From ac9fd9f636fa05f553461028b6e66b083a541024 Mon Sep 17 00:00:00 2001 From: August Vi Date: Sat, 10 Oct 2026 21:26:07 -0700 Subject: [PATCH] Record the 5.7.0 changes so far in the changelog and mention SafeDisk, the 0700 directories and the import warning in the README fork notice --- CHANGELOG.md | 30 +++++++++++++++++++++++++++--- README.rst | 10 ++++++++-- 2 files changed, 35 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b8c8dcc..b3b1bae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,9 +1,33 @@ # Changelog -diskcache-community forked from DiskCache at upstream commit ebfa37c (3 March 2024), two commits after the 5.6.3 release. Each entry names the pull request in this repository; imported upstream pull requests name their original author. +diskcache-community forked from DiskCache at upstream commit ebfa37c (3 March 2024), two commits after the 5.6.3 release. Each entry names the pull request in this repository. Imported upstream pull requests are referenced by number, and their commits keep their original authors in the git history. ## Unreleased -- Replace the upstream CI with one `ci.yml` workflow: lint checks, tests on Python 3.10 to 3.14 on Linux, macOS and Windows, Django 4.2 and 6.0 jobs, and an import check without Django (#1). +### Security + +- Add `SafeDisk`, an opt-in `Disk` for CVE-2025-69872: it unpickles only an allowlist of standard-library types, raises `TypeError` at write time for anything the allowlist could not read back, and confines the paths read from the `filename` column to the cache directory. `Deque` and `Index` take a `disk` argument, `FanoutCache.cache()`, `deque()` and `index()` honour theirs, and the Django backend gains a `DISK` option. The default `Disk` is unchanged, so every 5.6.3 cache keeps opening (#11). +- Create every directory the cache makes with mode `0700`, including missing parents and the value subdirectories, and leave existing directories alone; includes upstream pull request 359 (#7). +- Warn at import time when the upstream `diskcache` distribution is installed next to `diskcache-community`, since both own the same package directory (#9). + +### Fixes + +- Support SQLite builds compiled with `SQLITE_DQS=0`, such as conda-forge's sqlite builds of early 2025: single-quoted literals in the `Settings` triggers and statistics counters (upstream pull request 311), and caches written by earlier versions get their triggers rewritten on first open when the stored text differs (#3). +- `FanoutCache.__getattr__` raises `AttributeError`, so `hasattr()` works (upstream pull request 366), and `FanoutCache.get` and `pop` return the documented tuple when a shard times out (upstream pull request 367) (#3). +- Write bytes values without the `io.BytesIO` copy (upstream pull request 333) and fix a README typo (upstream pull request 365) (#3). +- Accept either path separator in stored filenames, so a cache written on Windows opens on other systems and `check()` stays clean across platforms (#6). +- A parameter name in the `ignore` set of `memoize` matches the argument whether it is passed positionally or by keyword; keys of calls that do not pass an ignored parameter positionally are unchanged (#8). + +### Packaging + - Move packaging from `setup.py` to `pyproject.toml` under the distribution name `diskcache-community`; the import name stays `diskcache`. Includes upstream pull request 326, which removes the `setup.py test` command (#2). -- Add the fork notice and migration steps to the README, plus `NOTICE`, `SECURITY.md`, `CONTRIBUTING.md` and this changelog; point the documentation and repository links at this fork and remove the upstream analytics, logo and funding links from the docs (this PR). + +### Docs + +- Add the fork notice and migration steps to the README, plus `NOTICE`, `SECURITY.md`, `CONTRIBUTING.md` and this changelog; point the documentation and repository links at this fork and remove the upstream analytics, logo and funding links from the docs (#4). + +### Tests and CI + +- Replace the upstream CI with one `ci.yml` workflow: lint checks, tests on Python 3.10 to 3.14 on Linux, macOS and Windows, Django 4.2 and 6.0 jobs, and an import check without Django (#1). +- Add golden compatibility fixtures written by diskcache 5.6.3 for every container, eviction policy, tag index, statistics, `JSONDisk`, memoized calls and file-backed values, with tests that read them with the current code and a reverse-direction test that reads a fork-written cache with 5.6.3 (#5). +- Run the test suite in CI against a SQLite built from source with `SQLITE_DQS=0` (#10). diff --git a/README.rst b/README.rst index f35f88a..27b2ce8 100644 --- a/README.rst +++ b/README.rst @@ -59,7 +59,9 @@ who can write into the cache directory can run code in the process that reads from it. The package still installs and works, but dependency scanners flag it and no fixed upstream version exists. This fork publishes the same library as ``diskcache-community`` and carries the fix in two steps: 5.7.0 stays -compatible with 5.6.3 caches and adds an opt-in ``SafeDisk``; 6.0.0 makes safe +compatible with 5.6.3 caches and adds an opt-in ``SafeDisk``, selected with +``Cache(directory, disk=SafeDisk)`` and likewise on ``FanoutCache``, +``Deque``, ``Index`` and the Django ``DISK`` option; 6.0.0 makes safe reading the default. No release has been published yet; ``SECURITY.md`` in the repository describes the current state. @@ -70,10 +72,14 @@ What stays the same: 5.6.3 process opens a directory written by this fork and the reverse - the ``JSONDisk`` bytes, the memoize key format and the persisted settings +What changes for everyone: directories the cache creates get mode ``0700``, +so only the owner can read them; existing directories keep their permissions. + Migrating from ``diskcache``: both distributions install into the same ``diskcache/`` package directory, so they cannot be installed side by side. Uninstall the upstream package first, and never keep both, because -uninstalling either one deletes the shared package:: +uninstalling either one deletes the shared package. The fork warns at import +time when both are installed:: $ pip uninstall diskcache $ pip install diskcache-community