dalli 5.2.2 → 5.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd910ad2e0c6e5aa47b8591e9ba8c5806b6208fbab0ae0852637aecc48939051
-  data.tar.gz: bd0db96211060011acb2135feb337d8acc88638b08c57b3fa875445695a09b59
+  metadata.gz: 1a31a4159ee5cd637dca6676f343595f653798864bef28b109fbc329debe2aff
+  data.tar.gz: efba0a1a4bb20eff2fd4f6b26c15359351484401502a798fa398b5bf1301d046
 SHA512:
-  metadata.gz: 82da7aebd50661e1ab9af25dab7d66e5f70cb15260ff9ca4b3476e63eeb60cbb2ad1299718e56312f9a6a61d7a2b14d394fcc470325329f1152db42ac921ee6d
-  data.tar.gz: a036421fac121aa342adc3beced711ce64a1bd241673a9314f1f1454a951515890732c4c9651e52baf65c94cd01c4b5cbb655c8dcca4fa4db03d656c3cfc4abe
+  metadata.gz: 38f6d3ba18790b94875f18bf6239a520f57144ba763826063471bea2047aa6def2cc528d37de35f29037a0c33ca9bb8b46d7ed0ddc5dccebf8914888c71dafd7
+  data.tar.gz: 9f091240e20313b7cbb9250e900cbf3aa02f9aedbffceabeedc7355bc780cd3895e231c77bb091ab97680dbdac85e093635e3cfbca904fd7f095512181e4a59d

data/CHANGELOG.md

@@ -4,6 +4,58 @@ Dalli Changelog
 Unreleased
 ==========
 
+5.2.3
+==========
+
+Security:
+
+- Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
+  - memcached stores an item made by auto-create (`ma` with `N`/`J`, or `mg` with `N`) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
+  - `incr` and `decr` with an initial value now create such counters with an add instead. Return values are unchanged
+  - The new `verify_reply_keys` option makes `get_multi`, `get_multi_cas` and `get_multi_with_metadata` ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
+  - Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes
+
+Bug fixes:
+
+- `get_multi_with_metadata` and its `CacheResult` adapter now retry transient network errors and raise `Dalli::NetworkError` on terminal failures instead of returning misses or partial results (#1222, @jaideeppyne)
+- A per-request `raw: true` write no longer compresses the value (#1213)
+  - Values at or above the compression threshold (4 KB by default) were compressed and flagged even with `raw: true`. Raw reads ignore flags, so reading them back with `raw: true` returned the compressed bytes
+  - Raw values are now stored exactly as given. Callers that pass `raw: true` without `compress: false` store large values uncompressed; Rails' `MemCacheStore` passes `compress: false` and isn't affected
+- Fix `cas` and `cas!` edge cases, and make `flush` attempt every server (#1214)
+  - `cas!` on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns `false` if another client got there first
+  - With `cache_nils: true`, `cas` treated a stored `nil` as a miss and didn't call the block
+  - The docs now say what `cas` and `cas!` return on success: the new CAS value, not `true`. The return values are unchanged
+  - `flush` stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
+- Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
+  - A failed or timed-out handshake left the TCP socket open until GC and raised `OpenSSL::SSL::SSLError` directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and `socket_max_failures` handling, raising `Dalli::NetworkError` (or `Dalli::RingError` once no server is available)
+  - Certificate and hostname checks come only from the `ssl_context` you pass, and a bare `OpenSSL::SSL::SSLContext.new` checks neither. Dalli now logs a warning once per process when `verify_mode` doesn't include `VERIFY_PEER` or `verify_hostname` is false; see the new TLS section in the README
+- Connection and configuration fixes (#1216)
+  - `memcached://` URIs with a bracketed IPv6 host (`memcached://[::1]:11211`) now connect
+  - A server weight below 1 raises `ArgumentError`. Before, a ring where every weight was 0 raised `FloatDomainError`
+  - A reply line longer than 8 KiB without a CRLF, or one cut short by the connection closing, is now a network error that closes the connection. Before, the line had no length limit
+  - On CRuby, DNS resolution is now limited by `socket_timeout` (`resolv_timeout:`) as well as the connect
+- `Dalli::Client.new` no longer modifies the options hash it's given, and accepts a frozen one (#1217)
+- `value_max_bytes` now counts the key and memcached's per-item overhead (#1217)
+  - memcached's `-I` limit covers the whole item, not only the value. A value of exactly 1 MB passed Dalli's check and then failed in memcached with `Dalli::ServerError`, which `quiet` blocks and `set_multi` silently discarded
+  - Dalli now checks value + key + 63 bytes, the overhead measured on memcached 1.6, and raises `Dalli::ValueOverMaxSize` before sending. A custom `value_max_bytes` is now that much stricter
+  - A String `value_max_bytes` is converted to an Integer instead of raising on every set
+- `Rack::Session::Dalli` fixes (#1217)
+  - It no longer requires the `connection_pool` gem unless `pool_size` or `pool_timeout` is given
+  - `pool_size` and `pool_timeout` are no longer passed to `Dalli::Client`, and the options hash isn't modified
+  - A failed session delete is logged as a warning, not only when `$VERBOSE` is set
+- One value that can't be stored no longer discards other buffered writes (#1218)
+  - A value that raised `Dalli::MarshalError` or `Dalli::ValueOverMaxSize` closed the connection, which dropped writes still buffered from the same `quiet` block or `set_multi`. Multi-server `set_multi` did this without raising
+  - Both `set_multi` paths now store every other key, skip the bad one, and then raise. Single-server `set_multi` used to store nothing
+  - When single-server `set_multi` failed to marshal a value, the error log included every value in the batch. It now lists only the keys
+- `Rack::Session::Dalli`'s 401 for a session deleted mid-request is now a valid Rack response (#1220)
+  - When a session is deleted while a request is using it (for example, by a logout in another request), the store still returns 401 instead of writing the session back. The 401 now has a `content-type` and expires the session cookie, so the browser stops sending the dead session ID
+  - The app's response body is now closed, as the Rack spec requires. Before, it was dropped without `close`
+  - The app has already run when the 401 is returned, so its side effects have happened. This is documented in the README
+
+Improvements:
+
+- Add a `connect_timeout` option to set a separate timeout for DNS resolution and TCP/UNIX socket connects (including reconnects); it defaults to `socket_timeout`. TLS handshakes continue to use `socket_timeout` (#1221, @underwoo16)
+
 5.2.2
 ==========
 

data/README.md

@@ -59,6 +59,17 @@ Dalli::Client.new('localhost:11211', namespace: 'myapp', namespace_separator: '/
 
 The separator must be a single non-alphanumeric character. Valid examples: `:`, `/`, `|`, `.`, `-`, `_`, `#`
 
+### Maximum Item Size
+
+memcached rejects items larger than its `-I` setting (1MB by default). Set `value_max_bytes` to the same value if you change it:
+
+```ruby
+# memcached started with -I 2m
+Dalli::Client.new('localhost:11211', value_max_bytes: 2 * 1024 * 1024)
+```
+
+memcached's limit covers the whole item, so Dalli checks the stored (serialized and compressed) value plus the key plus 63 bytes of per-item overhead against `value_max_bytes`, and raises `Dalli::ValueOverMaxSize` before sending anything larger. With the defaults, the largest value you can store under a 10-byte key is 1,048,576 - 10 - 63 = 1,048,503 bytes.
+
 ### Deferred Draining
 
 By default, a `quiet` (or `multi`) block ends by waiting for the replies memcached still sends for its quiet requests, one round trip for each server the block wrote to. With `defer_drain: true`, the block returns without waiting:
@@ -112,6 +123,35 @@ The digest is MD5 by default. `digest_class:` takes any object that responds to
 
 See the [5.0-Upgrade.md](5.0-Upgrade.md) guide for upgrade information.
 
+### Counters and verify_reply_keys
+
+memcached names an item made by auto-create for a base64-encoded key (one with whitespace, control or non-ASCII characters) by its raw key bytes in later replies. Since 5.2.3, Dalli creates counters for such keys with an add rather than auto-create. Items created before then, or by other clients, can still be named that way until memcached releases a fix (1.6.45 and earlier behave this way). If keys passed to `incr` or `decr` with an initial value can contain untrusted input, set `verify_reply_keys: true` until then: multi-gets then ignore replies for keys they didn't request, at a cost of about 15% per multi-get.
+
+## TLS
+
+Pass an `OpenSSL::SSL::SSLContext` as `ssl_context:` to connect over TLS. Certificate and hostname verification come only from that context: Dalli adds no checks of its own. A bare `OpenSSL::SSL::SSLContext.new` verifies nothing, so it accepts any certificate from any server. Configure the context to verify both:
+
+```ruby
+ssl_context = OpenSSL::SSL::SSLContext.new
+ssl_context.set_params(
+  verify_mode: OpenSSL::SSL::VERIFY_PEER,
+  verify_hostname: true,
+  ca_file: '/path/to/ca.crt' # omit to use the system's trusted certificates
+)
+
+Dalli::Client.new('memcached.example.com:11211', ssl_context: ssl_context)
+```
+
+Dalli logs a warning once per process when the context's `verify_mode` is `VERIFY_NONE`, or when it is `VERIFY_PEER` but `verify_hostname` is false.
+
+A failed TLS handshake counts as a failed connection attempt, like a refused connection: once `socket_max_failures` attempts have failed, the server is marked down and requests fail over to the other servers.
+
+## Rack Sessions
+
+`Rack::Session::Dalli` stores Rack sessions in memcached. If a session is deleted while a request is using it (for example, when the user logs out in another tab during a slow request), the store doesn't write the session back, so a logged-out session can't come back. It replaces the app's response with a `401 Wrong session ID` that expires the session cookie.
+
+The app has already run by then, so whatever it did (database writes, emails, and so on) has happened, and only its response is lost. If a request needs a different outcome, check that the session still exists before making the changes.
+
 ## OpenTelemetry Tracing
 
 Dalli automatically instruments operations with [OpenTelemetry](https://opentelemetry.io/) when the SDK is present. No configuration is required - just add the OpenTelemetry gems to your application:

data/lib/dalli/client.rb

@@ -35,15 +35,20 @@ module Dalli
     #               to memcached.  Default: true.
     # - :compression_min_size - the minimum size (in bytes) for which Dalli will compress values sent to Memcached.
     #                           Defaults to 4K.
+    # - :value_max_bytes - the largest item memcached will accept, i.e. its -I setting. Defaults to 1MB. Like
+    #                     memcached, Dalli counts the key and 63 bytes of item overhead against this limit along
+    #                     with the (serialized, compressed) value, so the largest value that can be stored is
+    #                     value_max_bytes - key bytesize - 63. Larger values raise Dalli::ValueOverMaxSize.
     # - :serializer - defaults to Marshal
     # - :compressor - defaults to Dalli::Compressor, a Zlib-based implementation
     # - :cache_nils - defaults to false, if true Dalli will not treat cached nil values as 'not found' for
     #                 #fetch operations.
     # - :raw        - If set, disables serialization and compression entirely at the client level.
     #                 Only String values are supported. This is useful when the caller handles its own
-    #                 serialization (e.g., Rails' ActiveSupport::Cache). Note: this is different from
-    #                 the per-request :raw option which converts values to strings but still uses the
-    #                 serialization pipeline.
+    #                 serialization (e.g., Rails' ActiveSupport::Cache). The per-request :raw option
+    #                 (e.g. set(key, value, ttl, raw: true)) does the same for a single call: String
+    #                 values are stored as-is, uncompressed, and non-String values raise
+    #                 Dalli::MarshalError.
     # - :digest_class - defaults to Digest::MD5, allows you to pass in an object that responds to the hexdigest method,
     #                   useful for injecting a FIPS compliant hash object.
     # - :otel_db_statement - controls the +db.query.text+ span attribute when OpenTelemetry is loaded.
@@ -58,6 +63,17 @@ module Dalli
     #                  quiet requests (NF, NS, errors) wait on the connection until then, so a client that only makes
     #                  quiet requests should call #drain_deferred_responses periodically. See "Deferred Draining" in
     #                  the README.
+    # - :socket_timeout - timeout in seconds for reads and writes on a connection, and for the TLS
+    #                     handshake. Also used for connecting unless :connect_timeout is set.
+    #                     Default: 1.
+    # - :connect_timeout - timeout in seconds for DNS resolution and TCP/UNIX socket connects,
+    #                      including reconnects after a failure. Defaults to :socket_timeout.
+    #                      TLS handshakes use :socket_timeout.
+    # - :verify_reply_keys - defaults to false. When true, get_multi, get_multi_cas and get_multi_with_metadata only
+    #                        accept replies for the keys they requested; after a reply naming another key, the rest of
+    #                        that server's replies are treated as misses. memcached can name an item by its raw key
+    #                        bytes when the item was created by auto-create from a base64-encoded key, which Dalli no
+    #                        longer does. Costs a multi-get about 15%.
     #
     def initialize(servers = nil, options = {})
       @normalized_servers = ::Dalli::ServersArgNormalizer.normalize_servers(servers)
@@ -226,9 +242,14 @@ module Dalli
     #
     # `req_options` accepts :p_token/:l_token, applied to every key in the batch.
     #
+    # A transient network error is retried automatically. If a server remains
+    # unreachable after retrying, raises Dalli::NetworkError rather than
+    # returning its keys as misses or yielding a partial result.
+    #
     # @param keys [Array<String>] the keys to fetch
     # @param req_options [Hash, nil] routing-token options
     # @return [Hash] key => { value:, cas:, stale:, miss: }
+    # @raise [Dalli::NetworkError] if a server is unreachable after retrying
     def get_multi_with_metadata(*keys, req_options: nil, &block)
       keys.flatten!
       keys.compact!
@@ -371,24 +392,26 @@ module Dalli
     # compare and swap values using optimistic locking.
     # Fetch the existing value for key.
     # If it exists, yield the value to the block.
-    # Add the block's return value as the new value for the key.
-    # Add will fail if someone else changed the value.
+    # Store the block's return value as the new value for the key.
+    # The store will fail if someone else changed the value.
     #
     # Returns:
-    # - nil if the key did not exist.
+    # - nil if the key did not exist (or held nil and :cache_nils is false);
+    #   the block is not called.
     # - false if the value was changed by someone else.
-    # - true if the value was successfully updated.
+    # - the new CAS value (a positive Integer) if the value was successfully updated.
     def cas(key, ttl = nil, req_options = nil, &)
       cas_core(key, false, ttl, req_options, &)
     end
 
     ##
     # like #cas, but will yield to the block whether or not the value
-    # already exists.
+    # already exists. If the key did not exist, the block receives nil.
     #
     # Returns:
-    # - false if the value was changed by someone else.
-    # - true if the value was successfully updated.
+    # - false if the value was changed by someone else, including another
+    #   client creating a missing key while the block ran.
+    # - the new CAS value (a positive Integer) if the value was successfully updated.
     def cas!(key, ttl = nil, req_options = nil, &)
       cas_core(key, true, ttl, req_options, &)
     end
@@ -650,9 +673,20 @@ module Dalli
     ##
     # Flush the memcached server, at 'delay' seconds in the future.
     # Delay defaults to zero seconds, which means an immediate flush.
+    # Every server is attempted. If any of them fails, the first error is
+    # raised once all the others have been flushed.
     ##
     def flush(delay = 0)
-      ring.servers.map { |s| s.request(:flush, delay) }
+      first_error = nil
+      results = ring.servers.map do |s|
+        s.request(:flush, delay)
+      rescue StandardError => e
+        first_error ||= e
+        nil
+      end
+      raise first_error if first_error
+
+      results
     end
     alias flush_all flush
 
@@ -805,16 +839,26 @@ module Dalli
       Dalli.logger.debug { e.inspect }
       Dalli.logger.debug { 'retrying single-server get_multi because of network error' }
       retry
+    rescue Dalli::UnexpectedReplyKeyError => e
+      # The connection is closed and the keys are treated as missing, as the
+      # pipelined get_multi does for a server whose replies are out of step
+      Dalli.logger.warn { e.message }
+      {}
     end
 
     def single_server_get_multi_with_metadata(keys, req_options = nil)
-      keys.map! { |k| @key_manager.validate_key(k.to_s) }
+      validated_keys = keys.map { |k| @key_manager.validate_key(k.to_s) }
       return {} unless (server = single_server)
 
-      result = server.request(:read_multi_with_metadata_req, keys, req_options)
+      result = server.request(:read_multi_with_metadata_req, validated_keys, req_options)
       result.transform_keys! { |k| @key_manager.key_without_namespace(k) }
       result
-    rescue Dalli::NetworkError
+    rescue Dalli::RetryableNetworkError => e
+      Dalli.logger.debug { e.inspect }
+      Dalli.logger.debug { 'retrying single-server get_multi_with_metadata because of network error' }
+      retry
+    rescue Dalli::UnexpectedReplyKeyError => e
+      Dalli.logger.warn { e.message }
       {}
     end
 
@@ -913,12 +957,23 @@ module Dalli
     def cas_core(key, always_set, ttl = nil, req_options = nil)
       validate_routing_tokens!(req_options)
       (value, cas) = perform(:cas, key, req_options)
-      return if value.nil? && !always_set
+      return if !always_set && cas_miss?(value, cas)
 
       newvalue = yield(value)
+      # A CAS of 0 means the key was missing. A set with CAS 0 is unconditional,
+      # so add instead: it fails if another client created the key meanwhile.
+      return perform(:add, key, newvalue, ttl_or_default(ttl), req_options) if cas.zero?
+
       perform(:set, key, newvalue, ttl_or_default(ttl), cas, req_options)
     end
 
+    # The CAS lookup returns [nil, 0] on a miss rather than NOT_FOUND, and a
+    # stored item always has a non-zero CAS. So under cache_nils a zero CAS
+    # marks the miss, and a stored nil is a hit, as in #not_found?.
+    def cas_miss?(value, cas)
+      cache_nils ? cas.zero? : value.nil?
+    end
+
     def fetch_with_lock_request(key, ttl, lock_ttl, recache_threshold, req_options)
       server = ring.server_for_key(key)
       # req_options is the base, not the override: fetch_with_lock's own
@@ -986,7 +1041,10 @@ module Dalli
       retry
     end
 
-    def normalize_options(opts)
+    # Works on a copy so the caller's hash is neither modified here nor able
+    # to change this client's configuration later.
+    def normalize_options(options)
+      opts = options.dup
       opts[:expires_in] = opts[:expires_in].to_i if opts[:expires_in]
       opts
     rescue NoMethodError

data/lib/dalli/pipelined_getter.rb

@@ -60,6 +60,9 @@ module Dalli
     #
     # `req_options` accepts :p_token/:l_token, applied to every key in the batch.
     #
+    # A transient network error is retried automatically. A terminal
+    # Dalli::NetworkError propagates instead of returning partial metadata.
+    #
     def process_with_metadata(keys, req_options = nil)
       return {} if keys.empty?
 
@@ -67,9 +70,9 @@ module Dalli
         results = {}
         groups_for_keys(keys).each do |server, keys_for_server|
           results.merge!(server.request(:read_multi_with_metadata_req, keys_for_server, req_options))
-        rescue Dalli::RetryableNetworkError
+        rescue Dalli::NetworkError
           raise
-        rescue DalliError, NetworkError => e
+        rescue DalliError => e
           Dalli.logger.debug { e.inspect }
           Dalli.logger.debug { "unable to get keys for server #{server.name}" }
         end

data/lib/dalli/pipelined_setter.rb

@@ -18,6 +18,9 @@ module Dalli
     # A transient network error is retried automatically. If a server remains
     # unreachable after retrying, raises Dalli::NetworkError.
     #
+    # A value that can't be marshalled or is over value_max_bytes is skipped;
+    # the other keys are still stored, then the first such error is raised.
+    #
     # @param hash [Hash] key-value pairs to set
     # @param ttl [Integer] time-to-live in seconds
     # @param req_options [Hash] options passed to each set operation
@@ -26,10 +29,12 @@ module Dalli
     def process(hash, ttl, req_options)
       return if hash.empty?
 
+      @value_error = nil
       @ring.lock do
         servers = setup_requests(hash, ttl, req_options)
         finish_requests(servers)
       end
+      raise @value_error if @value_error
     rescue Dalli::RetryableNetworkError => e
       Dalli.logger.debug { e.inspect }
       Dalli.logger.debug { 'retrying pipelined sets because of network error' }
@@ -62,6 +67,10 @@ module Dalli
           server.request(:pipelined_set, key, value, ttl, req_options)
         rescue Dalli::NetworkError
           raise
+        rescue Dalli::MarshalError, Dalli::ValueOverMaxSize => e
+          # Nothing was written for this key, so the server's other keys are
+          # unaffected; raised by #process once the batch is complete
+          @value_error ||= e
         rescue DalliError => e
           Dalli.logger.debug { e.inspect }
           Dalli.logger.debug { "unable to set key #{key} for server #{server.name}" }

data/lib/dalli/protocol/base.rb

@@ -43,6 +43,7 @@ module Dalli
         @options = client_options.merge(user_creds)
         @raw_mode = client_options[:raw]
         @defer_drain = client_options[:defer_drain] ? true : false
+        @verify_reply_keys = client_options[:verify_reply_keys] ? true : false
         @value_marshaller = @raw_mode ? StringMarshaller.new(@options) : ValueMarshaller.new(@options)
         @connection_manager = ConnectionManager.new(hostname, port, socket_type, @options)
       end
@@ -79,8 +80,14 @@ module Dalli
 
           request_completed = true
           response
-        rescue Dalli::MarshalError => e
-          log_marshal_err(args.first, e)
+        rescue Dalli::MarshalError, Dalli::ValueOverMaxSize => e
+          log_marshal_err(args.first, e) if e.is_a?(Dalli::MarshalError)
+          # Raised only while the connection is clean: a value is marshalled
+          # before any of its request is written, and write_multi_req raises
+          # only after reading every reply. Closing the connection would
+          # discard earlier quiet writes still waiting in the write buffer.
+          @connection_manager.abort_request!
+          request_completed = true
           raise
         rescue Dalli::DalliError
           raise
@@ -153,6 +160,8 @@ module Dalli
       # avoiding intermediate Hash allocation. Returns nil.
       # Without a block, returns a Hash of { key => [value, cas] }.
       def pipeline_next_responses(&block)
+        return abandon_pipeline if @pipeline_out_of_step
+
         reconnect_on_pipeline_complete!
         values = nil
 
@@ -174,6 +183,13 @@ module Dalli
           # to the noop at the end of the pipeline
           finish_pipeline && break if status && key.nil?
 
+          # A key that wasn't requested means the replies are out of step
+          # (see expect_reply_keys): keep what was read so far, drop the rest
+          if unexpected_reply_key?(key)
+            abandon_pipeline
+            break
+          end
+
           # If the status is ok and the key is not nil, then this is a
           # getkq response with a value that we want to set in the response hash
           unless key.nil?
@@ -346,6 +362,7 @@ module Dalli
         # the expected state before pipeline_response_setup is called.
         response_buffer.clear
         response_buffer.raw = raw_request?(options)
+        expect_reply_keys(keys)
 
         # The terminating noop is sent by pipeline_response_setup
         write(quiet_get_requests(keys, options, return_cas: return_cas))
@@ -358,6 +375,7 @@ module Dalli
         # Initialize the response buffer for draining during send phase
         response_buffer.ensure_ready
         response_buffer.raw = raw_request?(options)
+        expect_reply_keys(keys)
 
         keys.each_slice(chunk_size) do |chunk|
           # Build and write this chunk of requests
@@ -390,6 +408,12 @@ module Dalli
           status, cas, key, value = response_buffer.process_single_getk_response
           break if status.nil? # No complete response available
 
+          # Handled by the next pipeline_next_responses, once sending is done
+          if unexpected_reply_key?(key)
+            @pipeline_out_of_step = true
+            break
+          end
+
           results[key] = [value, cas] unless key.nil?
         end
       rescue SystemCallError, Dalli::NetworkError
@@ -401,6 +425,42 @@ module Dalli
         @response_buffer ||= ResponseBuffer.new(@connection_manager, response_processor)
       end
 
+      # A multi-get only accepts replies for the keys it asked for. memcached
+      # names an item created by auto-create (ma or mg with N) for a
+      # base64-encoded key by its raw bytes, without the b flag; such a key
+      # can contain spaces or CR/LF, which split the reply header and make the
+      # replies after it parse as different ones. A key that wasn't requested
+      # is how that shows up.
+      # Only with the verify_reply_keys option, since building the set costs a
+      # multi-get about 15%. Dalli itself no longer creates such items (see
+      # Meta#decr_incr); the check guards against ones that older versions or
+      # other clients created, on memcached versions with the behavior.
+      def expect_reply_keys(keys)
+        @pipeline_out_of_step = false
+        @expected_reply_keys = (keys.to_set { |k| reply_key_form(k) } if @verify_reply_keys)
+      end
+
+      def unexpected_reply_key?(key)
+        !key.nil? && @expected_reply_keys && !@expected_reply_keys.include?(reply_key_form(key))
+      end
+
+      # Keys compared as bytes; ASCII keys compare equal in any encoding as is
+      def reply_key_form(key)
+        key.ascii_only? ? key : key.b
+      end
+
+      # Keeps what was read, drops the rest of this server's replies, and
+      # closes the connection so nothing unread is left on it. Not a socket
+      # failure, so it doesn't count toward socket_max_failures; the keys not
+      # read are simply missing from the result.
+      def abandon_pipeline
+        Dalli.logger.warn { "#{name} replied to a get_multi with a key that wasn't requested; closing the connection" }
+        @pipeline_out_of_step = false
+        response_buffer.clear
+        @connection_manager.close
+        {}
+      end
+
       # Called after the noop response is received at the end of a set
       # of pipelined gets
       def finish_pipeline
@@ -414,7 +474,10 @@ module Dalli
         @connection_manager.reconnect! 'pipelined get has completed' if pipeline_complete?
       end
 
+      # The single-server set_multi path passes its whole pairs hash as the
+      # first argument; log only its keys, never the values
       def log_marshal_err(key, err)
+        key = key.keys.join("', '") if key.is_a?(Hash)
         Dalli.logger.error "Marshalling error for key '#{key}': #{err.message}"
         Dalli.logger.error 'You are trying to cache a Ruby object which cannot be serialized to memcached.'
       end

data/lib/dalli/protocol/connection_manager.rb

@@ -60,8 +60,8 @@ module Dalli
         @pid = Process.pid
         @request_in_progress = false
         @quiet_responses_pending = false
-      rescue SystemCallError, *TIMEOUT_ERRORS, EOFError, SocketError => e
-        # SocketError = DNS resolution failure
+      rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError, SocketError => e
+        # SocketError = DNS resolution failure; SSL_ERRORS = failed TLS handshake
         error_on_request!(e)
       end
 
@@ -188,10 +188,22 @@ module Dalli
         @request_in_progress = false
       end
 
+      # The longest reply line Dalli reads, in bytes, CRLF included. A meta
+      # reply header is at most about 500 bytes: "VA <size>" plus its flags,
+      # the largest being a 250-byte key base64-encoded to 336 bytes, a
+      # 20-digit CAS, a 32-byte opaque and a few numeric fields. The longest
+      # stats line (stats settings) carries a file path such as ext_path, up
+      # to PATH_MAX (4096). 8 KiB leaves room for both, while a server that
+      # never sends CRLF can't grow the read buffer without bound.
+      MAX_LINE_BYTES = 8 * 1024
+
       def read_line
         flush_write_buffer
-        data = @sock.gets("\r\n")
+        data = @sock.gets("\r\n", MAX_LINE_BYTES)
         error_on_request!('EOF in read_line') if data.nil?
+        # Without its CRLF the line either ran past MAX_LINE_BYTES or was cut
+        # short by EOF; either way the connection is out of step
+        error_on_request!("Reply line without CRLF in the first #{MAX_LINE_BYTES} bytes") unless data.end_with?("\r\n")
         data
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
         error_on_request!(e)

data/lib/dalli/protocol/meta.rb

@@ -234,12 +234,45 @@ module Dalli
       # rubocop:disable-next Metrics/ParameterLists
       def decr_incr(incr, key, delta, ttl, initial, options = nil)
         ttl = initial ? TtlSanitizer.sanitize(ttl) : nil # Only set a TTL if we want to set a value on miss
+        # memcached stores an item created by ma's auto-create (N/J) for a
+        # base64-encoded key without its binary-key flag, and later replies
+        # name it with the raw key bytes. Create such counters with an add.
+        return decr_incr_with_add(incr, key, delta, ttl, initial, options) if initial && KeyRegularizer.required?(key)
+
         write(RequestFormatter.meta_arithmetic(key: key, delta: delta, initial: initial, incr: incr, ttl: ttl,
                                                quiet: quiet?, **routing_token_kwargs(options)))
         finish_write(quiet?)
         response_processor.decr_incr unless quiet?
       end
 
+      # Like decr_incr with an initial value, without memcached's auto-create:
+      # on a miss the counter is added with the initial value (which is
+      # returned, as auto-create would), and the add losing a race to another
+      # client means the counter now exists, so the incr is tried again. In a
+      # quiet block both requests are sent and whichever applies takes effect.
+      # rubocop:disable-next Metrics/ParameterLists
+      def decr_incr_with_add(incr, key, delta, ttl, initial, options)
+        add_options = (options || {}).merge(raw: true) # counters are stored raw
+        return quiet_decr_incr_with_add(incr, key, delta, ttl, initial, add_options) if quiet?
+
+        2.times do
+          value = decr_incr(incr, key, delta, nil, nil, options)
+          return value unless value.nil?
+
+          write_storage_req(:add, key, initial.to_s, ttl, nil, add_options, quiet: false)
+          return initial if response_processor.meta_set_with_cas
+        end
+        decr_incr(incr, key, delta, nil, nil, options)
+      end
+
+      # rubocop:disable-next Metrics/ParameterLists
+      def quiet_decr_incr_with_add(incr, key, delta, ttl, initial, add_options)
+        write(RequestFormatter.meta_arithmetic(key: key, delta: delta, initial: nil, incr: incr, ttl: nil,
+                                               quiet: true, **routing_token_kwargs(add_options)))
+        write_storage_req(:add, key, initial.to_s, ttl, nil, add_options, quiet: true)
+        finish_write(true)
+      end
+
       # Other Commands
       def flush(delay = 0)
         write(RequestFormatter.flush(delay: delay))
@@ -293,7 +326,7 @@ module Dalli
         buffer = RequestFormatter.multi_meta_get(keys, skip_flags: is_raw, **routing_token_kwargs(options))
         flushed_write(buffer)
         buffer.clear
-        read_multi_get_responses(is_raw)
+        read_multi_get_responses(is_raw, keys)
       end
 
       # Stale-aware bulk get.  Returns { key => { value:, cas:, stale:, miss: } }
@@ -310,12 +343,13 @@ module Dalli
                                                        **routing_token_kwargs(options))
         flushed_write(buffer)
         buffer.clear
-        read_multi_metadata_responses(is_raw)
+        read_multi_metadata_responses(is_raw, keys)
       end
 
       # Unlike read_multi_get_responses this locates tokens by flag rather than
       # by position, because the c flag shifts the key's index.
-      def read_multi_metadata_responses(is_raw)
+      def read_multi_metadata_responses(is_raw, keys)
+        expect_reply_keys(keys)
         hash = {}
         while (line = @connection_manager.read_line)
           break if line.start_with?('MN')
@@ -331,23 +365,34 @@ module Dalli
           key = response_processor.key_from_tokens(tokens)
           next if key.nil?
 
+          raise_unexpected_reply_key(key) if unexpected_reply_key?(key)
+
           hash[key] = { value: @value_marshaller.retrieve(value, bitflags), cas: cas, stale: stale, miss: false }
         end
         hash
       end
 
-      def read_multi_get_responses(is_raw)
+      def read_multi_get_responses(is_raw, keys)
+        expect_reply_keys(keys)
         hash = {}
         while (line = @connection_manager.read_line)
           break if line.start_with?('MN')
           next unless line.start_with?('VA ')
 
           key, value = parse_multi_get_value(line, is_raw)
+          raise_unexpected_reply_key(key) if unexpected_reply_key?(key)
           hash[key] = value if key
         end
         hash
       end
 
+      # The replies after a key that wasn't requested can't be trusted (see
+      # Base#expect_reply_keys). Raising ends the request, which closes the
+      # connection; the caller treats this server's keys as missing.
+      def raise_unexpected_reply_key(key)
+        raise Dalli::UnexpectedReplyKeyError, "#{name} replied with a key that wasn't requested: #{key.inspect}"
+      end
+
       # Reads the "VA <size> [f<flags>] k<key> ..." line in place rather than
       # splitting it into tokens
       def parse_multi_get_value(line, is_raw)
@@ -364,16 +409,27 @@ module Dalli
 
       # Single-server fast path for set_multi. Inlines request formatting to
       # minimize per-key overhead. Avoids PipelinedSetter server grouping.
+      #
+      # A value that can't be marshalled or is over value_max_bytes is skipped;
+      # the other keys are still stored, then the first such error is raised
+      # (as PipelinedSetter does on the multi-server path).
       def write_multi_req(pairs, ttl, req_options)
         ttl = TtlSanitizer.sanitize(ttl) if ttl
-        entries = pairs.map do |key, raw_value|
+        value_error = nil
+        entries = pairs.filter_map do |key, raw_value|
           [key, @value_marshaller.store(key, raw_value, req_options)]
+        rescue Dalli::MarshalError, Dalli::ValueOverMaxSize => e
+          value_error ||= e
+          nil
         end
 
-        buffer = RequestFormatter.multi_meta_set(entries, ttl: ttl, **routing_token_kwargs(req_options))
-        flushed_write(buffer)
-        buffer.clear
-        response_processor.consume_all_responses_until_mn
+        unless entries.empty?
+          buffer = RequestFormatter.multi_meta_set(entries, ttl: ttl, **routing_token_kwargs(req_options))
+          flushed_write(buffer)
+          buffer.clear
+          response_processor.consume_all_responses_until_mn
+        end
+        raise value_error if value_error
       end
 
       # Single-server fast path for delete_multi. Writes all quiet delete requests

data/lib/dalli/protocol/server_config_parser.rb

@@ -33,7 +33,7 @@ module Dalli
           username: uri.user,
           password: uri.password
         }
-        [uri.host, normalize_port(uri.port), :tcp, DEFAULT_WEIGHT, auth_details]
+        [uri.hostname, normalize_port(uri.port), :tcp, DEFAULT_WEIGHT, auth_details]
       end
 
       def self.parse_non_uri(str)
@@ -61,11 +61,11 @@ module Dalli
         # in case of unix socket, allow only setting of weight, not port
         raise Dalli::DalliError, "Could not parse hostname #{res[0]}" if res[4]
 
-        [nil, normalize_weight(res[3])]
+        [nil, normalize_weight(res[3], res[0])]
       end
 
       def self.attributes_for_tcp_socket(res)
-        [normalize_port(res[3]), normalize_weight(res[4])]
+        [normalize_port(res[3]), normalize_weight(res[4], res[0])]
       end
 
       def self.normalize_host_from_match(str, res)
@@ -78,8 +78,13 @@ module Dalli
         Integer(port || DEFAULT_PORT)
       end
 
-      def self.normalize_weight(weight)
-        Integer(weight || DEFAULT_WEIGHT)
+      # A weight below 1 gives the server no points on the ring, and if every
+      # server has one the ring divides by a zero total weight.
+      def self.normalize_weight(weight, str)
+        value = Integer(weight || DEFAULT_WEIGHT)
+        raise ArgumentError, "Server weight must be at least 1, got #{value} in #{str}" if value < 1
+
+        value
       end
     end
   end

data/lib/dalli/protocol/string_marshaller.rb

@@ -10,7 +10,8 @@ module Dalli
     ##
     class StringMarshaller
       DEFAULTS = {
-        # max size of value in bytes (default is 1 MB, can be overriden with "memcached -I <size>")
+        # max memcached item size in bytes: value + key + ITEM_OVERHEAD_BYTES. Set it to
+        # memcached's -I value (default 1 MB).
         value_max_bytes: 1024 * 1024
       }.freeze
 
@@ -55,10 +56,7 @@ module Dalli
       private
 
       def error_if_over_max_value_bytes(key, value)
-        return if value.bytesize <= value_max_bytes
-
-        message = "Value for #{key} over max size: #{value_max_bytes} <= #{value.bytesize}"
-        raise Dalli::ValueOverMaxSize, message
+        ValueMarshaller.error_if_over_max_value_bytes(key, value, value_max_bytes)
       end
     end
   end

data/lib/dalli/protocol/value_compressor.rb

@@ -84,11 +84,13 @@ module Dalli
       end
 
       # Checks whether we should apply compression when serializing a value
-      # based on the specified options.  Returns false unless the value
-      # is greater than the minimum compression size.  Otherwise returns
-      # based on a method-level option if specified, falling back to the
-      # server default.
+      # based on the specified options.  Returns false for a raw request
+      # (raw reads ignore bitflags, so the value must be stored as given) or
+      # unless the value is greater than the minimum compression size.
+      # Otherwise returns based on a method-level option if specified,
+      # falling back to the server default.
       def compress_value?(value, req_options)
+        return false if req_options&.dig(:raw)
         return false unless value.bytesize >= compression_min_size
         return compress_by_default? unless req_options && !req_options[:compress].nil?
 

data/lib/dalli/protocol/value_marshaller.rb

@@ -13,12 +13,30 @@ module Dalli
       extend Forwardable
 
       DEFAULTS = {
-        # max size of value in bytes (default is 1 MB, can be overriden with "memcached -I <size>")
+        # max memcached item size in bytes: value + key + ITEM_OVERHEAD_BYTES. Set it to
+        # memcached's -I value (default 1 MB).
         value_max_bytes: 1024 * 1024
       }.freeze
 
       OPTIONS = DEFAULTS.keys.freeze
 
+      # memcached's -I limit applies to the whole item, not just the value. On
+      # 64-bit memcached 1.6 an item takes the value, the key, and 63 bytes of
+      # overhead: a 48-byte header, 8 bytes of CAS, 4 bytes of client flags,
+      # the key's NUL terminator and the value's trailing CRLF. (Measured
+      # against memcached 1.6.45 with -I 512k, 1m, 2m and 5m; an item stored
+      # with zero flags or with CAS disabled needs a few bytes less.)
+      ITEM_OVERHEAD_BYTES = 63
+
+      def self.error_if_over_max_value_bytes(key, value, value_max_bytes)
+        item_bytes = value.bytesize + key.bytesize + ITEM_OVERHEAD_BYTES
+        return if item_bytes <= value_max_bytes
+
+        message = "Value for #{key} over max size: #{value_max_bytes} <= #{item_bytes} " \
+                  "(#{value.bytesize} value bytes + #{key.bytesize} key bytes + #{ITEM_OVERHEAD_BYTES} item overhead)"
+        raise Dalli::ValueOverMaxSize, message
+      end
+
       def_delegators :@value_serializer, :serializer
       def_delegators :@value_compressor, :compressor, :compression_min_size, :compress_by_default?
 
@@ -28,6 +46,7 @@ module Dalli
 
         @marshal_options =
           DEFAULTS.merge(client_options.slice(*OPTIONS))
+        @marshal_options[:value_max_bytes] = @marshal_options[:value_max_bytes].to_i
       end
 
       def store(key, value, options = nil)
@@ -49,10 +68,7 @@ module Dalli
       end
 
       def error_if_over_max_value_bytes(key, value)
-        return if value.bytesize <= value_max_bytes
-
-        message = "Value for #{key} over max size: #{value_max_bytes} <= #{value.bytesize}"
-        raise Dalli::ValueOverMaxSize, message
+        self.class.error_if_over_max_value_bytes(key, value, value_max_bytes)
       end
     end
   end

data/lib/dalli/protocol.rb

@@ -16,9 +16,9 @@ module Dalli
         [Timeout::Error]
       end
 
-    # SSL errors that occur during read/write operations (not during initial
-    # handshake) should trigger reconnection. These indicate transient network
-    # issues, not configuration problems.
+    # SSL errors during the handshake or during read/write operations count as
+    # a failed request: they trigger reconnection and, after
+    # socket_max_failures, mark the server down.
     SSL_ERRORS =
       if defined?(OpenSSL::SSL::SSLError)
         [OpenSSL::SSL::SSLError]

data/lib/dalli/socket.rb

@@ -8,6 +8,12 @@ module Dalli
   # Various socket implementations used by Dalli.
   ##
   module Socket
+    # Timeout for establishing a connection: connect_timeout if set,
+    # otherwise socket_timeout.
+    def self.connect_timeout_for(options)
+      options[:connect_timeout] || options[:socket_timeout]
+    end
+
     ##
     # Common methods for all socket implementations.
     ##
@@ -162,11 +168,13 @@ module Dalli
       end
 
       def self.create_socket_with_timeout(host, port, options)
+        timeout = Dalli::Socket.connect_timeout_for(options)
         if supports_connect_timeout?
-          sock = new(host, port, connect_timeout: options[:socket_timeout])
+          # resolv_timeout bounds the DNS lookup, which connect_timeout doesn't cover
+          sock = new(host, port, connect_timeout: timeout, resolv_timeout: timeout)
           yield(sock)
         else
-          Timeout.timeout(options[:socket_timeout]) do
+          Timeout.timeout(timeout) do
             sock = new(host, port)
             yield(sock)
           end
@@ -228,12 +236,41 @@ module Dalli
         [seconds, microseconds].pack(timeval_pack_format(sock))
       end
 
+      # Closes the TCP socket if the handshake fails or times out, so a failed
+      # attempt doesn't hold a file descriptor until GC.
       def self.wrapping_ssl_socket(tcp_socket, host, ssl_context)
+        warn_if_unverified(ssl_context)
+        connected = false
         ssl_socket = Dalli::Socket::SSLSocket.new(tcp_socket, ssl_context)
         ssl_socket.hostname = host
         ssl_socket.sync_close = true
         ssl_socket.connect
+        connected = true
         ssl_socket
+      ensure
+        tcp_socket.close unless connected
+      end
+
+      # Class variable to track whether the TLS verification warning has been logged
+      @@ssl_verification_warning_logged = false # rubocop:disable Style/ClassVars
+
+      # Verification comes entirely from the caller's ssl_context, and a bare
+      # SSLContext.new verifies nothing, so warn (once per process) when the
+      # certificate or the hostname won't be checked.
+      def self.warn_if_unverified(ssl_context)
+        return if @@ssl_verification_warning_logged
+
+        problem = if !ssl_context.verify_mode.to_i.anybits?(::OpenSSL::SSL::VERIFY_PEER)
+                    'verify_mode is VERIFY_NONE, so the server certificate is not checked'
+                  elsif !ssl_context.verify_hostname
+                    'verify_hostname is false, so the certificate is not checked against the hostname'
+                  end
+        return unless problem
+
+        Dalli.logger.warn "SECURITY WARNING: Dalli's ssl_context #{problem}. " \
+                          'Use ssl_context.set_params(verify_mode: OpenSSL::SSL::VERIFY_PEER, ' \
+                          'verify_hostname: true) to verify the server.'
+        @@ssl_verification_warning_logged = true # rubocop:disable Style/ClassVars
       end
     end
 
@@ -261,7 +298,7 @@ module Dalli
         attr_accessor :options
 
         def self.open(path, options = {})
-          Timeout.timeout(options[:socket_timeout]) do
+          Timeout.timeout(Dalli::Socket.connect_timeout_for(options)) do
             sock = new(path)
             sock.options = { path: path }.merge(options)
             init_socket_options(sock, options)

data/lib/dalli/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Dalli
-  VERSION = '5.2.2'
+  VERSION = '5.2.3'
 
   MIN_SUPPORTED_MEMCACHED_VERSION = '1.6.27'
 end

data/lib/dalli.rb

@@ -31,6 +31,10 @@ module Dalli
   # socket/server communication error that can be retried
   class RetryableNetworkError < NetworkError; end
 
+  # a multi-get reply named a key that wasn't requested, so the rest of that
+  # server's replies can't be trusted
+  class UnexpectedReplyKeyError < DalliError; end
+
   # Implements the NullObject pattern to store an application-defined value for 'Key not found' responses.
   class NilObject; end # rubocop:disable Lint/EmptyClass
   NOT_FOUND = NilObject.new

data/lib/rack/session/dalli.rb

@@ -2,7 +2,6 @@
 
 require 'rack/session/abstract/id'
 require 'dalli'
-require 'connection_pool'
 require 'English'
 
 module Rack
@@ -21,6 +20,11 @@ module Rack
         namespace: 'rack:session'
       }
 
+      # Our pool options and the ConnectionPool options they set. These are
+      # not passed on to Dalli::Client.
+      POOL_OPTIONS = { pool_size: :size, pool_timeout: :timeout }.freeze
+      private_constant :POOL_OPTIONS
+
       # Brings in a new Rack::Session::Dalli middleware with the given
       # `:memcache_server`. The server is either a hostname, or a
       # host-with-port string in the form of "host_name:port", or an array of
@@ -73,10 +77,18 @@ module Rack
         @data = build_data_source(options)
       end
 
-      def call(*_args)
-        super
+      # If the session is deleted from memcached while a request is running
+      # (for example, by a logout in another request), the session is not
+      # written back, so a logged-out session can't come back. The app's
+      # response is replaced with a 401 that expires the session cookie.
+      # The app has already run by then, so any side effects it had (database
+      # writes, emails, and so on) have happened.
+      def context(env, app = @app)
+        body = nil
+        super(env, ->(app_env) { app.call(app_env).tap { |response| body = response[2] } })
       rescue MissingSessionError
-        [401, {}, ['Wrong session ID']]
+        body.close if body.respond_to?(:close)
+        missing_session_response(env)
       end
 
       def find_session(req, sid)
@@ -111,13 +123,23 @@ module Rack
       def delete_session(_req, sid, options)
         with_dalli_client do |dc|
           key = memcached_key_from_sid(sid)
-          dc.delete(key) if key
+          delete_session_key(dc, key) if key
           generate_sid_with(dc) unless options[:drop]
         end
       end
 
       private
 
+      # A failed delete leaves the old session readable in memcached (e.g.
+      # after logout), so always log it, even though with_dalli_client then
+      # handles the error as before.
+      def delete_session_key(client, key)
+        client.delete(key)
+      rescue ::Dalli::DalliError, Errno::ECONNREFUSED => e
+        ::Dalli.logger.warn("#{self.class} failed to delete a session from memcached: #{e.class}: #{e.message}")
+        raise
+      end
+
       def memcached_key_from_sid(sid)
         sid.private_id if sid.respond_to?(:private_id)
       end
@@ -162,6 +184,12 @@ module Rack
         end
       end
 
+      def missing_session_response(env)
+        options = env[Rack::RACK_SESSION_OPTIONS] || @default_options
+        cookie = Rack::Utils.delete_set_cookie_header(key, options.slice(:path, :domain))
+        [401, { 'content-type' => 'text/plain', 'set-cookie' => cookie }, ['Wrong session ID']]
+      end
+
       def write_session_safely!(dalli_client, sid, persisted_data, write_args:)
         if persisted_data && persisted_data[:id] == sid # That means that we update the existing session
           # Override the session only if it still exists in the store!
@@ -181,15 +209,14 @@ module Rack
       end
 
       def retrieve_client_options(options)
-        # Filter out Rack::Session-specific options and apply our defaults
-        filtered_opts = options.reject { |k, _| DEFAULT_OPTIONS.key? k }
+        # Filter out Rack::Session-specific and pool options and apply our defaults
+        filtered_opts = options.reject { |k, _| DEFAULT_OPTIONS.key?(k) || POOL_OPTIONS.key?(k) }
         DEFAULT_DALLI_OPTIONS.merge(filtered_opts)
       end
 
       def retrieve_pool_options(options)
-        {}.tap do |pool_options|
-          pool_options[:size] = options.delete(:pool_size) if options[:pool_size]
-          pool_options[:timeout] = options.delete(:pool_timeout) if options[:pool_timeout]
+        POOL_OPTIONS.each_with_object({}) do |(option, pool_option), pool_options|
+          pool_options[pool_option] = options[option] if options[option]
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dalli
 version: !ruby/object:Gem::Version
-  version: 5.2.2
+  version: 5.2.3
 platform: ruby
 authors:
 - Peter M. Goldstein
@@ -89,7 +89,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.21
+rubygems_version: 4.0.23
 specification_version: 4
 summary: High performance memcached client for Ruby
 test_files: []