cachekit 0.21.0__tar.gz → 0.23.0__tar.gz

{cachekit-0.21.0 → cachekit-0.23.0}/Cargo.lock

@@ -280,7 +280,7 @@ dependencies = [
 
 [[package]]
 name = "cachekit-rs"
-version = "0.21.0"
+version = "0.23.0"
 dependencies = [
  "cachekit-core",
  "criterion 0.8.2",

{cachekit-0.21.0 → cachekit-0.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cachekit
-Version: 0.21.0
+Version: 0.23.0
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -28,11 +28,9 @@ Requires-Dist: psutil>=7.0.0
 Requires-Dist: blake3>=1.0.5
 Requires-Dist: msgpack>=1.2.1
 Requires-Dist: xxhash>=3.5.0
-Requires-Dist: httpx[http2]>=0.28.1
-Requires-Dist: anyio>=4.14.2
-Requires-Dist: h2>=4.4.1
+Requires-Dist: urllib3>=2.8.0
 Requires-Dist: numpy>=2.0.2 ; extra == 'data'
-Requires-Dist: pandas>=1.3.0 ; extra == 'data'
+Requires-Dist: pandas>=2.2.2 ; extra == 'data'
 Requires-Dist: pyarrow>=21.0.0 ; extra == 'data'
 Requires-Dist: orjson>=3.9.0 ; extra == 'json'
 Requires-Dist: pymemcache>=4.0.0 ; extra == 'memcached'
@@ -116,7 +114,23 @@ Or with [uv][uv-url] (recommended):
 uv add cachekit
 ```
 
-### Setup (choose a backend)
+### Setup
+
+With nothing configured, `@cache` caches in L1, in process, like `lru_cache`: no backend,
+no connection attempt, no warning.
+
+```python
+from cachekit import cache
+
+@cache  # nothing configured: L1-only, per process
+def expensive_api_call(user_id: int):
+    return fetch_user_data(user_id)
+```
+
+An L1-only cache is not shared between processes, holds values by reference, and is chosen
+at the function's first call, so configure a backend before then.
+
+### Choose a backend
 
 cachekit exposes one decorator API over a pluggable backend abstraction. Pick the
 backend that fits your infrastructure — they're peers behind the same `@cache` API:
@@ -126,7 +140,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
 | CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
-| File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
+| File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / nothing (or `backend=None`) |
 
 ```bash
 # Run Redis locally or use your existing infrastructure
@@ -136,13 +150,16 @@ export REDIS_URL="redis://localhost:6379"
 ```python
 from cachekit import cache
 
-@cache  # Auto-detects backend (defaults to Redis at localhost)
+@cache  # REDIS_URL set: L1 + Redis, shared across processes
 def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-> [!TIP]
-> No Redis? No worries! Use `@cache(backend=None)` for L1-only in-memory caching, like `lru_cache`, but with all the bells and whistles.
+> [!WARNING]
+> Earlier releases connected to `redis://localhost:6379` when nothing was configured. To keep
+> that Redis, set `REDIS_URL=redis://localhost:6379` (or `CACHEKIT_REDIS_URL`). `@cache.secure`,
+> `encryption=True` and `interop=` still need a backend and still fall back to localhost Redis;
+> see [Backend Resolution Priority](docs/backends/README.md#backend-resolution-priority).
 
 ### More Backends
 
@@ -163,6 +180,8 @@ def expensive_api_call(user_id: int):
 
 *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
+How fresh a cachekit.io read is, and how long a deleted project's data stays readable: [Consistency and Deletion](https://docs.cachekit.io/concepts/consistency/).
+
 </details>
 
 <details>
@@ -226,26 +245,29 @@ Setting `CACHEKIT_MASTER_KEY` instead of passing `master_key=` means every prese
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
 | L1 SWR (L1-only mode) | - | ✅ | - | ✅ | - |
-| L1 Invalidation | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | -¹ | - | ✅ | ✅ |
-| Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
+| Backend unreachable² | Function runs, no error | Function runs, no error | Function runs, no error | Function runs, no error | Function runs, no error |
 | **Use Case** | High throughput | Local debugging | Deterministic tests | Production reliability | Compliance/security |
 
 > ¹ `@cache.dev` exports no Prometheus metrics except `circuit_breaker_state`, which is recorded for every function whose circuit breaker is enabled.
 >
-> 🔒 `@cache.secure` forces `integrity_checking=True` — passing `integrity_checking=False` raises `ConfigurationError` at decoration, including as an override next to `config=DecoratorConfig.secure(...)`. `@cache.secure` also rejects `config=`; the RORO form is `@cache(config=DecoratorConfig.secure(...))`.
+> ² A backend that is down or unreachable never raises to the caller, on any preset (`@cache.io` included): the call logs the failure and runs your function. What gets cached meanwhile is in [Connection Errors](docs/error-codes.md#connection-errors).
+>
+> 🔒 `@cache.secure` forces `integrity_checking=True` — passing `integrity_checking=False` raises `ConfigurationError` at decoration, including as an override next to `config=DecoratorConfig.secure(...)`. Its encryption is fixed the same way: `encryption=` raises `ConfigurationError` on `@cache.secure` and next to `config=DecoratorConfig.secure(...)`, so pass `fail_closed=` and the other encryption options to the preset itself. `@cache.secure` also rejects `config=`; the RORO form is `@cache(config=DecoratorConfig.secure(...))`.
 >
 > **Default TTL** follows the cross-SDK [intent-preset spec](https://github.com/cachekit-io/protocol/blob/main/spec/intent-presets.md#default-ttl) (`@cache.io` 3600 s) — the same numbers as cachekit-rs and cachekit-ts. `ttl=` overrides it; `ttl=None` is the explicit never-expire opt-in ([details](docs/configuration.md#intent-presets)).
 >
+> **Cross-process L1 eviction** is not a preset feature: every preset's `invalidate_cache()` deletes from L1 and L2 alike, and evicting other processes' L1 copies is one process-wide opt-in, `CACHEKIT_INVALIDATION_LISTENER_ENABLED` ([L1 invalidation](docs/features/l1-invalidation.md#cross-process-l1-eviction)).
+>
 > **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
 >
-> **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
+> **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a Python-only, SDK-local preset: a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
 <summary><strong>Additional Presets: <code>@cache.dev</code> and <code>@cache.test</code></strong></summary>
 
-See the comparison table above for the exact feature set of each preset.
+`@cache.dev` and `@cache.test` are Python-only, SDK-local presets. See the comparison table above for the exact feature set of each preset.
 
 ```python
 # Development: verbose logging, integrity checks on, Prometheus off except circuit_breaker_state
@@ -298,9 +320,10 @@ def test_cached_function():
 
 - Circuit breaker with graceful degradation
 - Connection pooling with thread affinity (+28% throughput)
+- CachekitIO keeps idle connections pooled until the server closes them, with TCP keepalive probes, so a request after a pause skips a new TLS handshake
 - Distributed locking prevents cache stampedes
 - Pluggable backend abstraction (Redis, CachekitIO, File, Memcached, custom)
-- Untrusted-decode bounds: nesting depth and header-declared allocation are capped on every cache read (a forged entry is a bounded cache miss), verified against the protocol's shared [`decode-bounds.json`](https://github.com/cachekit-io/protocol/blob/2736a81f2f853cf08c5563c0fe7c8361331fa3ad/test-vectors/decode-bounds.json) vectors
+- Untrusted-decode bounds: nesting depth and header-declared allocation are capped on every cache read (a forged entry is a bounded cache miss), verified against the protocol's shared [`decode-bounds.json`](https://github.com/cachekit-io/protocol/blob/42ea601f3c1656df0a06904afa2406604f43f57d/test-vectors/decode-bounds.json) vectors
 
 > [!NOTE]
 > All reliability features are **enabled by default** with `@cache.production`. Use `@cache.minimal` to disable them for maximum throughput.
@@ -309,10 +332,10 @@ def test_cached_function():
 
 | Serializer | Speed | Use Case |
 |:-----------|:-----:|:---------|
-| **StandardSerializer** | ★★★★☆ | General Python types, NumPy, Pandas |
+| **StandardSerializer** | ★★★★☆ | General Python types; not NumPy arrays or pandas objects |
 | **OrjsonSerializer** | ★★★★★ | JSON APIs (2-5x faster than stdlib) — requires `cachekit[json]` |
-| **ArrowSerializer** | ★★★★★ | Large DataFrames (6-23x faster for 10K+ rows) |
-| **EncryptionWrapper** | ★★★★☆ | Wraps any serializer with AES-256-GCM |
+| **ArrowSerializer** | — | pandas DataFrames (columnar, exact round trip) |
+| **+ Encryption** | ★★★★☆ | Any serializer above, AES-256-GCM encrypted: `@cache.secure(master_key=..., serializer=...)` |
 
 <details>
 <summary><strong>Serializer Examples</strong></summary>
@@ -325,13 +348,13 @@ from cachekit.serializers import OrjsonSerializer, ArrowSerializer
 def get_api_response(endpoint: str):
     return {"status": "success", "data": fetch_api(endpoint)}
 
-# Zero-copy DataFrames for large datasets
+# Columnar DataFrames (Arrow IPC, zstd-compressed by default)
 @cache(serializer=ArrowSerializer())
 def get_large_dataset(date: str):
     return pd.read_csv(f"data/{date}.csv")
 ```
 
-Encrypted DataFrames go through `@cache.secure`, which takes any serializer. A file backend keeps this example self-contained; production uses Redis or cachekit.io:
+Encrypted DataFrames go through `@cache.secure`, which takes any serializer whose class declares `cross_sdk_compatible = True` ([details](docs/serializers/encryption.md#composability)). A file backend keeps this example self-contained; production uses Redis or cachekit.io:
 
 ```python
 import tempfile
@@ -451,7 +474,9 @@ free-threaded 3.14 with the GIL verified disabled (CI job
 `test-freethreaded`), and the Rust extension declares free-threaded safety
 (`gil_used = false`). Free-threaded wheels are **not yet published** and
 free-threaded builds are not officially supported — blocked upstream on
-orjson (no free-threaded wheels) and hiredis (re-enables the GIL on import). See
+orjson (no free-threaded wheels) and hiredis (re-enables the GIL on import;
+cachekit loads redis-py only for its Redis backend, and keeps hiredis out there,
+so redis-py uses its pure-Python parser). See
 [measured performance results](docs/free-threading.md#measured-performance) and the
 full concurrency audit: [docs/free-threading.md](docs/free-threading.md).
 
@@ -502,7 +527,7 @@ info = expensive_func.cache_info()
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
 | [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
-| [L1 Invalidation & SWR][l1-invalidation-url] | Invalidation scope (incl. cross-process whole-function on tenant-scoped Redis from the environment or `RedisBackendProvider`), stale-while-revalidate |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Invalidation scope (incl. cross-process whole-function on tenant-scoped Redis from the environment or `RedisBackendProvider`), opt-in cross-process L1 eviction, stale-while-revalidate |
 | [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
 | [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
 | [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
@@ -517,7 +542,8 @@ info = expensive_func.cache_info()
 # Backend selection: set exactly ONE of CACHEKIT_REDIS_URL, CACHEKIT_API_KEY,
 # CACHEKIT_MEMCACHED_SERVERS, CACHEKIT_FILE_CACHE_DIR. Two or more is a ConfigurationError at
 # first call, and decorators relying on env auto-detection run uncached (docs/backends/README.md).
-# REDIS_URL is only a fallback and never conflicts.
+# REDIS_URL is only a fallback and never conflicts. With none of them set, decorators cache
+# L1-only, in process (encrypted and interop decorators still use localhost Redis).
 
 # Redis Connection (priority: CACHEKIT_REDIS_URL > REDIS_URL)
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)

{cachekit-0.21.0 → cachekit-0.23.0}/README.md

@@ -60,7 +60,23 @@ Or with [uv][uv-url] (recommended):
 uv add cachekit
 ```
 
-### Setup (choose a backend)
+### Setup
+
+With nothing configured, `@cache` caches in L1, in process, like `lru_cache`: no backend,
+no connection attempt, no warning.
+
+```python
+from cachekit import cache
+
+@cache  # nothing configured: L1-only, per process
+def expensive_api_call(user_id: int):
+    return fetch_user_data(user_id)
+```
+
+An L1-only cache is not shared between processes, holds values by reference, and is chosen
+at the function's first call, so configure a backend before then.
+
+### Choose a backend
 
 cachekit exposes one decorator API over a pluggable backend abstraction. Pick the
 backend that fits your infrastructure — they're peers behind the same `@cache` API:
@@ -70,7 +86,7 @@ backend that fits your infrastructure — they're peers behind the same `@cache`
 | Redis | Self-hosted, full control | `REDIS_URL` / `CACHEKIT_REDIS_URL` |
 | CachekitIO | Managed, zero-ops (beta) | `CACHEKIT_API_KEY` |
 | Memcached | High-throughput, existing infra | `CACHEKIT_MEMCACHED_SERVERS` |
-| File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / `backend=None` |
+| File / L1-only | Local dev, tests, no external deps | `CACHEKIT_FILE_CACHE_DIR` / nothing (or `backend=None`) |
 
 ```bash
 # Run Redis locally or use your existing infrastructure
@@ -80,13 +96,16 @@ export REDIS_URL="redis://localhost:6379"
 ```python
 from cachekit import cache
 
-@cache  # Auto-detects backend (defaults to Redis at localhost)
+@cache  # REDIS_URL set: L1 + Redis, shared across processes
 def expensive_api_call(user_id: int):
     return fetch_user_data(user_id)
 ```
 
-> [!TIP]
-> No Redis? No worries! Use `@cache(backend=None)` for L1-only in-memory caching, like `lru_cache`, but with all the bells and whistles.
+> [!WARNING]
+> Earlier releases connected to `redis://localhost:6379` when nothing was configured. To keep
+> that Redis, set `REDIS_URL=redis://localhost:6379` (or `CACHEKIT_REDIS_URL`). `@cache.secure`,
+> `encryption=True` and `interop=` still need a backend and still fall back to localhost Redis;
+> see [Backend Resolution Priority](docs/backends/README.md#backend-resolution-priority).
 
 ### More Backends
 
@@ -107,6 +126,8 @@ def expensive_api_call(user_id: int):
 
 *cachekit.io is in closed beta — [request access](https://cachekit.io) to get started.*
 
+How fresh a cachekit.io read is, and how long a deleted project's data stays readable: [Consistency and Deletion](https://docs.cachekit.io/concepts/consistency/).
+
 </details>
 
 <details>
@@ -170,26 +191,29 @@ Setting `CACHEKIT_MASTER_KEY` instead of passing `master_key=` means every prese
 | Integrity Checking | - | ✅ | - | ✅ | ✅ 🔒 |
 | Encryption | - | - | - | - | ✅ Required |
 | L1 SWR (L1-only mode) | - | ✅ | - | ✅ | - |
-| L1 Invalidation | - | - | - | ✅ | ✅ |
 | Prometheus Metrics | - | -¹ | - | ✅ | ✅ |
-| Tracing | - | ✅ | - | ✅ | ✅ |
 | Structured Logging | - | ✅ | - | ✅ | ✅ |
+| Backend unreachable² | Function runs, no error | Function runs, no error | Function runs, no error | Function runs, no error | Function runs, no error |
 | **Use Case** | High throughput | Local debugging | Deterministic tests | Production reliability | Compliance/security |
 
 > ¹ `@cache.dev` exports no Prometheus metrics except `circuit_breaker_state`, which is recorded for every function whose circuit breaker is enabled.
 >
-> 🔒 `@cache.secure` forces `integrity_checking=True` — passing `integrity_checking=False` raises `ConfigurationError` at decoration, including as an override next to `config=DecoratorConfig.secure(...)`. `@cache.secure` also rejects `config=`; the RORO form is `@cache(config=DecoratorConfig.secure(...))`.
+> ² A backend that is down or unreachable never raises to the caller, on any preset (`@cache.io` included): the call logs the failure and runs your function. What gets cached meanwhile is in [Connection Errors](docs/error-codes.md#connection-errors).
+>
+> 🔒 `@cache.secure` forces `integrity_checking=True` — passing `integrity_checking=False` raises `ConfigurationError` at decoration, including as an override next to `config=DecoratorConfig.secure(...)`. Its encryption is fixed the same way: `encryption=` raises `ConfigurationError` on `@cache.secure` and next to `config=DecoratorConfig.secure(...)`, so pass `fail_closed=` and the other encryption options to the preset itself. `@cache.secure` also rejects `config=`; the RORO form is `@cache(config=DecoratorConfig.secure(...))`.
 >
 > **Default TTL** follows the cross-SDK [intent-preset spec](https://github.com/cachekit-io/protocol/blob/main/spec/intent-presets.md#default-ttl) (`@cache.io` 3600 s) — the same numbers as cachekit-rs and cachekit-ts. `ttl=` overrides it; `ttl=None` is the explicit never-expire opt-in ([details](docs/configuration.md#intent-presets)).
 >
+> **Cross-process L1 eviction** is not a preset feature: every preset's `invalidate_cache()` deletes from L1 and L2 alike, and evicting other processes' L1 copies is one process-wide opt-in, `CACHEKIT_INVALIDATION_LISTENER_ENABLED` ([L1 invalidation](docs/features/l1-invalidation.md#cross-process-l1-eviction)).
+>
 > **L1 SWR** (within-TTL background refresh) runs only in L1-only mode (`backend=None`) — with a backend configured it has no effect. `@cache.io` additionally ships past-TTL SWR via `stale_ttl` ([docs](docs/configuration.md#stale-while-revalidate-stale_ttl)).
 >
-> **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
+> **`@cache.io()`** mirrors `@cache.production` (full reliability + observability) but routes to the managed CachekitIO SaaS backend instead of Redis. **`@cache.local()`** is a Python-only, SDK-local preset: a separate in-process path backed by `ObjectCache` (raw object references, entry-count LRU, no serialization) — the reliability and encryption features listed above do not apply to it.
 
 <details>
 <summary><strong>Additional Presets: <code>@cache.dev</code> and <code>@cache.test</code></strong></summary>
 
-See the comparison table above for the exact feature set of each preset.
+`@cache.dev` and `@cache.test` are Python-only, SDK-local presets. See the comparison table above for the exact feature set of each preset.
 
 ```python
 # Development: verbose logging, integrity checks on, Prometheus off except circuit_breaker_state
@@ -242,9 +266,10 @@ def test_cached_function():
 
 - Circuit breaker with graceful degradation
 - Connection pooling with thread affinity (+28% throughput)
+- CachekitIO keeps idle connections pooled until the server closes them, with TCP keepalive probes, so a request after a pause skips a new TLS handshake
 - Distributed locking prevents cache stampedes
 - Pluggable backend abstraction (Redis, CachekitIO, File, Memcached, custom)
-- Untrusted-decode bounds: nesting depth and header-declared allocation are capped on every cache read (a forged entry is a bounded cache miss), verified against the protocol's shared [`decode-bounds.json`](https://github.com/cachekit-io/protocol/blob/2736a81f2f853cf08c5563c0fe7c8361331fa3ad/test-vectors/decode-bounds.json) vectors
+- Untrusted-decode bounds: nesting depth and header-declared allocation are capped on every cache read (a forged entry is a bounded cache miss), verified against the protocol's shared [`decode-bounds.json`](https://github.com/cachekit-io/protocol/blob/42ea601f3c1656df0a06904afa2406604f43f57d/test-vectors/decode-bounds.json) vectors
 
 > [!NOTE]
 > All reliability features are **enabled by default** with `@cache.production`. Use `@cache.minimal` to disable them for maximum throughput.
@@ -253,10 +278,10 @@ def test_cached_function():
 
 | Serializer | Speed | Use Case |
 |:-----------|:-----:|:---------|
-| **StandardSerializer** | ★★★★☆ | General Python types, NumPy, Pandas |
+| **StandardSerializer** | ★★★★☆ | General Python types; not NumPy arrays or pandas objects |
 | **OrjsonSerializer** | ★★★★★ | JSON APIs (2-5x faster than stdlib) — requires `cachekit[json]` |
-| **ArrowSerializer** | ★★★★★ | Large DataFrames (6-23x faster for 10K+ rows) |
-| **EncryptionWrapper** | ★★★★☆ | Wraps any serializer with AES-256-GCM |
+| **ArrowSerializer** | — | pandas DataFrames (columnar, exact round trip) |
+| **+ Encryption** | ★★★★☆ | Any serializer above, AES-256-GCM encrypted: `@cache.secure(master_key=..., serializer=...)` |
 
 <details>
 <summary><strong>Serializer Examples</strong></summary>
@@ -269,13 +294,13 @@ from cachekit.serializers import OrjsonSerializer, ArrowSerializer
 def get_api_response(endpoint: str):
     return {"status": "success", "data": fetch_api(endpoint)}
 
-# Zero-copy DataFrames for large datasets
+# Columnar DataFrames (Arrow IPC, zstd-compressed by default)
 @cache(serializer=ArrowSerializer())
 def get_large_dataset(date: str):
     return pd.read_csv(f"data/{date}.csv")
 ```
 
-Encrypted DataFrames go through `@cache.secure`, which takes any serializer. A file backend keeps this example self-contained; production uses Redis or cachekit.io:
+Encrypted DataFrames go through `@cache.secure`, which takes any serializer whose class declares `cross_sdk_compatible = True` ([details](docs/serializers/encryption.md#composability)). A file backend keeps this example self-contained; production uses Redis or cachekit.io:
 
 ```python
 import tempfile
@@ -395,7 +420,9 @@ free-threaded 3.14 with the GIL verified disabled (CI job
 `test-freethreaded`), and the Rust extension declares free-threaded safety
 (`gil_used = false`). Free-threaded wheels are **not yet published** and
 free-threaded builds are not officially supported — blocked upstream on
-orjson (no free-threaded wheels) and hiredis (re-enables the GIL on import). See
+orjson (no free-threaded wheels) and hiredis (re-enables the GIL on import;
+cachekit loads redis-py only for its Redis backend, and keeps hiredis out there,
+so redis-py uses its pure-Python parser). See
 [measured performance results](docs/free-threading.md#measured-performance) and the
 full concurrency audit: [docs/free-threading.md](docs/free-threading.md).
 
@@ -446,7 +473,7 @@ info = expensive_func.cache_info()
 | [Prometheus Metrics][prometheus-url] | Built-in observability |
 | [Zero-Knowledge Encryption][encryption-url] | Client-side security |
 | [Interop Mode][interop-url] | Cross-SDK cache sharing with cachekit-ts/rs |
-| [L1 Invalidation & SWR][l1-invalidation-url] | Invalidation scope (incl. cross-process whole-function on tenant-scoped Redis from the environment or `RedisBackendProvider`), stale-while-revalidate |
+| [L1 Invalidation & SWR][l1-invalidation-url] | Invalidation scope (incl. cross-process whole-function on tenant-scoped Redis from the environment or `RedisBackendProvider`), opt-in cross-process L1 eviction, stale-while-revalidate |
 | [Reference Caching][reference-caching-url] | `@cache.local()` for non-serializable objects |
 | [Rust Serialization][rust-serialization-url] | ByteStorage layer: LZ4, xxHash3, AES-256-GCM |
 | [SSRF Protection][ssrf-url] | URL allowlisting for the CachekitIO backend |
@@ -461,7 +488,8 @@ info = expensive_func.cache_info()
 # Backend selection: set exactly ONE of CACHEKIT_REDIS_URL, CACHEKIT_API_KEY,
 # CACHEKIT_MEMCACHED_SERVERS, CACHEKIT_FILE_CACHE_DIR. Two or more is a ConfigurationError at
 # first call, and decorators relying on env auto-detection run uncached (docs/backends/README.md).
-# REDIS_URL is only a fallback and never conflicts.
+# REDIS_URL is only a fallback and never conflicts. With none of them set, decorators cache
+# L1-only, in process (encrypted and interop decorators still use localhost Redis).
 
 # Redis Connection (priority: CACHEKIT_REDIS_URL > REDIS_URL)
 CACHEKIT_REDIS_URL="redis://localhost:6379"  # Primary (preferred)

{cachekit-0.21.0 → cachekit-0.23.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "cachekit"
-version = "0.21.0"
+version = "0.23.0"
 description = "Backend-agnostic caching for Python — intent-based decorators with circuit breaker, distributed locking, Prometheus metrics, and optional zero-knowledge AES-256-GCM encryption, on a Rust-powered core. Zero-config L1 in-memory; scales to Redis, Memcached, File, or CachekitIO."
 readme = "README.md"
 license = {text = "MIT"}
@@ -71,31 +71,19 @@ dependencies = [
     "blake3>=1.0.5",
     "msgpack>=1.2.1",
     "xxhash>=3.5.0",
-    # HTTP client for SaaS backend (cachekit.io)
-    "httpx[http2]>=0.28.1",
-    # anyio is transitive via the mandatory httpx dependency above, so it ships
-    # to EVERY install, not just dev. Declared here rather than as a
-    # [tool.uv] constraint because that table is uv-local: it never reaches
-    # requires-dist, so `pip install cachekit` would ignore it. 4.14.2 fixes
-    # GHSA-82r6-8w77-94w6 / CVE-2026-63374 (IDNA-2003 hostname encoding lets a
-    # hijacked connection to an internationalised domain pass TLS certificate
-    # validation; CVSS 9.3), GHSA-5p39-cfhj-2xmp / CVE-2026-64847 (undrained
-    # process-pool stderr pipe deadlocks the worker) and GHSA-3w57-8xmc-8v26 /
-    # CVE-2026-63349 (extra_groups ignored, parent supplementary groups kept).
-    "anyio>=4.14.2",
-    # h2 arrives via the http2 extra on that same mandatory httpx dependency, so
-    # it ships to every install too, and was declared as a [tool.uv] constraint
-    # with the same no-op effect. 4.4.1 fixes GHSA-6hr6-w5qg-qmwg (duplicate Host
-    # headers forwarded across an HTTP/2 -> HTTP/1.1 downgrade — a request
-    # smuggling primitive).
-    "h2>=4.4.1",
+    # HTTP client for the SaaS backend (cachekit.io). It has no dependencies of its own. 2.8.0 fixes
+    # GHSA-8988-9cw3-xx77 (HTTPS proxy TLS config ignored), GHSA-gh4c-6fx4-qh6g (chunked deflate
+    # infinite loop) and GHSA-vxq7-64xx-v4gw (unbounded chunk-size line buffering).
+    "urllib3>=2.8.0",
 ]
 
 [project.optional-dependencies]
 # User-facing optional features only - dev deps are in [dependency-groups]
 data = [
     "numpy>=2.0.2",
-    "pandas>=1.3.0",
+    # 2.2.2 is the first pandas release built against numpy 2, so an older pandas cannot install
+    # beside the numpy floor above.
+    "pandas>=2.2.2",
     "pyarrow>=21.0.0",
 ]
 json = [
@@ -149,7 +137,6 @@ ignore = [
 "__init__.py" = ["F401"]
 "tests/**/*" = ["S101", "S105", "S110", "S112", "S311", "D", "F841", "N802"]
 "src/cachekit/logging.py" = ["S110"]  # Logging errors would create recursion
-"src/cachekit/monitoring/pool_monitor.py" = ["S110"]  # Monitoring errors should be silent
 "src/cachekit/reliability/async_metrics.py" = ["S101"]  # Internal invariant checks
 "src/cachekit/serializers/__init__.py" = ["S101"]  # Module-level validation
 "src/cachekit/serializers/standard_serializer.py" = ["S110"]  # Fallback deserialization patterns
@@ -238,7 +225,6 @@ test = [
     "pymemcache>=4.0.0",
     # Utilities
     "faker>=20.0.0",
-    "httpx>=0.28.1",
     "hypothesis>=6.0.0",
     "requests>=2.33.0; python_version >= '3.10'",
     "psutil>=5.9.0",
@@ -246,6 +232,7 @@ test = [
     "pyyaml>=6.0.3",
     "pytest-xdist>=3.8.0",
     "time-machine>=2.19.0",
+    "h11>=0.16.0",
 ]
 dev = [
     { include-group = "test" },
@@ -260,7 +247,7 @@ dev = [
     "pip-audit>=2.7.0",
     # Data science support (for testing AutoSerializer with numpy/pandas)
     "numpy>=2.0.2",
-    "pandas>=1.3.0",
+    "pandas>=2.2.2",
     "pyarrow>=21.0.0",
     # OrjsonSerializer support — now the [json] optional extra; kept here so the
     # orjson tests, doctests, and markdown-docs still resolve it in dev/CI.
@@ -275,15 +262,9 @@ fuzz = [
 # This table is uv-local: it constrains resolution of this repo's lockfile and
 # never reaches requires-dist, so a floor placed here does NOT protect anyone who
 # runs `pip install cachekit`. A transitive that reaches users belongs in
-# [project] dependencies instead — see the anyio/h2 entries above.
+# [project] dependencies instead — see the urllib3 entry above.
 [tool.uv]
 constraint-dependencies = [
-    # urllib3 is a dev-only transitive dep (requests -> urllib3; requests is a
-    # dev dependency and also arrives via pip-audit).
-    # 2.8.0 fixes GHSA-8988-9cw3-xx77 (HTTPS proxy TLS config ignored),
-    # GHSA-gh4c-6fx4-qh6g (chunked deflate infinite loop) and
-    # GHSA-vxq7-64xx-v4gw (unbounded chunk-size line buffering).
-    "urllib3>=2.8.0",
     "fonttools>=4.60.2",
     "werkzeug>=3.1.4",
     # pip is a dev-only transitive dep (pip-audit -> pip-api -> pip). 26.1.2 fixes

{cachekit-0.21.0 → cachekit-0.23.0}/rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cachekit-rs"
-version = "0.21.0"
+version = "0.23.0"
 edition = "2021"
 authors = ["cachekit Contributors"]
 description = "High-performance storage engine for caching with compression and encryption"