29,7 +27,7 @@ module Dalli
         # Stores partial results collected during interleaved send phase
         @partial_results = {}
         servers = setup_requests(keys)
-        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        start_time = Time.now
 
         # First yield any partial results collected during interleaved send
         yield_partial_results(&block)
@@ -149,7 +147,7 @@ module Dalli
     end
 
     def remaining_time(start, timeout)
-      elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
+      elapsed = Time.now - start
       return 0 if elapsed > timeout
 
       timeout - elapsed
@@ -168,8 +166,8 @@ module Dalli
     # Processes responses from a server.  Returns true if there are no
     # additional responses from this server.
     def process_server(server)
-      server.pipeline_next_responses do |key, value, cas|
-        yield @key_manager.key_without_namespace(key), [value, cas]
+      server.pipeline_next_responses.each_pair do |key, value_list|
+        yield @key_manager.key_without_namespace(key), value_list
       end
 
       server.pipeline_complete?
@@ -178,13 +176,18 @@ module Dalli
     def servers_with_response(servers, timeout)
       return [] if servers.empty?
 
-      sockets = servers.map(&:sock)
-      readable, = IO.select(sockets, nil, nil, timeout)
+      # TODO: - This is a bit challenging.  Essentially the PipelinedGetter
+      # is a reactor, but without the benefit of a Fiber or separate thread.
+      # My suspicion is that we may want to try and push this down into the
+      # individual servers, but I'm not sure.  For now, we keep the
+      # mapping between the alerted object (the socket) and the
+      # corrresponding server here.
+      server_map = servers.each_with_object({}) { |s, h| h[s.sock] = s }
+
+      readable, = IO.select(server_map.keys, nil, nil, timeout)
       return [] if readable.nil?
 
-      # For typical server counts (1-5), linear scan is faster than
-      # building and looking up a hash map
-      readable.filter_map { |sock| servers.find { |s| s.sock == sock } }
+      readable.map { |sock| server_map[sock] }
     end
 
     def groups_for_keys(*keys)

data/lib/dalli/protocol/base.rb

@@ -22,6 +22,7 @@ module Dalli
 
       def initialize(attribs, client_options = {})
         hostname, port, socket_type, @weight, user_creds = ServerConfigParser.parse(attribs)
+        warn_uri_credentials(user_creds)
         @options = client_options.merge(user_creds)
         @raw_mode = client_options[:raw]
         @value_marshaller = @raw_mode ? StringMarshaller.new(@options) : ValueMarshaller.new(@options)
@@ -91,13 +92,10 @@ module Dalli
       # repeatedly whenever this server's socket is readable until
       # #pipeline_complete?.
       #
-      # When a block is given, yields (key, value, cas) for each response,
-      # avoiding intermediate Hash allocation. Returns nil.
-      # Without a block, returns a Hash of { key => [value, cas] }.
-      # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
-      def pipeline_next_responses(&block)
+      # Returns a Hash of kv pairs received.
+      def pipeline_next_responses
         reconnect_on_pipeline_complete!
-        values = nil
+        values = {}
 
         response_buffer.read
 
@@ -111,24 +109,16 @@ module Dalli
 
           # If the status is ok and the key is not nil, then this is a
           # getkq response with a value that we want to set in the response hash
-          unless key.nil?
-            if block
-              yield key, value, cas
-            else
-              values ||= {}
-              values[key] = [value, cas]
-            end
-          end
+          values[key] = [value, cas] unless key.nil?
 
           # Get the next response from the buffer
           status, cas, key, value = response_buffer.process_single_getk_response
         end
 
-        values || {}
+        values
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
         @connection_manager.error_on_request!(e)
       end
-      # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
       # Abort current pipelined get. Generally used to signal an external
       # timeout during pipelined get.  The underlying socket is
@@ -152,18 +142,6 @@ module Dalli
         !response_buffer.in_progress?
       end
 
-      def username
-        @options[:username] || ENV.fetch('MEMCACHE_USERNAME', nil)
-      end
-
-      def password
-        @options[:password] || ENV.fetch('MEMCACHE_PASSWORD', nil)
-      end
-
-      def require_auth?
-        !username.nil?
-      end
-
       def quiet?
         Thread.current[::Dalli::QUIET]
       end
@@ -173,6 +151,16 @@ module Dalli
 
       private
 
+      URI_CREDENTIAL_WARNING = 'Dalli 5.0 removed SASL authentication. ' \
+                               'Credentials in memcached:// URIs are ignored.'
+      private_constant :URI_CREDENTIAL_WARNING
+
+      def warn_uri_credentials(user_creds)
+        return if user_creds[:username].nil? && user_creds[:password].nil?
+
+        Dalli.logger.warn(URI_CREDENTIAL_WARNING)
+      end
+
       ALLOWED_QUIET_OPS = %i[add replace set delete incr decr append prepend flush noop].freeze
       private_constant :ALLOWED_QUIET_OPS
 
@@ -227,8 +215,7 @@ module Dalli
 
       def connect
         @connection_manager.establish_connection
-        authenticate_connection if require_auth?
-        @version = version # Connect socket if not authed
+        @version = version
         up!
       end
 

data/lib/dalli/protocol/connection_manager.rb

@@ -156,7 +156,13 @@ module Dalli
       end
 
       def read(count)
-        @sock.readfull(count)
+        # JRuby doesn't support IO#timeout=, so use custom readfull implementation
+        # CRuby 3.3+ has IO#timeout= which makes IO#read work with timeouts
+        if RUBY_ENGINE == 'jruby'
+          @sock.readfull(count)
+        else
+          @sock.read(count)
+        end
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
         error_on_request!(e)
       end

data/lib/dalli/protocol/meta.rb

@@ -257,13 +257,9 @@ module Dalli
         @connection_manager.flush
       end
 
-      def authenticate_connection
-        raise Dalli::DalliError, 'Authentication not supported for the meta protocol.'
-      end
-
-      require_relative 'meta/key_regularizer'
-      require_relative 'meta/request_formatter'
-      require_relative 'meta/response_processor'
+      require_relative 'key_regularizer'
+      require_relative 'request_formatter'
+      require_relative 'response_processor'
     end
   end
 end

data/lib/dalli/protocol/{meta/request_formatter.rb → request_formatter.rb}

@@ -45,11 +45,10 @@ module Dalli
           cmd << (skip_flags ? ' v' : ' v f') if value
           cmd << ' c' if return_cas
           cmd << ' b' if base64
-          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
+          cmd << " T#{ttl}" if ttl
           cmd << ' k q s' if quiet # Return the key in the response if quiet
-          cmd << " N#{integer_flag(:vivify_ttl, vivify_ttl)}" if vivify_ttl # Thundering herd: vivify on miss
-          # Thundering herd: win recache if TTL below threshold
-          cmd << " R#{integer_flag(:recache_ttl, recache_ttl)}" if recache_ttl
+          cmd << " N#{vivify_ttl}" if vivify_ttl # Thundering herd: vivify on miss
+          cmd << " R#{recache_ttl}" if recache_ttl # Thundering herd: win recache if TTL below threshold
           cmd << ' h' if return_hit_status # Return hit status (0 or 1)
           cmd << ' l' if return_last_access # Return seconds since last access
           cmd << ' u' if skip_lru_bump # Don't bump LRU or update access stats
@@ -62,7 +61,7 @@ module Dalli
           cmd << ' b' if base64
           cmd << " F#{bitflags}" if bitflags
           cmd << cas_string(cas)
-          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
+          cmd << " T#{ttl}" if ttl
           cmd << " M#{mode_to_token(mode)}"
           cmd << ' q' if quiet
           cmd << TERMINATOR
@@ -75,7 +74,7 @@ module Dalli
           cmd = "md #{key}"
           cmd << ' b' if base64
           cmd << cas_string(cas)
-          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
+          cmd << " T#{ttl}" if ttl
           cmd << ' I' if stale # Mark stale instead of deleting
           cmd << ' q' if quiet
           cmd + TERMINATOR
@@ -84,10 +83,10 @@ module Dalli
         def self.meta_arithmetic(key:, delta:, initial:, incr: true, cas: nil, ttl: nil, base64: false, quiet: false)
           cmd = "ma #{key} v"
           cmd << ' b' if base64
-          cmd << " D#{integer_flag(:delta, delta)}" if delta
-          cmd << " J#{integer_flag(:initial, initial)}" if initial
+          cmd << " D#{delta}" if delta
+          cmd << " J#{initial}" if initial
           # Always set a TTL if an initial value is specified
-          cmd << " N#{ttl ? integer_flag(:ttl, ttl) : 0}" if ttl || initial
+          cmd << " N#{ttl || 0}" if ttl || initial
           cmd << cas_string(cas)
           cmd << ' q' if quiet
           cmd << " M#{incr ? 'I' : 'D'}"
@@ -137,18 +136,6 @@ module Dalli
           end
         end
 
-        # Numeric flag values are written straight into the command line, so a
-        # value that isn't an integer -- e.g. a String carrying CRLF -- would let
-        # the caller inject further memcached commands (GHSA-6wmv-xq9m-fmp7).
-        # Converting to Integer means only digits ever reach the wire. Strings
-        # are parsed as base 10 so "010" means 10, as memcached would read it,
-        # rather than octal 8.
-        def self.integer_flag(name, value)
-          value.is_a?(String) ? Integer(value, 10) : Integer(value)
-        rescue ArgumentError, TypeError, FloatDomainError
-          raise ArgumentError, "#{name} must be an Integer, got #{value.inspect}"
-        end
-
         def self.cas_string(cas)
           cas = parse_to_64_bit_int(cas, nil)
           cas.nil? || cas.zero? ? '' : " C#{cas}"

data/lib/dalli/protocol/response_buffer.rb

@@ -7,39 +7,38 @@ module Dalli
   module Protocol
     ##
     # Manages the buffer for responses from memcached.
-    # Uses an offset-based approach to avoid string allocations
-    # when advancing through parsed responses.
     ##
     class ResponseBuffer
-      # Compact the buffer when the consumed portion exceeds this
-      # threshold and represents more than half the buffer
-      COMPACT_THRESHOLD = 4096
-
       def initialize(io_source, response_processor)
         @io_source = io_source
         @response_processor = response_processor
         @buffer = nil
-        @offset = 0
       end
 
       def read
         @buffer << @io_source.read_nonblock
       end
 
-      # Attempts to process a single response from the buffer,
-      # advancing the offset past the consumed bytes.
+      # Attempts to process a single response from the buffer.  Starts
+      # by advancing the buffer to the specified start position
       def process_single_getk_response
-        bytes, status, cas, key, value = @response_processor.getk_response_from_buffer(@buffer, @offset)
-        @offset += bytes
-        compact_if_needed
+        bytes, status, cas, key, value = @response_processor.getk_response_from_buffer(@buffer)
+        advance(bytes)
         [status, cas, key, value]
       end
 
+      # Advances the internal response buffer by bytes_to_advance
+      # bytes.  The
+      def advance(bytes_to_advance)
+        return unless bytes_to_advance.positive?
+
+        @buffer = @buffer.byteslice(bytes_to_advance..-1)
+      end
+
       # Resets the internal buffer to an empty state,
       # so that we're ready to read pipelined responses
       def reset
         @buffer = ''.b
-        @offset = 0
       end
 
       # Ensures the buffer is initialized for reading without discarding
@@ -49,30 +48,16 @@ module Dalli
         return if in_progress?
 
         @buffer = ''.b
-        @offset = 0
       end
 
       # Clear the internal response buffer
       def clear
         @buffer = nil
-        @offset = 0
       end
 
       def in_progress?
         !@buffer.nil?
       end
-
-      private
-
-      # Only compact when we've consumed a significant portion of the buffer.
-      # This avoids per-response string allocation while preventing unbounded
-      # memory growth for large pipelines.
-      def compact_if_needed
-        return unless @offset > COMPACT_THRESHOLD && @offset > @buffer.bytesize / 2
-
-        @buffer = @buffer.byteslice(@offset..)
-        @offset = 0
-      end
     end
   end
 end