settfex 0.26.0__tar.gz → 0.26.1__tar.gz

{settfex-0.26.0 → settfex-0.26.1}/.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.
@@ -63,7 +63,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.

{settfex-0.26.0 → settfex-0.26.1}/.github/workflows/dependency-drift.yml

@@ -40,7 +40,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.
@@ -138,14 +138,6 @@ jobs:
             echo "  A uv bump is its own change with its own gates — Dependency policy, CLAUDE.md."
             echo "- **hatchling** (build backend) is unconstrained in [build-system] and absent from"
             echo "  uv.lock — releases resolve whatever is current at build time."
-            echo "- **diskcache** upstream is dormant (last release 2023, last commit 2024) and is"
-            echo "  at its last release — so its advisory **PYSEC-2026-2447 / CVE-2025-69872**"
-            echo "  (pickle deserialization; empty Fix Versions because no fixed release exists)"
-            echo "  cannot be cleared by a bump. It is the only flagged **runtime** dependency —"
-            echo "  everything else pip-audit reports is dev/extras. Exploiting it needs write"
-            echo "  access to the cache dir, which settfex now creates \`0700\` and tightens in place"
-            echo "  (2026-09-19) -- so the exposure is mitigated and the row below is expected to"
-            echo "  stay. Do not re-triage it monthly; revisit only if upstream ships a fix."
             echo "- Bumps follow the **Dependency policy** in CLAUDE.md: one package per commit, full"
             echo "  gates each, and curl_cffi additionally requires the live-probe protocol"
             echo '  (`uv run pytest -m integration --no-cov` before/after with cache clear).'

{settfex-0.26.0 → settfex-0.26.1}/.github/workflows/live-smoke.yml

@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned by hand like every other setup-uv step; the monthly drift report checks them all.
           version: "0.12.17"

{settfex-0.26.0 → settfex-0.26.1}/.github/workflows/pre-commit.yml

@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.

{settfex-0.26.0 → settfex-0.26.1}/.github/workflows/release.yml

@@ -87,7 +87,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.
@@ -114,7 +114,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.

{settfex-0.26.0 → settfex-0.26.1}/.github/workflows/security.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.
@@ -50,7 +50,7 @@ jobs:
       - uses: actions/checkout@v7
 
       # setup-uv stopped publishing floating major tags at v8 — pin the exact version.
-      - uses: astral-sh/setup-uv@v10.1.0
+      - uses: astral-sh/setup-uv@v10.2.0
         with:
           # Pinned for reproducible builds — "latest" silently adopts whatever uv shipped
           # that day. Dependabot does not bump action *inputs*, so bump this by hand.
@@ -64,5 +64,6 @@ jobs:
       # Non-blocking: surfaces dependency CVEs for triage without blocking PRs.
       # Some advisories are transitive or not-yet-fixed upstream (e.g. no fix
       # released), so review results and bump deps in a dedicated PR.
+      # (0.26.1 removed diskcache, so its PYSEC-2026-2447 ignore is gone too: nothing is ignored.)
       - run: uv run pip-audit --desc
         continue-on-error: true

{settfex-0.26.0 → settfex-0.26.1}/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-11-02
+
+**Security: settfex no longer depends on `diskcache`, and nothing it caches is ever unpickled.**
+The same fix is released for the older lines that consumers still pin, as 0.17.1, 0.15.1 and
+0.3.1, so each can take a patch bump instead of migrating across 0.24.0.
+
+### Security
+
+- **The session cache no longer unpickles anything, and `diskcache` is no longer a dependency**
+  (`settfex.utils.session_cache`). `diskcache` reads cached values back with pickle
+  (PYSEC-2026-2447 / CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v). It has no fixed release, and upstream
+  has been dormant since 2023, so anyone able to write into the cache directory could execute code
+  in the process that read it. Every consumer's pip-audit flagged it on a runtime dependency.
+  - The store is now stdlib `sqlite3` holding JSON text (`sessions.sqlite3`, WAL, created `0600`
+    inside the `0700` directory). A row that is not a JSON object is a cache miss, never code.
+  - The pre-0.26.1 `cache.db` is never opened, so it is never unpickled. A session warms up once
+    after the upgrade, and an INFO line says the old file can be deleted.
+  - `SessionCache`'s API is unchanged (the same methods and parameters), and so is
+    `SessionManager`.
+  - settfex's own Security workflow no longer needs an ignore. This release also moves four
+    packages that `pip-audit` flagged in `uv.lock`, one commit each: `certifi` 2026.10.23 (a
+    `curl-cffi` dependency), plus `virtualenv` 21.14.13, `filelock` 4.2.6 and `msgpack` 1.2.4
+    (dev tools only). After these bumps `pip-audit` reports no known vulnerabilities. None of them
+    is a floor in `pyproject.toml`, so the only change to the published wheel's requirements is
+    the removal of `diskcache`.
+
 ## [0.26.0] - 2026-10-08
 
 **SEC Form 59 arrives: directors' and executives' trades, with the report behind each one.**

{settfex-0.26.0 → settfex-0.26.1}/CLAUDE.md

@@ -549,7 +549,7 @@ See [`CHANGELOG.md`](CHANGELOG.md) for the full, versioned release history — t
 - **The stock-info endpoint has NO language dimension, and its timestamp is nanosecond-precision:** `?lang=en` and `?lang=th` return byte-identical payloads (both `nameEN` and `nameTH` always present), so `fetch_stock_info()` deliberately takes **no** `lang` argument — do not add one "for consistency" (same shape as the analyst-consensus table endpoint). Separately, `marketDateTime` carries **9 fractional digits** (`...783886192+07:00`) — unique among the SET endpoints here; pydantic and `datetime.fromisoformat` both truncate to microseconds on 3.11+, and a test pins that it is truncated rather than rejected.
 - **Over plain HTTP the quote block serves the BEST bid/offer level only:** `bids`/`offers` come back with one entry each, not the 5-level ladder shown on the set.or.th page (that depth is websocket-fed). Ladder `price` arrives as a **string** (`"44.75"`) and is coerced by the shared `BidOffer` model, which `stock/info.py` imports from `index/composition.py` rather than duplicating.
 - **A stock-info 404 means "unknown symbol" — unlike the DR-profile 404:** `/api/set/stock/{sym}/info` answers an unknown ticker with HTTP 404 `{"message": "Invalid Stock Name"}` and resolves every real one, so `SymbolNotFoundError` is raised **with** the "did you mean?" suggester enabled (the opposite of `/api/set/dr/{sym}/profile`, which 404s for valid non-DRs and must pass `suggest=False`).
-- **The session cache dir is forced to `0700`, and a caller-supplied one is deliberately NOT — do not "make it consistent":** `diskcache` reads cached values back with **pickle**, so write access to `~/.settfex/cache` is code execution in the caller's process (CVE-2025-69872 / PYSEC-2026-2447 — **no fixed release**, upstream's last release was 2023; it is the only advisory `pip-audit` still reports and the only one on a *runtime* dependency). `_secure_cache_dir()` therefore creates the directory `0700` and **chmods an existing default one in place** (a real side effect on the user's filesystem, logged at INFO). A directory the caller passed is created `0700` when new but, if it already exists group/other-writable, is **reported and left alone** — a shared cache can be deliberate, and silently breaking a multi-account layout is worse than the warning. Windows is skipped outright (POSIX bits do not express this), and every permission step is inside `try/except OSError` because a cache that cannot be chmod'd is still a usable cache. Tests pin all four behaviours in `tests/utils/test_session_cache.py`.
+- **The session cache no longer unpickles (0.26.1) — and the `0700` rule stays, for a different reason:** until 0.26.1 the store was `diskcache`, which reads values back with **pickle** (CVE-2025-69872 / PYSEC-2026-2447, **no fixed release**, upstream dormant since 2023), so write access to `~/.settfex/cache` was code execution in the caller's process, and every consumer's pip-audit flagged it on a *runtime* dependency. `settfex/utils/session_cache.py` is now stdlib **`sqlite3` holding JSON text** (`sessions.sqlite3`, WAL, created `0600`): `json.loads` on read, a row that is not a JSON object is a miss, and the old `cache.db` is **never opened** (one extra warm-up after upgrading; an INFO line says it can be deleted). The public API is unchanged. **Do not reintroduce a pickling store.** The directory rule is unchanged because the cookies are credentials: `_secure_cache_dir()` creates it `0700` and **chmods an existing default one in place** (logged at INFO); a directory the caller passed is created `0700` when new but, if it already exists group/other-writable, is **reported and left alone** — a shared cache can be deliberate. Windows is skipped (POSIX bits do not express this), and every permission step is inside `try/except OSError`. Tests pin the permissions, the no-unpickle property and the store's behaviour in `tests/utils/test_session_cache.py`.
 - **SEC serves FOUR download-URL shapes; two of them were silently dropping live filings:** `classify_download_href` knew `Download?FILEID=<path>` and `ipos/Common/IPOSGetFile.aspx?id=`. **Key Financial Ratio** rows use two more, and both fell through to "not a download link" and made the row vanish — live-probed 2026-09-20 on CPALL, both real downloads: (1) recent rows (2026 Q1/Q2) link through `/public/idisc/Views/FinancialStatementDownload?query=<opaque base64>`, answering `application/zip` — a **134 KB zip of the real PDFs**; (2) older rows (2018, 2019) link through `/public/idisc/views/viewdoc?…&TransId=<id>&FileSeq=<n>`, answering `application/.tif` — a **36 KB scan of the original**. Mapped now as `file_id="fsdl:<blob>"` / `"viewdoc:<id>-<n>"`, both `file_kind=None` (neither URL states a type; `Content-Disposition` names the file at download time). After the fix, CPALL 2015-2026 returns **177 documents with `completeness()` exact in all five categories** — `key_financial_ratio` was `(13, 15)`. ⚠️ **Three things this should teach the next reader.** (a) **It falsifies the reporting issue's own finding:** its corpus scan of 39 captured pages found *zero* natural instances of a dropped row and stated P1 "has not been observed in the wild"; the first two live runs of the new accounting found four. A captured corpus can only show what was captured. (b) **The window is load-bearing:** a narrow recent window passed clean while the 2018/2019 rows were being dropped — **old filings use old URL shapes**, so a probe that only checks recent data cannot see them. (c) **Do NOT generalise the allowlist** into "any link under /public/idisc/ with a query is a download": the "display all results" ViewMore link has exactly that shape, and would become a phantom filing in every truncated section. Expect the list to grow; `ListingAccounting.no_link` is the mechanism that makes the next one visible, and a test pins the ViewMore link as not-a-download. Note `_fallback_filename` keys on the **colon**, not on an `ipos:` prefix: a real FILEID path never contains one, so every synthetic id is safely excluded from being sliced like a path.
 - **The SEC LISTING path checks its HTTP status now — and a ViewMore failure DEGRADES rather than raising (issue #131):** `_run_search` used to return `post_resp.text` without ever reading `status_code`, so an error page parsed to zero rows and came back as `[]` with `has_losses == False` — indistinguishable from an issuer that filed nothing, and intermittent, so a backfill recorded the window as covered. Evidenced by a real **HTTP 505** from the listing host (2026-09-20). Two rules: non-2xx → `FetchError`; a 2xx body with **no result table and no section heading** → `ParseError`. The content rule is deliberately the weakest one that separates the populations, because the case it must never trip is a **genuinely empty listing** — a test pins it against every page this repo holds. It does **not** key on `ctl00_CPH_pnlControl`: the real ViewMore capture has that id and the trimmed `FS_VIEWMORE_HTML` constant does not, so a panel-id rule would call a legitimate page an error. ⚠️ **The severity ladder differs by leg, on purpose.** The POST leg raises (a total loss — nothing to fall back on). A **ViewMore** page is different: it *replaces* its section's inline rows, so 0.22.0's unconditional replacement meant a failing page **deleted the whole section, inline rows included, in silence**. A broken ViewMore is a *partial* loss, so it now keeps the inline rows, warns, and lets `completeness()` show the shortfall. `_map_rows` additionally refuses a **zero-row** input: within this package that can only be a non-listing body, since every captured page carries at least the placeholder row an empty section serves. ⚠️ **U-7 (0.25.0): a ViewMore page must never REDUCE the row set — and until 0.25.0 a *successful* one could.** Two ways, both silent: (1) a page that mapped to fewer documents than the inline rows replaced them anyway (no comparison), so a short or placeholder-only page deleted rows with `has_losses` still `False`; (2) a page whose `_map_rows` raised (`ParseError`/`IncompleteListingError`) escaped the loop, and the per-code gather then failed the **whole report code**, taking every sibling category's inline rows with it. Both now degrade exactly like an unusable page (`DegradedSection`, inline rows kept). The rule is a **count** (ViewMore docs for the category ≥ inline docs), **not identity** — a superset check by file id would flip the synthetic test pairs and misfire on `fsdl:` ids, which may be minted per request. On the degrade path `reported.update`/`supersede` are skipped, so `is_balanced` holds and the inline page's reported count stays for `completeness()`; on the replace path only the replaced category's reported count moves.
 - **The live Thai `fs-kf` ViewMore page has been answering HTTP 500 since at least 2026-09-20 — an UPSTREAM bug, and it is why the degrade path exists:** probed 3× each, `th/fs-kf` returned 500 every time while `th/fs-norm`, `th/fs-mda` and all three `en/*` returned 200. On 0.22.0 this silently removed CPALL's entire Thai Key Financial Ratio section; now the listing returns 177 documents with `key_financial_ratio: (10, 15)` stated in `completeness()` plus two WARNINGs. **If you see a Thai KFR shortfall, check whether SEC has fixed their page before looking in settfex.**

{settfex-0.26.0 → settfex-0.26.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: settfex
-Version: 0.26.0
+Version: 0.26.1
 Summary: Async Python library for fetching real-time and historical data from the Stock Exchange of Thailand (SET) and Thailand Futures Exchange (TFEX)
 Project-URL: Homepage, https://github.com/lumduan/settfex
 Project-URL: Documentation, https://github.com/lumduan/settfex#readme
@@ -27,7 +27,6 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: curl-cffi>=0.6.0
-Requires-Dist: diskcache>=5.6.0
 Requires-Dist: loguru>=0.7.0
 Requires-Dist: pydantic>=2.0.0
 Provides-Extra: dataframe

{settfex-0.26.0 → settfex-0.26.1}/docs/settfex/utils/session_caching.md

@@ -40,9 +40,9 @@ The `settfex` library uses **disk-based session caching** to dramatically improv
                   │
                   ▼
 ┌─────────────────────────────────────────────────┐
-│  SessionCache (diskcache)                       │
-│  Location: ~/.settfex/cache/                    │
-│  Format: SQLite + pickled data                  │
+│  SessionCache (stdlib sqlite3)                  │
+│  Location: ~/.settfex/cache/sessions.sqlite3    │
+│  Format: SQLite rows holding JSON text          │
 │  TTL: 1 hour (configurable)                     │
 │  Keys:                                          │
 │    - set_session_chrome120                      │
@@ -269,16 +269,18 @@ await manager.ensure_initialized()
 The cache directory is created **`0700`** (owner only), and an existing `~/.settfex/cache` left
 looser by an earlier version is tightened in place on the next run, with a log line saying so.
 
-Two reasons, and the second is the sharp one:
+The reason: the cached cookies are credentials. Anything that can read them can impersonate your
+session, and anything that can write them can plant cookies your process will send.
 
-1. The cached cookies are credentials — anything that can read them can impersonate your session.
-2. `diskcache` reads cached values back with **pickle**. Anyone who can *write* into this
-   directory can therefore execute code inside your process the next time it reads the cache
-   ([CVE-2025-69872](https://nvd.nist.gov/vuln/detail/CVE-2025-69872)). The advisory has no fixed
-   release — upstream's last release was 2023 — so the directory mode is the mitigation.
+**Nothing in the cache is unpickled (since 0.26.1).** Before 0.26.1 the store was `diskcache`,
+which reads values back with pickle
+([CVE-2025-69872](https://nvd.nist.gov/vuln/detail/CVE-2025-69872), no fixed release upstream), so
+write access to this directory meant code execution in your process. The store is now stdlib
+`sqlite3` holding JSON text: a row that is not a JSON object is a cache miss, never code. The old
+`cache.db` is never opened; delete it if you like. The session warms up once after the upgrade.
 
 A directory **you** passed as `cache_dir` is treated differently: it is created `0700` if new, but
-if it already exists and is group/other-**writable**, settfex logs a warning naming the CVE and
+if it already exists and is group/other-**writable**, settfex logs a warning and
 **leaves the mode alone**. A shared cache may be deliberate, and silently breaking that layout
 would be worse than telling you about it.
 
@@ -496,9 +498,8 @@ Single request comparison:
 
 ## Dependencies
 
-Session caching requires:
-- `diskcache >= 5.6.0` - Disk-based cache with SQLite backend
-- Automatically installed with `settfex`
+Session caching uses only the standard library (`sqlite3`, `json`). There is no third-party
+cache dependency since 0.26.1, which dropped `diskcache` and its pickle advisory.
 
 ## Summary
 

{settfex-0.26.0 → settfex-0.26.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "settfex"
-version = "0.26.0"
+version = "0.26.1"
 description = "Async Python library for fetching real-time and historical data from the Stock Exchange of Thailand (SET) and Thailand Futures Exchange (TFEX)"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -8,7 +8,6 @@ dependencies = [
     "curl-cffi>=0.6.0",
     "pydantic>=2.0.0",
     "loguru>=0.7.0",
-    "diskcache>=5.6.0",
 ]
 authors = [
     { name = "batt", email = "b@candythink.com" }

{settfex-0.26.0 → settfex-0.26.1}/settfex/__init__.py

@@ -64,7 +64,7 @@ Usage:
     >>> asyncio.run(main())
 """
 
-__version__ = "0.26.0"
+__version__ = "0.26.1"
 __author__ = "batt"
 __license__ = "MIT"
 

{settfex-0.26.0 → settfex-0.26.1}/settfex/utils/session_cache.py

@@ -1,5 +1,5 @@
 """
-Session cache for persistent cookie storage using diskcache.
+Session cache for persistent cookie storage: stdlib ``sqlite3`` holding JSON values.
 
 This module provides disk-based caching for curl_cffi session cookies,
 enabling fast session reuse without warming up every time.
@@ -7,25 +7,43 @@ enabling fast session reuse without warming up every time.
 Key features:
 - Persistent storage across program restarts
 - Automatic expiration and refresh
-- Thread-safe disk cache
+- Thread-safe, and safe for several processes sharing one cache directory (SQLite WAL)
 - Fallback to warm-up on cache miss or failure
+
+**Nothing here unpickles.** Until 0.26.1 the store was ``diskcache``, which reads values back with
+pickle (CVE-2025-69872 / PYSEC-2026-2447, no fixed release upstream): write access to the cache
+directory meant code execution in the reading process. Values are now JSON text, decoded with
+``json.loads``; a row that does not decode to a JSON object is a cache miss, never code. The old
+diskcache database (``cache.db``) is never opened, so it is never unpickled either.
 """
 
 import asyncio
+import json
 import os
+import sqlite3
 import stat
+import threading
 import time
 from pathlib import Path
 from typing import Any
 
-import diskcache  # type: ignore[import-untyped]
 from loguru import logger
 
-# diskcache deserializes cached values with pickle (CVE-2025-69872 / PYSEC-2026-2447, which has
-# NO fixed release upstream), so any account that can write into the cache directory executes
-# code inside this process the next time the cache is read. The cached cookies are credentials
-# in their own right. 0700 removes both reaches for every other account on the machine.
+# The cached cookies are credentials in their own right: another account that can read the
+# directory can replay the session, and one that can write it can plant cookies. 0700 on the
+# directory and 0600 on the database remove both reaches for every other account on the machine.
 _CACHE_DIR_MODE = 0o700
+_CACHE_FILE_MODE = 0o600
+_DB_NAME = "sessions.sqlite3"
+# The pre-0.26.1 diskcache database. Never opened: diskcache would unpickle it.
+_LEGACY_DISKCACHE_DB = "cache.db"
+_SCHEMA = (
+    "CREATE TABLE IF NOT EXISTS sessions ("
+    " key TEXT PRIMARY KEY,"
+    " value TEXT NOT NULL,"
+    " stored_at REAL NOT NULL,"
+    " expires_at REAL NOT NULL)"
+)
 
 
 def _secure_cache_dir(cache_dir: Path, *, owned: bool) -> None:
@@ -43,7 +61,7 @@ def _secure_cache_dir(cache_dir: Path, *, owned: bool) -> None:
     module's contract is to degrade rather than fail (see the try/except in every method below).
 
     Args:
-        cache_dir: Directory that will hold the diskcache database.
+        cache_dir: Directory that will hold the session database.
         owned: True when settfex chose the location, False when the caller passed one.
     """
     cache_dir.mkdir(mode=_CACHE_DIR_MODE, parents=True, exist_ok=True)
@@ -63,20 +81,34 @@ def _secure_cache_dir(cache_dir: Path, *, owned: bool) -> None:
             cache_dir.chmod(_CACHE_DIR_MODE)
             logger.info(
                 f"Tightened cache directory permissions: {cache_dir} {mode:04o} -> 0700 "
-                f"(cached cookies are credentials, and diskcache reads them back via pickle)"
+                f"(cached cookies are credentials)"
             )
         elif mode & 0o022:
             logger.warning(
-                f"Cache directory {cache_dir} is group/other-writable ({mode:04o}). diskcache "
-                f"deserializes with pickle, so anyone who can write here can execute code in "
-                f"this process (CVE-2025-69872). Leaving the mode alone because you chose this "
-                f"path -- pass a private directory, or chmod 700 it, if the sharing is not "
-                f"deliberate."
+                f"Cache directory {cache_dir} is group/other-writable ({mode:04o}). The cached "
+                f"session cookies are credentials: anyone who can write here can plant cookies "
+                f"this process will send. Leaving the mode alone because you chose this path -- "
+                f"pass a private directory, or chmod 700 it, if the sharing is not deliberate."
             )
     except OSError as e:
         logger.warning(f"Could not verify permissions on cache directory {cache_dir}: {e}")
 
 
+def _secure_db_file(path: Path) -> None:
+    """Create the database file ``0600`` before SQLite opens it; tighten a loose existing one.
+
+    SQLite creates its ``-wal`` / ``-shm`` files with the main database's permissions, so getting
+    this file right covers all three. Never raises (same contract as :func:`_secure_cache_dir`).
+    """
+    try:
+        fd = os.open(path, os.O_CREAT | os.O_WRONLY, _CACHE_FILE_MODE)
+        os.close(fd)
+        if os.name != "nt" and stat.S_IMODE(path.stat().st_mode) & 0o077:
+            path.chmod(_CACHE_FILE_MODE)
+    except OSError as e:
+        logger.warning(f"Could not verify permissions on cache file {path}: {e}")
+
+
 class SessionCache:
     """
     Disk-based cache for session cookies and metadata.
@@ -86,6 +118,9 @@ class SessionCache:
     cookies are available and valid, they're used immediately (fast path).
     Otherwise, a new session is warmed up and cached.
 
+    Values must be JSON-serializable dicts (cookies as ``{name: value}`` strings, the browser
+    name, timestamps, counts). They are stored as JSON text in SQLite; nothing is unpickled.
+
     Architecture:
         1. Check cache for valid cookies → Use if found (fast)
         2. If not found or expired → Warm up → Cache it
@@ -116,7 +151,8 @@ class SessionCache:
         Args:
             cache_dir: Directory for cache storage (default: ~/.settfex/cache)
             default_ttl: Default time-to-live for cached items in seconds (default: 1 hour)
-            size_limit: Maximum cache size in bytes (default: 100MB)
+            size_limit: Maximum total size of stored values in bytes (default: 100MB); the
+                oldest entries are evicted beyond it
         """
         # The `is None` test is repeated rather than reusing `is_default`, because mypy narrows
         # the parameter on the literal check but not through the flag.
@@ -126,9 +162,26 @@ class SessionCache:
         # Create the cache directory 0700 -- see _secure_cache_dir for why the mode matters.
         _secure_cache_dir(cache_dir, owned=is_default)
 
-        # Initialize diskcache
-        self.cache = diskcache.Cache(str(cache_dir), size_limit=size_limit)
+        self.path = cache_dir / _DB_NAME
+        _secure_db_file(self.path)
         self.default_ttl = default_ttl
+        self.size_limit = size_limit
+        self._lock = threading.Lock()
+        # Autocommit (isolation_level=None) with a busy timeout: several processes on one host
+        # may share this directory, and WAL lets their readers and the one writer coexist.
+        self._db = sqlite3.connect(
+            str(self.path), timeout=10.0, isolation_level=None, check_same_thread=False
+        )
+        with self._lock:
+            self._db.execute("PRAGMA journal_mode=WAL")
+            self._db.execute(_SCHEMA)
+
+        if (cache_dir / _LEGACY_DISKCACHE_DB).exists():
+            logger.info(
+                f"A pre-0.26.1 diskcache database is present at {cache_dir / _LEGACY_DISKCACHE_DB}"
+                f" and is NOT read (diskcache unpickles its values). It can be deleted; the "
+                f"session will warm up once and be cached in {_DB_NAME}."
+            )
 
         logger.info(
             f"SessionCache initialized at {cache_dir} "
@@ -143,7 +196,7 @@ class SessionCache:
             key: Cache key (e.g., "set_session", "tfex_session")
 
         Returns:
-            Cached session data dict or None if not found
+            Cached session data dict or None if not found, expired, or unreadable
 
         Example:
             >>> cached = cache.get("set_session")
@@ -152,14 +205,23 @@ class SessionCache:
             >>>     browser = cached["browser"]
         """
         try:
-            value = self.cache.get(key)
-            if value is not None:
-                logger.debug(f"Cache HIT: {key}")
-                return value  # type: ignore[no-any-return]
-            else:
+            with self._lock:
+                row = self._db.execute(
+                    "SELECT value, expires_at FROM sessions WHERE key = ?", (key,)
+                ).fetchone()
+                if row is not None and row[1] <= time.time():
+                    self._db.execute("DELETE FROM sessions WHERE key = ?", (key,))
+                    row = None
+            if row is None:
                 logger.debug(f"Cache MISS: {key}")
                 return None
-        except Exception as e:
+            value = json.loads(row[0])
+            if not isinstance(value, dict):
+                logger.warning(f"Cache entry {key!r} is not a JSON object; treating it as a miss")
+                return None
+            logger.debug(f"Cache HIT: {key}")
+            return value
+        except (sqlite3.Error, ValueError) as e:
             logger.error(f"Failed to read from cache: {e}")
             return None
 
@@ -174,15 +236,16 @@ class SessionCache:
 
         Args:
             key: Cache key (e.g., "set_session")
-            value: Session data to cache (must be dict with "cookies", "browser", etc.)
+            value: Session data to cache: a JSON-serializable dict with "cookies", "browser",
+                etc.
             ttl: Time-to-live in seconds (uses default_ttl if None)
 
         Returns:
-            True if successfully cached, False otherwise
+            True if successfully cached, False otherwise (including a value JSON cannot encode)
 
         Example:
             >>> cache.set("set_session", {
-            >>>     "cookies": "charlot=abc; incap_ses=xyz",
+            >>>     "cookies": {"incap_ses": "xyz"},
             >>>     "browser": "chrome120",
             >>>     "warmup_time": time.time(),
             >>>     "cookie_count": 12
@@ -190,17 +253,39 @@ class SessionCache:
         """
         try:
             ttl = ttl or self.default_ttl
+            now = time.time()
             # Add metadata
-            value["cached_at"] = time.time()
+            value["cached_at"] = now
             value["ttl"] = ttl
-
-            self.cache.set(key, value, expire=ttl)
+            encoded = json.dumps(value)
+
+            with self._lock:
+                self._db.execute(
+                    "INSERT OR REPLACE INTO sessions (key, value, stored_at, expires_at)"
+                    " VALUES (?, ?, ?, ?)",
+                    (key, encoded, now, now + ttl),
+                )
+                self._db.execute("DELETE FROM sessions WHERE expires_at <= ?", (now,))
+                self._evict_over_limit()
             logger.success(f"✓ Cached session: {key} (ttl={ttl}s)")
             return True
-        except Exception as e:
+        except (sqlite3.Error, TypeError, ValueError) as e:
             logger.error(f"Failed to write to cache: {e}")
             return False
 
+    def _evict_over_limit(self) -> None:
+        """Drop the oldest entries while the stored values exceed ``size_limit``. Lock held."""
+        while True:
+            total = self._db.execute(
+                "SELECT COALESCE(SUM(LENGTH(value)), 0), COUNT(*) FROM sessions"
+            ).fetchone()
+            if total[0] <= self.size_limit or total[1] <= 1:
+                return
+            self._db.execute(
+                "DELETE FROM sessions WHERE key ="
+                " (SELECT key FROM sessions ORDER BY stored_at ASC LIMIT 1)"
+            )
+
     def delete(self, key: str) -> bool:
         """
         Delete cached session data.
@@ -212,11 +297,12 @@ class SessionCache:
             True if deleted, False otherwise
         """
         try:
-            result = self.cache.delete(key)
-            if result:
+            with self._lock:
+                deleted = self._db.execute("DELETE FROM sessions WHERE key = ?", (key,)).rowcount
+            if deleted:
                 logger.debug(f"Deleted from cache: {key}")
-            return bool(result)
-        except Exception as e:
+            return bool(deleted)
+        except sqlite3.Error as e:
             # "delete from" below is log text, not SQL (bandit B608 false positive).
             logger.error(f"Failed to delete from cache: {e}")  # nosec B608
             return False
@@ -251,9 +337,10 @@ class SessionCache:
     def clear(self) -> None:
         """Clear all cached data."""
         try:
-            self.cache.clear()
+            with self._lock:
+                self._db.execute("DELETE FROM sessions")
             logger.info("Cache cleared")
-        except Exception as e:
+        except sqlite3.Error as e:
             logger.error(f"Failed to clear cache: {e}")
 
     def stats(self) -> dict[str, Any]:
@@ -261,23 +348,25 @@ class SessionCache:
         Get cache statistics.
 
         Returns:
-            Dict with cache statistics (size, volume, hits, etc.)
+            Dict with ``size`` (bytes of stored values) and ``count`` (number of entries)
         """
         try:
-            return {
-                "size": self.cache.volume(),  # Bytes used
-                "count": len(self.cache),  # Number of items
-            }
-        except Exception as e:
+            with self._lock:
+                size, count = self._db.execute(
+                    "SELECT COALESCE(SUM(LENGTH(value)), 0), COUNT(*) FROM sessions"
+                ).fetchone()
+            return {"size": int(size), "count": int(count)}
+        except sqlite3.Error as e:
             logger.error(f"Failed to get cache stats: {e}")
             return {"size": 0, "count": 0}
 
     def close(self) -> None:
         """Close the cache."""
         try:
-            self.cache.close()
+            with self._lock:
+                self._db.close()
             logger.debug("Cache closed")
-        except Exception as e:
+        except sqlite3.Error as e:
             logger.error(f"Failed to close cache: {e}")
 
     def __enter__(self) -> "SessionCache":
@@ -319,8 +408,8 @@ async def get_global_cache(
 
     async with _cache_lock:
         if _global_cache is None:
-            # SessionCache.__init__ does blocking disk I/O (mkdir + opening the diskcache
-            # SQLite DB); run it off the event loop so cold cache init never blocks the loop.
+            # SessionCache.__init__ does blocking disk I/O (mkdir + opening the SQLite
+            # database); run it off the event loop so cold cache init never blocks the loop.
             _global_cache = await asyncio.to_thread(
                 SessionCache, cache_dir=cache_dir, default_ttl=default_ttl
             )