cachekit 0.17.1__tar.gz → 0.19.0__tar.gz

{cachekit-0.17.1 → cachekit-0.19.0}/Cargo.lock

@@ -245,9 +245,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cachekit-core"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aba1513135a7b92a124ad6983f7e80e5f5c78c4f9c74384079efa3fbf491eab"
+checksum = "12089baacc5ff661a62d2071588c895973bc48e42ed359178afaee22decb5559"
 dependencies = [
  "aes",
  "aes-gcm",
@@ -271,7 +271,7 @@ dependencies = [
 
 [[package]]
 name = "cachekit-rs"
-version = "0.17.1"
+version = "0.19.0"
 dependencies = [
  "cachekit-core",
  "criterion",
@@ -282,6 +282,7 @@ dependencies = [
  "pprof",
  "proptest",
  "pyo3",
+ "zeroize",
 ]
 
 [[package]]

{cachekit-0.17.1 → cachekit-0.19.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: cachekit
-Version: 0.17.1
-Classifier: Development Status :: 3 - Alpha
+Version: 0.19.0
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
@@ -21,13 +21,15 @@ Classifier: Framework :: AsyncIO
 Classifier: Typing :: Typed
 Requires-Dist: redis[hiredis]>=4.0.0
 Requires-Dist: pydantic>=2.0.0
-Requires-Dist: pydantic-settings>=2.0.0
+Requires-Dist: pydantic-settings>=2.7.0
 Requires-Dist: prometheus-client>=0.22.1
 Requires-Dist: psutil>=7.0.0
 Requires-Dist: blake3>=1.0.5
 Requires-Dist: msgpack>=1.2.1
 Requires-Dist: xxhash>=3.5.0
 Requires-Dist: httpx[http2]>=0.28.1
+Requires-Dist: anyio>=4.14.2
+Requires-Dist: h2>=4.4.1
 Requires-Dist: numpy>=2.0.2 ; extra == 'data'
 Requires-Dist: pandas>=1.3.0 ; extra == 'data'
 Requires-Dist: pyarrow>=21.0.0 ; extra == 'data'
@@ -37,7 +39,7 @@ Provides-Extra: data
 Provides-Extra: json
 Provides-Extra: memcached
 License-File: LICENSE
-Summary: Production-ready Redis caching for Python with intelligent reliability features and Rust-powered performance
+Summary: Backend-agnostic caching for Python — intent-based decorators with circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge AES-256-GCM encryption, on a Rust-powered core. Zero-config L1 in-memory; scales to Redis, Memcached, File, or CachekitIO.
 Keywords: redis,cache,caching,decorator,rust,performance,reliability,production,encryption,security,circuit-breaker,prometheus,messagepack,distributed-locking
 Home-Page: https://github.com/cachekit-io/cachekit-py
 Author-email: cachekit Contributors <noreply@cachekit.io>
@@ -57,7 +59,7 @@ Project-URL: Repository, https://github.com/cachekit-io/cachekit-py.git
 
 > **Python caching, batteries included**
 
-Production-ready caching for Python with intelligent reliability features and Rust-powered performance.
+Backend-agnostic caching with intent-based decorators — circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge encryption on a Rust-powered core. Zero config to start, any backend when you scale.
 
 [![PyPI Version][pypi-badge]][pypi-url]
 [![Python Versions][python-badge]][pypi-url]
@@ -68,20 +70,16 @@ Production-ready caching for Python with intelligent reliability features and Ru
 
 ---
 
-> [!WARNING]
-> **Alpha Software** — cachekit is under active development. While we've been building and testing for ~6 months, the API is not yet stable and **breaking changes may occur** between releases. We're committed to making this library rock-solid, but we need your help!
->
-> 🐛 **Found a bug?** Please [open an issue][issues-url] — even small ones help us improve.
->
-> 💡 **Something feel off?** We want to hear about rough edges, confusing APIs, or missing features.
+> [!NOTE]
+> **Status: beta** — CacheKit is in closed beta ahead of 1.0. APIs are stabilising; minor breaking changes may still occur between 0.x releases.
 >
-> Your feedback directly shapes the path to 1.0. Cheers!
+> 🐛 **Found a bug or a rough edge?** Please [open an issue][issues-url] — your feedback directly shapes the path to 1.0.
 
 ---
 
 ## Why cachekit?
 
-**Simple to use, production-ready out of the box.**
+**Simple to use, works out of the box.**
 
 ```python
 from cachekit import cache
@@ -125,7 +123,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Backend | Best for | Select with |
 |---------|----------|-------------|
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
-| CachekitIO | Managed, zero-ops (alpha) | `CACHEKIT_API_KEY` |
+| CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
 | File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
 
@@ -148,7 +146,7 @@ def expensive_api_call(user_id: int):
 ### More Backends
 
 <details>
-<summary><strong>CachekitIO — Managed SaaS (Alpha)</strong></summary>
+<summary><strong>CachekitIO — Managed SaaS (Beta)</strong></summary>
 
 ```python notest
 import os
@@ -162,7 +160,7 @@ def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-*cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+*cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 </details>
 
@@ -188,9 +186,9 @@ def expensive_api_call(user_id: int):
 
 ---
 
-> **CachekitIO Cloud (Alpha)**
+> **CachekitIO Cloud (Beta)**
 > Managed caching with zero infrastructure. L1+L2 caching, circuit breaker, and automatic failover — no Redis to manage.
-> *cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+> *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 ---
 
@@ -221,9 +219,8 @@ def get_user_profile(user_id: int):
 | Backpressure | ✅ | ✅ | - | ✅ | ✅ |
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
-| L1 SWR | - | ✅ | - | ✅ | ✅ |
+| L1 SWR (L1-only mode) | - | ✅ | - | ✅ | ✅ |
 | L1 Invalidation | - | - | - | ✅ | ✅ |
-| L1 Namespace Index | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | - | - | ✅ | ✅ |
 | Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
@@ -231,6 +228,8 @@ def get_user_profile(user_id: int):
 
 > 🔒 `@cache.secure` forces `integrity_checking=True` — it cannot be overridden.
 >
+> **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
+>
 > **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
@@ -291,6 +290,7 @@ def test_cached_function():
 - Connection pooling with thread affinity (+28% throughput)
 - Distributed locking prevents cache stampedes
 - Pluggable backend abstraction (Redis, CachekitIO, File, Memcached, custom)
+- Untrusted-decode bounds: nesting depth and header-declared allocation are capped on every cache read (a forged entry is a bounded cache miss), verified against the protocol's shared [`decode-bounds.json`](https://github.com/cachekit-io/protocol/blob/2d56cce231e193141f09df9316f9afac17a1538e/test-vectors/decode-bounds.json) vectors
 
 > [!NOTE]
 > All reliability features are **enabled by default** with `@cache.production`. Use `@cache.minimal` to disable them for maximum throughput.
@@ -346,9 +346,15 @@ def get_patient_data(hospital_id: int):
 > [!CAUTION]
 > When handling PII, medical, or financial data, always use `@cache.secure` to enforce encryption.
 
+**Zero-downtime key rotation**: promote a new `CACHEKIT_MASTER_KEY` and keep the
+retiring key readable via `CACHEKIT_PREVIOUS_MASTER_KEYS` (comma-separated hex,
+max 3 decrypt-only keys). Entries are selected by exact key fingerprint — never
+trial decryption — and old entries age out via TTL, no cache flush required. See
+[Zero-Knowledge Encryption](docs/features/zero-knowledge-encryption.md#key-rotation-pattern).
+
 cachekit employs comprehensive security tooling:
 
-- **Supply Chain Security**: cargo-deny for license compliance + RustSec scanning
+- **Dependency Security**: cargo-deny for license compliance + cargo-audit for RustSec scanning
 - **Formal Verification**: Kani proves correctness of compression, checksums, encryption
 - **Runtime Analysis**: Miri + sanitizers for memory safety
 - **Fuzzing**: Coverage-guided testing with >80% code coverage
@@ -408,6 +414,15 @@ exposition setup.
 <details>
 <summary><strong>Thread Safety Details</strong></summary>
 
+**Free-threaded CPython (3.14t):** the core suites run green on
+free-threaded 3.14 with the GIL verified disabled (CI job
+`test-freethreaded`), and the Rust extension declares free-threaded safety
+(`gil_used = false`). Free-threaded wheels are **not yet published** and
+free-threaded builds are not officially supported — blocked on upstream
+wheels (orjson, hiredis; numpy/pandas/pyarrow for `[data]`). See
+[measured performance results](docs/free-threading.md#measured-performance) and the
+full concurrency audit: [docs/free-threading.md](docs/free-threading.md).
+
 **Per-Function Statistics:**
 - Statistics tracked per function identity (`module.qualname`), shared across all calls and across re-decorations of the same function
 - Thread-safe via RLock (all methods safe for concurrent access)
@@ -443,6 +458,7 @@ info = expensive_func.cache_info()
 | [Comparison Guide][comparison-url] | How cachekit compares to lru_cache, aiocache, cachetools |
 | [Getting Started][getting-started-url] | Progressive tutorial from basics to advanced |
 | [API Reference][api-reference-url] | Complete API documentation |
+| [Skyline (live example)][skyline-url] | Canonical example project: this SDK ingests the Bluesky firehose and writes the analytics entries a TypeScript edge Worker serves live, on one shared interop namespace |
 
 ### Feature Deep Dives
 
@@ -453,6 +469,11 @@ info = expensive_func.cache_info()
 | [Distributed Locking][distributed-locking-url] | Cache stampede prevention |
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
+| [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Process-local invalidation, stale-while-revalidate |
+| [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
+| [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
+| [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
 
 ---
 
@@ -465,7 +486,7 @@ info = expensive_func.cache_info()
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)
 REDIS_URL="redis://localhost:6379"           # Fallback
 
-# CachekitIO SaaS Backend (closed alpha — request access at cachekit.io)
+# CachekitIO SaaS Backend (closed beta — request access at cachekit.io)
 CACHEKIT_API_KEY="your-api-key"             # Required for @cache.io()  # pragma: allowlist secret
 CACHEKIT_API_URL="https://api.cachekit.io"  # Default SaaS endpoint
 
@@ -528,6 +549,7 @@ MIT License - see [LICENSE][license-file-url] for details.
 [uv-url]: https://github.com/astral-sh/uv
 [security-url]: SECURITY.md
 [comparison-url]: docs/comparison.md
+[skyline-url]: https://github.com/cachekit-io/bluesky-thinking
 [getting-started-url]: docs/getting-started.md
 [api-reference-url]: docs/api-reference.md
 [serializer-guide-url]: docs/serializers/index.md
@@ -535,6 +557,11 @@ MIT License - see [LICENSE][license-file-url] for details.
 [distributed-locking-url]: docs/features/distributed-locking.md
 [prometheus-url]: docs/features/prometheus-metrics.md
 [encryption-url]: docs/features/zero-knowledge-encryption.md
+[interop-url]: docs/features/interop-mode.md
+[l1-invalidation-url]: docs/features/l1-invalidation.md
+[reference-caching-url]: docs/features/reference-caching.md
+[rust-serialization-url]: docs/features/rust-serialization.md
+[ssrf-url]: docs/features/ssrf-protection.md
 [contributing-url]: CONTRIBUTING.md
 [license-file-url]: LICENSE
 [github-url]: https://github.com/cachekit-io/cachekit-py

{cachekit-0.17.1 → cachekit-0.19.0}/README.md

@@ -4,7 +4,7 @@
 
 > **Python caching, batteries included**
 
-Production-ready caching for Python with intelligent reliability features and Rust-powered performance.
+Backend-agnostic caching with intent-based decorators — circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge encryption on a Rust-powered core. Zero config to start, any backend when you scale.
 
 [![PyPI Version][pypi-badge]][pypi-url]
 [![Python Versions][python-badge]][pypi-url]
@@ -15,20 +15,16 @@ Production-ready caching for Python with intelligent reliability features and Ru
 
 ---
 
-> [!WARNING]
-> **Alpha Software** — cachekit is under active development. While we've been building and testing for ~6 months, the API is not yet stable and **breaking changes may occur** between releases. We're committed to making this library rock-solid, but we need your help!
->
-> 🐛 **Found a bug?** Please [open an issue][issues-url] — even small ones help us improve.
->
-> 💡 **Something feel off?** We want to hear about rough edges, confusing APIs, or missing features.
+> [!NOTE]
+> **Status: beta** — CacheKit is in closed beta ahead of 1.0. APIs are stabilising; minor breaking changes may still occur between 0.x releases.
 >
-> Your feedback directly shapes the path to 1.0. Cheers!
+> 🐛 **Found a bug or a rough edge?** Please [open an issue][issues-url] — your feedback directly shapes the path to 1.0.
 
 ---
 
 ## Why cachekit?
 
-**Simple to use, production-ready out of the box.**
+**Simple to use, works out of the box.**
 
 ```python
 from cachekit import cache
@@ -72,7 +68,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Backend | Best for | Select with |
 |---------|----------|-------------|
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
-| CachekitIO | Managed, zero-ops (alpha) | `CACHEKIT_API_KEY` |
+| CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
 | File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
 
@@ -95,7 +91,7 @@ def expensive_api_call(user_id: int):
 ### More Backends
 
 <details>
-<summary><strong>CachekitIO — Managed SaaS (Alpha)</strong></summary>
+<summary><strong>CachekitIO — Managed SaaS (Beta)</strong></summary>
 
 ```python notest
 import os
@@ -109,7 +105,7 @@ def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-*cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+*cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 </details>
 
@@ -135,9 +131,9 @@ def expensive_api_call(user_id: int):
 
 ---
 
-> **CachekitIO Cloud (Alpha)**
+> **CachekitIO Cloud (Beta)**
 > Managed caching with zero infrastructure. L1+L2 caching, circuit breaker, and automatic failover — no Redis to manage.
-> *cachekit.io is in closed alpha — [request access](https://cachekit.io) to get started.*
+> *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
 ---
 
@@ -168,9 +164,8 @@ def get_user_profile(user_id: int):
 | Backpressure | ✅ | ✅ | - | ✅ | ✅ |
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
-| L1 SWR | - | ✅ | - | ✅ | ✅ |
+| L1 SWR (L1-only mode) | - | ✅ | - | ✅ | ✅ |
 | L1 Invalidation | - | - | - | ✅ | ✅ |
-| L1 Namespace Index | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | - | - | ✅ | ✅ |
 | Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
@@ -178,6 +173,8 @@ def get_user_profile(user_id: int):
 
 > 🔒 `@cache.secure` forces `integrity_checking=True` — it cannot be overridden.
 >
+> **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
+>
 > **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
@@ -238,6 +235,7 @@ def test_cached_function():
 - Connection pooling with thread affinity (+28% throughput)
 - Distributed locking prevents cache stampedes
 - Pluggable backend abstraction (Redis, CachekitIO, File, Memcached, custom)
+- Untrusted-decode bounds: nesting depth and header-declared allocation are capped on every cache read (a forged entry is a bounded cache miss), verified against the protocol's shared [`decode-bounds.json`](https://github.com/cachekit-io/protocol/blob/2d56cce231e193141f09df9316f9afac17a1538e/test-vectors/decode-bounds.json) vectors
 
 > [!NOTE]
 > All reliability features are **enabled by default** with `@cache.production`. Use `@cache.minimal` to disable them for maximum throughput.
@@ -293,9 +291,15 @@ def get_patient_data(hospital_id: int):
 > [!CAUTION]
 > When handling PII, medical, or financial data, always use `@cache.secure` to enforce encryption.
 
+**Zero-downtime key rotation**: promote a new `CACHEKIT_MASTER_KEY` and keep the
+retiring key readable via `CACHEKIT_PREVIOUS_MASTER_KEYS` (comma-separated hex,
+max 3 decrypt-only keys). Entries are selected by exact key fingerprint — never
+trial decryption — and old entries age out via TTL, no cache flush required. See
+[Zero-Knowledge Encryption](docs/features/zero-knowledge-encryption.md#key-rotation-pattern).
+
 cachekit employs comprehensive security tooling:
 
-- **Supply Chain Security**: cargo-deny for license compliance + RustSec scanning
+- **Dependency Security**: cargo-deny for license compliance + cargo-audit for RustSec scanning
 - **Formal Verification**: Kani proves correctness of compression, checksums, encryption
 - **Runtime Analysis**: Miri + sanitizers for memory safety
 - **Fuzzing**: Coverage-guided testing with >80% code coverage
@@ -355,6 +359,15 @@ exposition setup.
 <details>
 <summary><strong>Thread Safety Details</strong></summary>
 
+**Free-threaded CPython (3.14t):** the core suites run green on
+free-threaded 3.14 with the GIL verified disabled (CI job
+`test-freethreaded`), and the Rust extension declares free-threaded safety
+(`gil_used = false`). Free-threaded wheels are **not yet published** and
+free-threaded builds are not officially supported — blocked on upstream
+wheels (orjson, hiredis; numpy/pandas/pyarrow for `[data]`). See
+[measured performance results](docs/free-threading.md#measured-performance) and the
+full concurrency audit: [docs/free-threading.md](docs/free-threading.md).
+
 **Per-Function Statistics:**
 - Statistics tracked per function identity (`module.qualname`), shared across all calls and across re-decorations of the same function
 - Thread-safe via RLock (all methods safe for concurrent access)
@@ -390,6 +403,7 @@ info = expensive_func.cache_info()
 | [Comparison Guide][comparison-url] | How cachekit compares to lru_cache, aiocache, cachetools |
 | [Getting Started][getting-started-url] | Progressive tutorial from basics to advanced |
 | [API Reference][api-reference-url] | Complete API documentation |
+| [Skyline (live example)][skyline-url] | Canonical example project: this SDK ingests the Bluesky firehose and writes the analytics entries a TypeScript edge Worker serves live, on one shared interop namespace |
 
 ### Feature Deep Dives
 
@@ -400,6 +414,11 @@ info = expensive_func.cache_info()
 | [Distributed Locking][distributed-locking-url] | Cache stampede prevention |
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
+| [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Process-local invalidation, stale-while-revalidate |
+| [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
+| [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
+| [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
 
 ---
 
@@ -412,7 +431,7 @@ info = expensive_func.cache_info()
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)
 REDIS_URL="redis://localhost:6379"           # Fallback
 
-# CachekitIO SaaS Backend (closed alpha — request access at cachekit.io)
+# CachekitIO SaaS Backend (closed beta — request access at cachekit.io)
 CACHEKIT_API_KEY="your-api-key"             # Required for @cache.io()  # pragma: allowlist secret
 CACHEKIT_API_URL="https://api.cachekit.io"  # Default SaaS endpoint
 
@@ -475,6 +494,7 @@ MIT License - see [LICENSE][license-file-url] for details.
 [uv-url]: https://github.com/astral-sh/uv
 [security-url]: SECURITY.md
 [comparison-url]: docs/comparison.md
+[skyline-url]: https://github.com/cachekit-io/bluesky-thinking
 [getting-started-url]: docs/getting-started.md
 [api-reference-url]: docs/api-reference.md
 [serializer-guide-url]: docs/serializers/index.md
@@ -482,6 +502,11 @@ MIT License - see [LICENSE][license-file-url] for details.
 [distributed-locking-url]: docs/features/distributed-locking.md
 [prometheus-url]: docs/features/prometheus-metrics.md
 [encryption-url]: docs/features/zero-knowledge-encryption.md
+[interop-url]: docs/features/interop-mode.md
+[l1-invalidation-url]: docs/features/l1-invalidation.md
+[reference-caching-url]: docs/features/reference-caching.md
+[rust-serialization-url]: docs/features/rust-serialization.md
+[ssrf-url]: docs/features/ssrf-protection.md
 [contributing-url]: CONTRIBUTING.md
 [license-file-url]: LICENSE
 [github-url]: https://github.com/cachekit-io/cachekit-py

{cachekit-0.17.1 → cachekit-0.19.0}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "maturin"
 
 [project]
 name = "cachekit"
-version = "0.17.1"
-description = "Production-ready Redis caching for Python with intelligent reliability features and Rust-powered performance"
+version = "0.19.0"
+description = "Backend-agnostic caching for Python — intent-based decorators with circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge AES-256-GCM encryption, on a Rust-powered core. Zero-config L1 in-memory; scales to Redis, Memcached, File, or CachekitIO."
 readme = "README.md"
 license = {text = "MIT"}
 authors = [
@@ -31,7 +31,7 @@ keywords = [
     "distributed-locking",
 ]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
@@ -56,7 +56,7 @@ dependencies = [
     "redis[hiredis]>=4.0.0",
     # Configuration and validation
     "pydantic>=2.0.0",
-    "pydantic-settings>=2.0.0",
+    "pydantic-settings>=2.7.0",  # NoDecode (previous_master_keys env parsing) first shipped in 2.7.0
     # Monitoring and observability
     "prometheus-client>=0.22.1",
     "psutil>=7.0.0",
@@ -66,6 +66,22 @@ dependencies = [
     "xxhash>=3.5.0",
     # HTTP client for SaaS backend (cachekit.io)
     "httpx[http2]>=0.28.1",
+    # anyio is transitive via the mandatory httpx dependency above, so it ships
+    # to EVERY install, not just dev. Declared here rather than as a
+    # [tool.uv] constraint because that table is uv-local: it never reaches
+    # requires-dist, so `pip install cachekit` would ignore it. 4.14.2 fixes
+    # GHSA-82r6-8w77-94w6 / CVE-2026-63374 (IDNA-2003 hostname encoding lets a
+    # hijacked connection to an internationalised domain pass TLS certificate
+    # validation; CVSS 9.3), GHSA-5p39-cfhj-2xmp / CVE-2026-64847 (undrained
+    # process-pool stderr pipe deadlocks the worker) and GHSA-3w57-8xmc-8v26 /
+    # CVE-2026-63349 (extra_groups ignored, parent supplementary groups kept).
+    "anyio>=4.14.2",
+    # h2 arrives via the http2 extra on that same mandatory httpx dependency, so
+    # it ships to every install too, and was declared as a [tool.uv] constraint
+    # with the same no-op effect. 4.4.1 fixes GHSA-6hr6-w5qg-qmwg (duplicate Host
+    # headers forwarded across an HTTP/2 -> HTTP/1.1 downgrade — a request
+    # smuggling primitive).
+    "h2>=4.4.1",
 ]
 
 [project.optional-dependencies]
@@ -150,7 +166,6 @@ asyncio_default_fixture_loop_scope = "function"
 addopts = [
     "--strict-markers",
     "--verbose",
-    "--basetemp=/tmp/pytest",
     "--doctest-modules",              # Validate docstring examples
     "--doctest-continue-on-failure",  # Report all doctest failures, not just first
     "--markdown-docs",                # Validate markdown documentation examples
@@ -200,8 +215,12 @@ exclude_lines = [
 ]
 
 [dependency-groups]
-dev = [
-    # Testing
+# Core test toolchain — everything tests/unit + tests/critical need on ANY
+# interpreter, including free-threaded CPython: the free-threaded CI lane
+# installs ONLY this group (LAB-511). A dep may live here only if it ships
+# free-threaded wheels or builds cleanly from source on 3.14t; deps that
+# don't (orjson, numpy, pandas, pyarrow) stay in dev below.
+test = [
     "fakeredis>=2.21.0",
     "pytest>=7.0.0",
     "pytest-asyncio>=0.21.0",
@@ -210,6 +229,19 @@ dev = [
     "pytest-markdown-docs>=0.6.0",
     "pytest-redis>=3.0.0",
     "pymemcache>=4.0.0",
+    # Utilities
+    "faker>=20.0.0",
+    "httpx>=0.28.1",
+    "hypothesis>=6.0.0",
+    "requests>=2.33.0; python_version >= '3.10'",
+    "psutil>=5.9.0",
+    "python-dotenv>=1.0.0",
+    "pyyaml>=6.0.3",
+    "pytest-xdist>=3.8.0",
+    "time-machine>=2.19.0",
+]
+dev = [
+    { include-group = "test" },
     # Competitive comparison suite (tests/competitive/ benchmarks cachekit vs these)
     "cachetools>=5.3.0",
     "aiocache>=0.12.0",
@@ -218,14 +250,7 @@ dev = [
     "ruff>=0.6.0",
     # Utilities
     "bashlex>=0.18",
-    "faker>=20.0.0",
-    "httpx>=0.28.1",
-    "hypothesis>=6.0.0",
     "pip-audit>=2.7.0",
-    "requests>=2.33.0; python_version >= '3.10'",
-    "psutil>=5.9.0",
-    "python-dotenv>=1.0.0",
-    "pyyaml>=6.0.3",
     # Data science support (for testing AutoSerializer with numpy/pandas)
     "numpy>=2.0.2",
     "pandas>=1.3.0",
@@ -233,15 +258,17 @@ dev = [
     # OrjsonSerializer support — now the [json] optional extra; kept here so the
     # orjson tests, doctests, and markdown-docs still resolve it in dev/CI.
     "orjson>=3.9.0",
-    "pytest-xdist>=3.8.0",
-    "time-machine>=2.19.0",
 ]
 # Linux CI only - Atheris requires libFuzzer (not available on macOS without building LLVM)
 fuzz = [
     "atheris>=2.3.0",
 ]
 
-# Override vulnerable transitive dependencies
+# Override vulnerable DEV-ONLY transitive dependencies.
+# This table is uv-local: it constrains resolution of this repo's lockfile and
+# never reaches requires-dist, so a floor placed here does NOT protect anyone who
+# runs `pip install cachekit`. A transitive that reaches users belongs in
+# [project] dependencies instead — see the anyio/h2 entries above.
 [tool.uv]
 constraint-dependencies = [
     "urllib3>=2.7.0",
@@ -249,6 +276,7 @@ constraint-dependencies = [
     "werkzeug>=3.1.4",
     # pip is a dev-only transitive dep (pip-audit -> pip-api -> pip). 26.1.2 fixes
     # PYSEC-2026-196 (entry-point path traversal), GHSA-58qw-9mgm-455v (tar/zip
-    # confusion) and GHSA-jp4c-xjxw-mgf9 (self-update import ordering).
-    "pip>=26.1.2",
+    # confusion) and GHSA-jp4c-xjxw-mgf9 (self-update import ordering); 26.2 fixes
+    # PYSEC-2026-3721 (doubly-encoded index URLs install to arbitrary paths).
+    "pip>=26.2",
 ]

{cachekit-0.17.1 → cachekit-0.19.0}/rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cachekit-rs"
-version = "0.17.1"
+version = "0.19.0"
 edition = "2021"
 authors = ["cachekit Contributors"]
 description = "High-performance storage engine for caching with compression and encryption"
@@ -20,11 +20,15 @@ crate-type = ["cdylib", "rlib"]
 
 [dependencies]
 # Compression, checksums, encryption (https://crates.io/crates/cachekit-core)
-cachekit-core = { version = "0.4.0", features = ["compression", "checksum", "messagepack", "encryption"] }
+cachekit-core = { version = "0.5.0", features = ["compression", "checksum", "messagepack", "encryption"] }
 
 # Python integration - optional for Rust-only builds
 pyo3 = { workspace = true, optional = true }
 
+# Wipe the PyO3-side copies of master key material on drop. Only used behind
+# the encryption feature, so gated the same way pyo3 is.
+zeroize = { version = "1", optional = true }
+
 # Feature flags
 [features]
 default = ["python", "compression", "checksum", "messagepack", "encryption"]
@@ -36,7 +40,7 @@ python = ["dep:pyo3"]
 compression = []
 checksum = []
 messagepack = []
-encryption = []
+encryption = ["dep:zeroize"]
 
 [dev-dependencies]
 criterion = { version = "0.5", features = ["html_reports"] }