Update dependency dalli to v5 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dalli (changelog)	3.2.8 → 5.0.6

---

Release Notes

petergoldstein/dalli (dalli)

v5.0.6

Compare Source

==========

Performance:

• Skip the cas-return flag on quiet meta_set requests (#​1131)

  • In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request
  • Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter
  • Extracted from #​1130; thanks to Jianbin Chen for this contribution

• Reduce allocations in KeyRegularizer and multi-key request paths (#​1120)

  • Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value
  • Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers
  • Thanks to Jean Boussier for this contribution

• Reduce allocations in ResponseBuffer pipelined getk parsing (#​1117)

  • process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response
  • Also skips trailing nils in the token array
  • Thanks to Jean Boussier for this contribution

• Enable frozen string literals in RequestFormatter (#​1118)

  • Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)
  • Thanks to Jean Boussier for this contribution

• Reduce allocations in ResponseProcessor#value_from_tokens (#​1113)

  • token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons
  • Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)
  • Thanks to Jean Boussier for this contribution

• Reduce allocations in common operation paths (#​1111)

  • Use Symbol#name over Symbol#to_s to return a frozen string without allocation
  • Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled
  • Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation
  • Use match? in KeyRegularizer#encode to avoid MatchData object allocation
  • Reduces objects allocated by ~26% and memory by ~6% for a simple get workload
  • Thanks to Jean Boussier for this contribution

• Fix pathological memory behavior in ResponseBuffer (#​1114)

  • compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original
  • Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read
  • Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations
  • Accompanied by new unit tests for ResponseBuffer (#​1115)
  • Thanks to Jean Boussier for this contribution

Features:

• delete_multi now returns the number of keys found and deleted (#​1126)
  • Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed
  • The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted
  • The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted
  • Thanks to Iliana Hadzhiatanasova for this contribution

Bug Fixes:

• Raise instead of returning a truncated value when the peer closes mid-response (#​1135)

  • IO#read(count) on a blocking socket accumulates across TCP chunks and hands back a shorter buffer (or nil) in only one case: the stream hit EOF. That short buffer was passed through as the response body, so a memcached restart, proxy drop, or load balancer timeout partway through a response could surface a truncated but still decodable value to the caller, indistinguishable from a real one
  • A short read is now treated as the premature EOF it is, raising and closing the dirty socket so the request is retried on a fresh connection
  • CRuby only; the JRuby path already used Socket#readfull, which enforces the same contract
  • Extracted from #​1130; thanks to Ian Ker-Seymer for the original fix and Jianbin Chen for the port

• Tear down the connection when a non-StandardError aborts a request (#​1136)

  • Async::Stop and Thread#kill descend from Exception rather than StandardError, so the rescue clauses in Protocol::Base#request never saw them; a scheduler cancelling a fiber parked on a response read skipped close entirely, leaving the connection marked as having a request in progress with partial response bytes still unread on the wire, and returning that half-used client to the pool under connection_pool
  • Protocol::Base#request now closes in an ensure unless the request ran to completion, and ConnectionManager#close performs its state cleanup in an ensure so a second cancellation landing inside @sock.close cannot leave the socket non-nil with the request still marked in progress
  • Dalli::DalliError and Dalli::MarshalError now close the connection at the point of failure rather than at the start of the next request; those paths already left the request in progress and ConnectionManager#confirm_ready! closed on the next call, so this changes when the close happens rather than adding one
  • Extracted from #​1130; thanks to Dan Mayer for the original fix and Jianbin Chen for the port

• Fix ResponseBuffer compaction logic (#​1119)

  • COMPACT_THRESHOLD was removed in #​1116 as apparently unused, but the constant was referenced by the compaction guard; its absence silently disabled buffer compaction
  • Restored the constant, corrected the compaction condition, and improved the buffer-shrinking implementation to use String#bytesplice (backed by memmove) for true in-place compaction
  • Adds targeted tests covering the compaction threshold and shrink behavior
  • Thanks to Jean Boussier for this contribution

Maintenance:

• Scope StrictWarnings to Dalli's own source (#​1134)

  • The test suite runs under -w and prepends a hook to Warning.singleton_class that turns warnings into failures, but that hook is global: a warning emitted while loading any third-party gem aborted the whole suite before a single test ran
  • json 2.21.2's pure-Ruby generator (used on JRuby, where the C extension is unavailable) warns method redefined; discarding old to_hash at require time, which took the jruby-10 CI job red with no change to Dalli
  • Warnings are now attributed to a source file and only raise for lib/ and test/; attribution prefers the location Ruby embeds in the message, since the stack at that point describes the require chain rather than the offending code
  • Portable attribution of Kernel#warn callers also required walking the stack rather than indexing it (Ruby 3.3/3.4 push an <internal:warning> frame that 4.0 does not), skipping RubyGems' Kernel#warn shim (active on JRuby but not CRuby), and resolving relative backtrace paths

• Make raw and namespace fast path tests actually use those options (#​1129)

  • Followup to #​1127: the raw and namespace variants passed those options to the helper that starts memcached, which configures the client the tests then discarded, so neither option was ever exercised
  • Passes the options to the client under test and adds assertions that fail if they are absent
  • Thanks to Iliana Hadzhiatanasova for this contribution

• Benchmark set_multi and add a delete_multi target (#​1132)

  • Enables the two set_multi reports that were commented out pending the arrival of set_multi, resolving the accompanying TODO
  • Adds a delete_multi target comparing the pipelined path against N single deletes
  • Extracted from #​1130; thanks to Jianbin Chen for this contribution

• Bump CI memcached to 1.6.41 and run benchmarks on pull requests (#​1133)

  • The tests workflow moves from 1.6.40 to 1.6.41; the benchmarks and profile workflows had drifted back on 1.6.23
  • Extracted from #​1130; thanks to Jianbin Chen for this contribution

• Disable RuboCop metrics cops (#​1128)

  • Thanks to Jean Boussier for this contribution

• Remove PIDCache module (#​1125)

  • Process.pid is cached natively by Ruby 3.3+ (via https://bugs.ruby-lang.org/issues/19443), making the manual cache unnecessary now that Dalli requires Ruby 3.3+
  • Thanks to Jean Boussier for this contribution

• Remove unused COMPACT_THRESHOLD constant from ResponseBuffer (#​1116)

  • Followup cleanup after the buffer management redesign in #​1114
  • Note: subsequently found to be in use; restored and corrected in #​1119
  • Thanks to Jean Boussier for this contribution

• Use String#byteindex instead of String#index when searching for the response terminator in getk_response_from_buffer (#​1112)

  • The result feeds directly into byteslice; byteindex makes the intent explicit, though both return the same value since the buffer encoding is always BINARY
  • Thanks to Jean Boussier for this contribution

• Make single-server fast path tests actually exercise the fast path (#​1127)

  • The batch-operation tests built clients through a helper that registers two address aliases for the same memcached process, so every client had a 2-server ring and the tests always ran through the pipelined path instead of the single-server fast path
  • Adds a single_server_client test helper that builds a client with a single address, and uses it in the affected get_multi, set_multi, and delete_multi tests
  • Thanks to Iliana Hadzhiatanasova for this contribution

v5.0.5

Compare Source

==========

Performance:

• Batch multi-key commands into a single write to reduce packet overhead (#​1107)

  • With TCP_NODELAY set on sockets, each write call emits a separate packet; the meta protocol was calling write up to 3 times per key in multi-key operations (get_multi, set_multi, delete_multi), significantly increasing network traffic compared to the old binary protocol
  • Multi-key request paths now buffer all per-key commands into a single binary string and flush once; single-key paths combine the write and flush into one flushed_write call
  • Thanks to Jean Boussier for this contribution

• Avoid repeated RUBY_ENGINE checks on every socket read (#​1103)

  • Moved the JRuby branch from a runtime if inside ConnectionManager#read to a class-level conditional method definition, so the check happens once at load time rather than on every read call
  • Thanks to Jean Boussier for this contribution

• Eliminate per-call array allocations in ResponseProcessor (#​1104)

  • Token sets passed to error_on_unexpected! (e.g. [VA, EN, HD]) were allocated as new arrays on every invocation; replaced with frozen constants defined once at class load time
  • Thanks to Jean Boussier for this contribution

• Avoid string copies when building request commands in RequestFormatter (#​1106)

  • Changed cmd + TERMINATOR to cmd << TERMINATOR; since cmd is always a mutable string, the in-place append avoids copying the entire command string just to append two bytes
  • Thanks to Jean Boussier for this contribution

v5.0.4

Compare Source

==========

Bug fixes:

• Fix string_fastpath flag collision with compression (#​1099)

  • ValueSerializer::FLAG_UTF8 and ValueCompressor::FLAG_COMPRESSED were both 0x2, causing Dalli::UnmarshalError on any UTF-8 string written with string_fastpath: true when compression is enabled, and silent encoding corruption for binary strings
  • Introduces Dalli::Flags to centralise bit flag constants; UTF8 is reassigned to 0x4
  • Adds regression test covering short/long UTF-8, binary, and cross-client read scenarios
  • Thanks to Jean Boussier and Mikael Henriksson for the fix and regression test

• Fix client-level string_fastpath: true being silently ignored (#​1101)

  • Dalli::Client.new(servers, string_fastpath: true) had no effect; the fast path was only taken when string_fastpath: true was passed as a per-request option on each set call
  • Per-request option continues to take precedence over the client-level setting in both directions

v5.0.3

Compare Source

==========

Performance:

• Eliminate double array allocation in Client#perform (#​1093)
  • Changed method signature from perform(*all_args) with destructuring to perform(op, key, *args), letting Ruby decompose arguments directly without intermediate array allocations
  • Reduces benchmark time by ~39% across all Dalli operations (get, set, delete, etc.)
  • Thanks to Sam Obeid for this contribution

Features:

• Support connect_timeout: keyword argument with resolv-replace >= 0.2.0, which now correctly forwards keyword arguments through its TCPSocket patch (#​1096)

• Add Dalli::Instrumentation.disable! to allow disabling OpenTelemetry instrumentation at runtime (#​1088)

  • Also exposes Dalli::Instrumentation.tracer= for setting a custom tracer

v5.0.2

Compare Source

==========

Performance:

• Add single-server fast path for get_multi, set_multi, and delete_multi (#​1077)
  • When only one memcached server is configured, bypass the Pipelined* machinery (IO.select, response buffering, server grouping) and issue all quiet meta requests inline followed by a noop terminator
  • get_multi shows ~1.5x improvement at 10 keys and ~1.75x at 100–500 keys compared to the PipelinedGetter path
  • Thanks to Dan Mayer (Shopify) for this contribution

Development:

• Add bin/benchmark_branch script for benchmarking against the current branch

v5.0.1

Compare Source

==========

Performance:

• Reduce object allocations in pipelined get response processing (#​1072, #​1078)
  • Offset-based ResponseBuffer: track a read offset instead of slicing a new string after every parsed response; compact only when the consumed portion exceeds 4KB and more than half the buffer
  • Inline response processor parsing: avoid intermediate array allocations from split-based header parsing
  • Block-based pipeline_next_responses: yield (key, value, cas) directly when a block is given, avoiding per-call Hash allocation
  • PipelinedGetter: replace Hash-based socket-to-server mapping with linear scan (faster for typical 1-5 server counts); use Process.clock_gettime(CLOCK_MONOTONIC) instead of Time.now
• Add cross-version benchmark script (bin/compare_versions) for reproducible performance comparisons across Dalli versions

Bug Fixes:

• Rescue IOError in connection manager write/flush methods (#​1075)
  • Prevents unhandled exceptions when a connection is closed mid-operation
  • Thanks to Graham Cooper (Shopify) for this fix

Development:

• Add rubocop-thread_safety for detecting thread-safety issues (#​1076)
• Add CONTRIBUTING.md with AI contribution policy (#​1074)

v5.0.0

Compare Source

==========

Breaking Changes:

• Removed binary protocol - The meta protocol is now the only supported protocol

  • The :protocol option is no longer used
  • Requires memcached 1.6+ (for meta protocol support)
  • Users on older memcached versions must upgrade or stay on Dalli 4.x

• Removed SASL authentication - The meta protocol does not support authentication

  • Use network-level security (firewall rules, VPN) or memcached's TLS support instead
  • Users requiring SASL authentication must stay on Dalli 4.x with binary protocol

• Ruby 3.3+ required - Dropped support for Ruby 3.1 and 3.2

  • Ruby 3.2 reached end-of-life in March 2026
  • JRuby remains supported

Performance:

• ~7% read performance improvement (CRuby only)
  • Use native IO#read instead of custom readfull implementation
  • Enabled by Ruby 3.3's IO#timeout= support
  • JRuby continues to use readfull for compatibility

OpenTelemetry:

• Migrate to stable OTel semantic conventions (#​1070)
  • db.system renamed to db.system.name
  • db.operation renamed to db.operation.name
  • server.address now contains hostname only; server.port is a separate integer attribute
  • get_with_metadata and fetch_with_lock now include server.address/server.port
• Add db.query.text span attribute with configurable modes
  • :otel_db_statement option: :include, :obfuscate, or nil (default: omitted)
• Add peer.service span attribute
  • :otel_peer_service option for logical service naming

Internal:

• Simplified protocol directory structure: moved lib/dalli/protocol/meta/* to lib/dalli/protocol/
• Removed deprecated binary protocol files and SASL authentication code
• Removed require 'set' (autoloaded in Ruby 3.3+)

v4.3.3

Compare Source

==========

Performance:

• Reduce object allocations in pipelined get response processing (#​1072)
  • Offset-based ResponseBuffer: track a read offset instead of slicing a new string after every parsed response; compact only when the consumed portion exceeds 4KB and more than half the buffer
  • Inline response processor parsing: avoid intermediate array allocations from split-based header parsing in both binary and meta protocols
  • Block-based pipeline_next_responses: yield (key, value, cas) directly when a block is given, avoiding per-call Hash allocation
  • PipelinedGetter: replace Hash-based socket-to-server mapping with linear scan (faster for typical 1-5 server counts); use Process.clock_gettime(CLOCK_MONOTONIC) instead of Time.now
• Add cross-version benchmark script (bin/compare_versions) for reproducible performance comparisons across Dalli versions

Bug Fixes:

• Skip OTel integration tests when meta protocol is unavailable (#​1072)

v4.3.2

Compare Source

==========

OpenTelemetry:

• Migrate to stable OTel semantic conventions
  • db.system renamed to db.system.name
  • db.operation renamed to db.operation.name
  • server.address now contains hostname only; server.port is a separate integer attribute
  • get_with_metadata and fetch_with_lock now include server.address/server.port
• Add db.query.text span attribute with configurable modes
  • :otel_db_statement option: :include, :obfuscate, or nil (default: omitted)
• Add peer.service span attribute
  • :otel_peer_service option for logical service naming

v4.3.1

Compare Source

==========

Bug Fixes:

• Fix socket compatibility with gems that monkey-patch TCPSocket (#​996, #​1012)

  • Gems like socksify and resolv-replace modify TCPSocket#initialize, breaking Ruby 3.0+'s connect_timeout: keyword argument
  • Detection now uses parameter signature checking instead of gem-specific method detection
  • Falls back to Timeout.timeout when monkey-patching is detected
  • Detection result is cached for performance

• Fix network retry bug with socket_max_failures: 0 (#​1065)

  • Previously, setting socket_max_failures: 0 could still cause retries due to error handling
  • Introduced RetryableNetworkError subclass to distinguish retryable vs non-retryable errors
  • down! now raises non-retryable NetworkError, reconnect! raises RetryableNetworkError
  • Thanks to Graham Cooper (Shopify) for this fix

• Fix "character class has duplicated range" Ruby warning (#​1067)

  • Fixed regex in KeyManager::VALID_NAMESPACE_SEPARATORS that caused warnings on newer Ruby versions
  • Thanks to Hartley McGuire for this fix

Improvements:

• Add StrictWarnings test helper to catch Ruby warnings early (#​1067)

• Use bulk attribute setter for OpenTelemetry spans (#​1068)

  • Reduces lock acquisitions when setting span attributes
  • Thanks to Robert Laurin (Shopify) for this optimization

• Fix double recording of exceptions on OpenTelemetry spans (#​1069)

  • OpenTelemetry's in_span method already records exceptions and sets error status automatically
  • Removed redundant explicit exception recording that caused exceptions to appear twice in traces
  • Thanks to Robert Laurin (Shopify) for this fix

v4.3.0

Compare Source

==========

New Features:

• Add namespace_separator option to customize the separator between namespace and key (#​1019)
  • Default is : for backward compatibility
  • Must be a single non-alphanumeric character (e.g., :, /, |, .)
  • Example: Dalli::Client.new(servers, namespace: 'myapp', namespace_separator: '/')

Bug Fixes:

• Fix architecture-dependent struct timeval packing for socket timeouts (#​1034)

  • Detects correct pack format for time_t and suseconds_t on each platform
  • Fixes timeout issues on architectures with 64-bit time_t

• Fix get_multi hanging with large key counts (#​776, #​941)

  • Add interleaved read/write for pipelined gets to prevent socket buffer deadlock
  • For batches over 10,000 keys per server, requests are now sent in chunks

• Breaking: Enforce string-only values in raw mode (#​1022)

  • set(key, nil, raw: true) now raises MarshalError instead of storing ""
  • set(key, 123, raw: true) now raises MarshalError instead of storing "123"
  • This matches the behavior of client-level raw: true mode
  • To store counters, use string values: set('counter', '0', raw: true)

CI:

• Add TruffleRuby to CI test matrix (#​988)

v4.2.1

Compare Source

v4.2.0

Compare Source

==========

Performance:

• Buffered I/O: Use socket.sync = false with explicit flush to reduce syscalls for pipelined operations
• get_multi optimizations: Use Set for O(1) server tracking lookups
• Raw mode optimization: Skip bitflags request in meta protocol when in raw mode (saves 2 bytes per request)

New Features:

• OpenTelemetry tracing support: Automatically instruments operations when OpenTelemetry SDK is present
  • Zero overhead when OpenTelemetry is not loaded
  • Traces get, set, delete, get_multi, set_multi, delete_multi, get_with_metadata, and fetch_with_lock
  • Spans include db.system: memcached and db.operation attributes
  • Single-key operations include server.address attribute
  • Multi-key operations include db.memcached.key_count attribute
  • get_multi spans include db.memcached.hit_count and db.memcached.miss_count for cache efficiency metrics
  • Exceptions are automatically recorded on spans with error status

v4.1.0

Compare Source

==========

New Features:

• Add set_multi for efficient bulk set operations using pipelined requests
• Add delete_multi for efficient bulk delete operations using pipelined requests
• Add fetch_with_lock for thundering herd protection using meta protocol's vivify/recache flags (requires memcached 1.6+)
• Add thundering herd protection support to meta protocol (requires memcached 1.6+):
  • N (vivify) flag for creating stubs on cache miss
  • R (recache) flag for winning recache race when TTL is below threshold
  • Response flags W (won recache), X (stale), Z (lost race)
  • delete_stale method for marking items as stale instead of deleting
• Add get_with_metadata for advanced cache operations with metadata retrieval (requires memcached 1.6+):
  • Returns hash with :value, :cas, :won_recache, :stale, :lost_recache
  • Optional :return_hit_status returns :hit_before (true/false for previous access)
  • Optional :return_last_access returns :last_access (seconds since last access)
  • Optional :skip_lru_bump prevents LRU update on access
  • Optional :vivify_ttl and :recache_ttl for thundering herd protection

Deprecations:

• Binary protocol is deprecated and will be removed in Dalli 5.0. Use protocol: :meta instead (requires memcached 1.6+)
• SASL authentication is deprecated and will be removed in Dalli 5.0. Consider using network-level security or memcached's TLS support

v4.0.1

Compare Source

==========

• Add :raw client option to skip serialization entirely, returning raw byte strings
• Handle OpenSSL::SSL::SSLError in connection manager

v4.0.0

Compare Source

==========

BREAKING CHANGES:

• Require Ruby 3.1+ (dropped support for Ruby 2.6, 2.7, and 3.0)
• Removed Dalli::Server deprecated alias - use Dalli::Protocol::Binary instead
• Removed :compression option - use :compress instead
• Removed close_on_fork method - use reconnect_on_fork instead

Other changes:

• Add security warning when using default Marshal serializer (silence with silence_marshal_warning: true)
• Add defense-in-depth input validation for stats command arguments
• Add string_fastpath option to skip serialization for simple strings (byroot)
• Meta protocol set performance improvement (danmayer)
• Fix connection_pool 3.0 compatibility for Rack session store
• Fix session recovery after deletion (stengineering0)
• Fix cannot read response data included terminator \r\n when use meta protocol (matsubara0507)
• Support SERVER_ERROR response from Memcached as per the memcached spec (grcooper)
• Update Socket timeout handling to use Socket#timeout= when available (nickamorim)
• Serializer: reraise all .load errors as UnmarshalError (olleolleolle)
• Reconnect gracefully when a fork is detected instead of crashing (PatrickTulskie)
• Update CI to test against memcached 1.6.40

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile

Artifact update for dalli resolved to version 5.1.0, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 5.0.6
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/