statsig-python-core 0.19.4__tar.gz → 0.19.5b2606060303__tar.gz

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/Cargo.lock

@@ -60,6 +60,12 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -760,6 +766,12 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.1"
@@ -941,6 +953,17 @@ version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -1445,6 +1468,15 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
+[[package]]
+name = "lru"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
 [[package]]
 name = "maplit"
 version = "1.0.2"
@@ -2870,7 +2902,7 @@ dependencies = [
 
 [[package]]
 name = "sigstat-grpc"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 dependencies = [
  "async-trait",
  "chrono",
@@ -2962,7 +2994,7 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "statsig-node"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 dependencies = [
  "async-trait",
  "napi",
@@ -2977,7 +3009,7 @@ dependencies = [
 
 [[package]]
 name = "statsig-pyo3"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 dependencies = [
  "async-trait",
  "lazy_static",
@@ -2992,7 +3024,7 @@ dependencies = [
 
 [[package]]
 name = "statsig-rust"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 dependencies = [
  "ahash",
  "arc-swap",
@@ -3011,6 +3043,7 @@ dependencies = [
  "lazy_static",
  "libc",
  "log",
+ "lru",
  "memmap2",
  "mockito",
  "more-asserts",
@@ -3042,7 +3075,7 @@ dependencies = [
 
 [[package]]
 name = "statsig_elixir"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 dependencies = [
  "async-trait",
  "parking_lot",
@@ -3055,7 +3088,7 @@ dependencies = [
 
 [[package]]
 name = "statsig_ffi"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 dependencies = [
  "async-trait",
  "cbindgen",

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/Cargo.toml

@@ -19,7 +19,7 @@ exclude = [
 [workspace.package]
 edition = "2021"
 license = "ISC"
-version = "0.19.4"
+version = "0.19.5-beta.2606060303"
 homepage = "https://statsig.com/"
 authors = ["Statsig", "Daniel Loomb <daniel@statsig.com>"]
 readme = "README.md"

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: statsig_python_core
-Version: 0.19.4
+Version: 0.19.5b2606060303
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/statsig-pyo3/src/statsig_options_py.rs

@@ -357,6 +357,7 @@ fn create_inner_statsig_options(
         event_logging_flush_interval_ms: None,
         event_logging_max_queue_size: opts.event_logging_max_queue_size,
         event_logging_max_pending_batch_queue_size: opts.event_logging_max_pending_batch_queue_size,
+        exposure_dedupe_max_keys: None,
         enable_id_lists: opts.enable_id_lists,
         enable_dcs_deltas: opts.enable_dcs_deltas,
         id_lists_url: opts.id_lists_url.clone(),

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/statsig-rust/Cargo.toml

@@ -20,6 +20,7 @@ futures = "0.3.30"
 indexmap = { version = "2.13.0", features = ["serde"], optional = true }
 lazy_static = "1.5.0"
 log = "0.4.22"
+lru = "0.12"
 parking_lot = "0.12.1"
 percent-encoding = "2.3.1"
 rand = "0.8.4"
@@ -40,7 +41,7 @@ serde_json = { version = "1.0.143", features = [
 ] }
 serde_with = "3.4.0"
 sha2 = "0.10.8"
-sigstat-grpc = { path = "../statsig-grpc", version = "0.19.4", optional = true }
+sigstat-grpc = { path = "../statsig-grpc", version = "0.19.5-beta.2606060303", optional = true }
 simple_logger = { version = "5.0.0" }
 tempfile = "3.8.1"
 tokio = { version = "1.39.1", features = ["full"] }

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/statsig-rust/src/event_logging/event_logger.rs

@@ -79,7 +79,10 @@ impl EventLogger {
                     .event_logging_max_pending_batch_queue_size
                     .unwrap_or(DEFAULT_PENDING_BATCH_COUNT_MAX),
             ),
-            event_sampler: ExposureSampling::new(sdk_key),
+            event_sampler: ExposureSampling::with_max_keys(
+                sdk_key,
+                options.exposure_dedupe_max_keys,
+            ),
             flush_interval: FlushInterval::new(),
             options: options.clone(),
             logging_adapter: event_logging_adapter.clone(),

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/statsig-rust/src/event_logging/exposure_sampling.rs

@@ -8,7 +8,9 @@ use crate::{
 };
 use ahash::AHashSet;
 use chrono::Utc;
+use lru::LruCache;
 use parking_lot::RwLock;
+use std::num::NonZeroUsize;
 use std::sync::{
     atomic::{AtomicU64, Ordering},
     Arc,
@@ -16,7 +18,7 @@ use std::sync::{
 
 const TAG: &str = "ExposureSampling";
 const DEFAULT_EXPOSURE_SAMPLING_TTL_MS: u64 = 60_000;
-const SAMPLING_MAX_KEYS: usize = 100_000;
+pub const SAMPLING_MAX_KEYS: usize = 100_000;
 
 #[derive(Debug)]
 pub enum EvtSamplingMode {
@@ -46,7 +48,8 @@ pub struct ExposureSampling {
     spec_sampling_set: RwLock<AHashSet<SpecAndRuleHashTuple>>,
     last_spec_sampling_reset: AtomicU64,
 
-    exposure_dedupe_set: RwLock<AHashSet<ExposureSamplingKey>>,
+    exposure_dedupe_set: RwLock<LruCache<ExposureSamplingKey, ()>>,
+    exposure_dedupe_max_keys: NonZeroUsize,
     last_exposure_dedupe_reset: AtomicU64,
 
     global_configs: Arc<GlobalConfigs>,
@@ -54,13 +57,25 @@ pub struct ExposureSampling {
 
 impl ExposureSampling {
     pub fn new(sdk_key: &str) -> Self {
+        Self::with_max_keys(sdk_key, None)
+    }
+
+    pub fn with_max_keys(sdk_key: &str, max_keys: Option<u32>) -> Self {
         let now = Utc::now().timestamp_millis() as u64;
 
+        let cap = max_keys
+            .map(|v| v as usize)
+            .and_then(NonZeroUsize::new)
+            .unwrap_or_else(|| {
+                NonZeroUsize::new(SAMPLING_MAX_KEYS).expect("SAMPLING_MAX_KEYS must be non-zero")
+            });
+
         Self {
             spec_sampling_set: RwLock::from(AHashSet::default()),
             last_spec_sampling_reset: AtomicU64::from(now),
 
-            exposure_dedupe_set: RwLock::from(AHashSet::default()),
+            exposure_dedupe_set: RwLock::from(LruCache::new(cap)),
+            exposure_dedupe_max_keys: cap,
             last_exposure_dedupe_reset: AtomicU64::from(now),
 
             global_configs: GlobalConfigs::get_instance(sdk_key),
@@ -121,11 +136,11 @@ impl ExposureSampling {
 
     fn should_dedupe_exposure(&self, sampling_key: &ExposureSamplingKey) -> bool {
         let mut dedupe_set = write_lock_or_return!(TAG, self.exposure_dedupe_set, false);
-        if dedupe_set.contains(sampling_key) {
+        if dedupe_set.get(sampling_key).is_some() {
             return true;
         }
 
-        dedupe_set.insert(sampling_key.clone());
+        dedupe_set.put(sampling_key.clone(), ());
         false
     }
 
@@ -210,16 +225,10 @@ impl ExposureSampling {
         };
 
         let has_expired = now - last_dedupe_reset > ttl_ms;
-        let is_full = dedupe_map.len() > SAMPLING_MAX_KEYS;
 
-        if has_expired || is_full {
-            log_d!(
-                TAG,
-                "Resetting exposure dedupe set. has_expired: {:?}, is_full: {:?}",
-                has_expired,
-                is_full
-            );
-            dedupe_map.clear();
+        if has_expired {
+            log_d!(TAG, "Resetting exposure dedupe set (ttl expired)");
+            *dedupe_map = LruCache::new(self.exposure_dedupe_max_keys);
             self.last_exposure_dedupe_reset
                 .store(now, Ordering::Relaxed);
         }
@@ -347,3 +356,83 @@ impl ExposureSamplingKey {
         final_hash.is_multiple_of(sampling_rate)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_key(unique: u64) -> ExposureSamplingKey {
+        ExposureSamplingKey {
+            spec_name_hash: 1,
+            rule_id_hash: 2,
+            user_values_hash: unique,
+            additional_hash: 0,
+        }
+    }
+
+    /// Deterministic, cross-platform guard for the bounded dedupe cache.
+    ///
+    /// Inserting far more unique keys than the configured cap must leave the
+    /// cache at exactly the cap. On the pre-fix commit the cache was an
+    /// unbounded `HashSet`, so its length would equal the number of unique keys
+    /// inserted (10_000) and this assertion would fail.
+    #[test]
+    fn test_dedupe_set_is_bounded_by_max_keys() {
+        let cap: u32 = 1_000;
+        let sampling = ExposureSampling::with_max_keys("secret-test-bounded", Some(cap));
+
+        for i in 0..10_000u64 {
+            sampling.should_dedupe_exposure(&make_key(i));
+        }
+
+        let len = sampling.exposure_dedupe_set.read().len();
+        assert_eq!(
+            len, cap as usize,
+            "exposure dedupe cache must be bounded at the configured cap"
+        );
+    }
+
+    /// A repeated key is reported as a duplicate on subsequent sightings.
+    #[test]
+    fn test_dedupe_set_dedupes_repeated_key() {
+        let sampling = ExposureSampling::with_max_keys("secret-test-dedupe", Some(10));
+        let key = make_key(42);
+
+        assert!(
+            !sampling.should_dedupe_exposure(&key),
+            "first sighting should not be a duplicate"
+        );
+        assert!(
+            sampling.should_dedupe_exposure(&key),
+            "second sighting should be a duplicate"
+        );
+    }
+
+    /// The cache evicts least-recently-used entries, and `get` (a duplicate
+    /// hit) refreshes recency so frequently-seen keys survive eviction.
+    #[test]
+    fn test_dedupe_set_evicts_least_recently_used() {
+        let cap: u32 = 3;
+        let sampling = ExposureSampling::with_max_keys("secret-test-lru", Some(cap));
+
+        for i in 0..3u64 {
+            assert!(!sampling.should_dedupe_exposure(&make_key(i)));
+        }
+
+        // Refresh key 0 so it becomes most-recently-used; key 1 is now the LRU.
+        assert!(sampling.should_dedupe_exposure(&make_key(0)));
+
+        // Inserting a new key evicts the LRU entry (key 1).
+        assert!(!sampling.should_dedupe_exposure(&make_key(3)));
+
+        assert_eq!(sampling.exposure_dedupe_set.read().len(), cap as usize);
+        assert!(
+            sampling.should_dedupe_exposure(&make_key(0)),
+            "refreshed key should still be present"
+        );
+        assert!(
+            !sampling.should_dedupe_exposure(&make_key(1)),
+            "evicted key should be treated as new again"
+        );
+    }
+}

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/statsig-rust/src/statsig_metadata.rs

@@ -10,7 +10,7 @@ lazy_static! {
     static ref STATSIG_METADATA: RwLock<StatsigMetadata> = RwLock::new(StatsigMetadata::new());
 }
 
-pub const SDK_VERSION: &str = "0.19.4";
+pub const SDK_VERSION: &str = "0.19.5-beta.2606060303";
 
 const TAG: &str = stringify!(StatsigMetadata);
 

{statsig_python_core-0.19.4 → statsig_python_core-0.19.5b2606060303}/statsig-rust/src/statsig_options.rs

@@ -44,6 +44,11 @@ pub struct StatsigOptions {
     pub event_logging_max_pending_batch_queue_size: Option<u32>,
     pub event_logging_max_queue_size: Option<u32>,
 
+    /// Hard upper bound on unique `ExposureSamplingKey`s in the exposure-dedupe LRU
+    /// cache. Defaults to [`crate::event_logging::exposure_sampling::SAMPLING_MAX_KEYS`]
+    /// (100_000). `Some(0)` is treated as "use the default".
+    pub exposure_dedupe_max_keys: Option<u32>,
+
     pub fallback_to_statsig_api: Option<bool>,
     pub global_custom_fields: Option<HashMap<String, DynamicValue>>,
 
@@ -187,6 +192,12 @@ impl StatsigOptionsBuilder {
         self
     }
 
+    #[must_use]
+    pub fn exposure_dedupe_max_keys(mut self, exposure_dedupe_max_keys: Option<u32>) -> Self {
+        self.inner.exposure_dedupe_max_keys = exposure_dedupe_max_keys;
+        self
+    }
+
     // ID Lists
 
     #[must_use]

statsig_python_core-0.19.5b2606060303/statsig-rust/tests/memory_leak_per_request_users_tests.rs

@@ -0,0 +1,133 @@
+//! Regression coverage for unbounded growth in
+//! `ExposureSampling::should_dedupe_exposure`.
+//!
+//! Each iteration uses a distinct `user_id`, which previously inserted into an
+//! unbounded `HashSet` and grew RSS with unique-user cardinality. With the
+//! bounded LRU fix the dedupe cache is capped at `exposure_dedupe_max_keys`.
+//!
+//! The authoritative, deterministic guard for the bound lives in the unit tests
+//! next to the fix in `statsig-rust/src/event_logging/exposure_sampling.rs`
+//! (`tests::test_dedupe_set_is_bounded_by_max_keys`). Those assert directly on
+//! the cache length, run on every platform, and fail on the pre-fix commit.
+//!
+//! This integration test is a Linux-only, real-world RSS smoke check that
+//! exercises the full evaluation path end-to-end. It is `#[ignore]`d by default.
+//!
+//! Run manually on Linux:
+//! `cargo test --release --test memory_leak_per_request_users_tests -- --ignored`
+
+mod utils;
+
+use crate::utils::mock_event_logging_adapter::MockEventLoggingAdapter;
+use crate::utils::mock_specs_adapter::MockSpecsAdapter;
+use statsig_rust::{ClientInitResponseOptions, Statsig, StatsigOptions, StatsigUser};
+use std::sync::Arc;
+
+const WARMUP_ITERATIONS: usize = 1_000;
+const DEDUPE_CAP: u32 = 1_000;
+
+#[cfg(target_os = "linux")]
+const ITERATIONS: usize = 10_000;
+#[cfg(target_os = "linux")]
+const MAX_RSS_GROWTH_BYTES: i64 = 50 * 1024 * 1024;
+
+const GATE_NAME: &str = "test_public";
+const CONFIG_NAME: &str = "test_empty_array";
+const EXPERIMENT_NAME: &str = "test_experiment_no_targeting";
+const LAYER_NAME: &str = "test_layer";
+
+// Reads current RSS in bytes from /proc/self/status (Linux only). Panics on a
+// read/parse failure so a broken measurement surfaces as a test failure rather
+// than being silently skipped, which could otherwise mask a real regression.
+#[cfg(target_os = "linux")]
+fn read_rss_bytes() -> i64 {
+    let contents =
+        std::fs::read_to_string("/proc/self/status").expect("failed to read /proc/self/status");
+    for line in contents.lines() {
+        if let Some(rest) = line.strip_prefix("VmRSS:") {
+            let kb: i64 = rest
+                .split_whitespace()
+                .next()
+                .and_then(|v| v.parse().ok())
+                .expect("failed to parse VmRSS value");
+            return kb * 1024;
+        }
+    }
+    panic!("VmRSS field not found in /proc/self/status");
+}
+
+#[tokio::test]
+#[ignore]
+async fn test_memory_leak_per_request_users_bounded() {
+    let specs_adapter = Arc::new(MockSpecsAdapter::with_data("tests/data/eval_proj_dcs.json"));
+    let logging_adapter = Arc::new(MockEventLoggingAdapter::new());
+
+    let statsig = Statsig::new(
+        "secret-shhh",
+        Some(Arc::new(StatsigOptions {
+            specs_adapter: Some(specs_adapter.clone()),
+            event_logging_adapter: Some(logging_adapter.clone()),
+            exposure_dedupe_max_keys: Some(DEDUPE_CAP),
+            ..StatsigOptions::new()
+        })),
+    );
+    statsig.initialize().await.unwrap();
+
+    // Warm-up: run the full operation set so lazy initialization, evaluation
+    // caches, and allocator bucket growth settle before we capture the baseline.
+    // Otherwise first-iteration allocations would be counted as "growth".
+    for i in 0..WARMUP_ITERATIONS {
+        let user = StatsigUser::with_user_id(format!("warmup-{i}"));
+        run_evaluations(&statsig, &user);
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    {
+        // RSS is only readable via /proc on Linux. The bound itself is verified
+        // cross-platform by the deterministic unit tests in `exposure_sampling`,
+        // so here we explicitly log that the RSS smoke check is being skipped.
+        println!(
+            "Skipping RSS smoke check on non-Linux platform ({}). \
+             The dedupe-cache bound is covered cross-platform by \
+             exposure_sampling::tests::test_dedupe_set_is_bounded_by_max_keys.",
+            std::env::consts::OS
+        );
+        let _ = statsig.shutdown().await;
+    }
+
+    #[cfg(target_os = "linux")]
+    {
+        let initial_rss = read_rss_bytes();
+
+        for i in 0..ITERATIONS {
+            let user = StatsigUser::with_user_id(format!("user-{i}"));
+            run_evaluations(&statsig, &user);
+        }
+
+        let final_rss = read_rss_bytes();
+        let delta = final_rss - initial_rss;
+
+        println!(
+            "RSS: initial = {:.2} MB, final = {:.2} MB, delta = {:+.2} MB",
+            initial_rss as f64 / 1024.0 / 1024.0,
+            final_rss as f64 / 1024.0 / 1024.0,
+            delta as f64 / 1024.0 / 1024.0,
+        );
+
+        let _ = statsig.shutdown().await;
+
+        assert!(
+            delta < MAX_RSS_GROWTH_BYTES,
+            "RSS grew by {delta} bytes (> {MAX_RSS_GROWTH_BYTES} bytes); exposure dedupe cache exceeded its bound"
+        );
+    }
+}
+
+fn run_evaluations(statsig: &Statsig, user: &StatsigUser) {
+    let _ = statsig.check_gate(user, GATE_NAME);
+    let _ = statsig.get_dynamic_config(user, CONFIG_NAME);
+    let _ = statsig.get_experiment(user, EXPERIMENT_NAME);
+    let _ = statsig.get_layer(user, LAYER_NAME);
+    let _ =
+        statsig.get_client_init_response_with_options(user, &ClientInitResponseOptions::default());
+}