[cachekit-release-bot]

🤖 I have created a release beep boop

cachekit-macros: 0.12.0

0.12.0 (2026-10-21)

Miscellaneous

• cachekit-macros: Synchronize cachekit-rs versions

cachekit-rs: 0.12.0

0.12.0 (2026-10-21)

⚠ BREAKING CHANGES

• serializer: reject trailing bytes after the MessagePack document on every read (LAB-8182) (#140)
• encryption: on a client with both encryption and .namespace() configured, entries written before this release no longer authenticate: reading one returns CachekitError::Encryption, never a miss, on every read until it is overwritten, deleted or expires. Delete those entries, or move to a fresh namespace, when upgrading rather than waiting out the TTL. There is no fallback to the old AAD. Clients without a namespace are unaffected.
• encryption: a client with encryption configured (.encryption(), .encryption_from_bytes(), .encryption_from_bytes_with_previous(), the secure / secure_from_env presets, or CacheKit::from_env() with CACHEKIT_MASTER_KEY set) now encrypts every value read and write, not only those made through secure_cache(): plain get, set, set_with_ttl, interop_get, interop_get_swr and non-secure #[cachekit] functions store and read AES-256-GCM ciphertext, and L1 holds ciphertext. Entries those calls wrote in plaintext before this release are not migrated: reading one now returns CachekitError::Encryption, never a silent miss, until it is overwritten, deleted or expires, so delete or let expire what they wrote before upgrading. Builds without the encryption feature now get CachekitError::Config from all three builder encryption methods, and from CacheKit::from_env() when CACHEKIT_MASTER_KEY is set, instead of a plaintext client. On every build, a CACHEKIT_MASTER_KEY that is set but not valid UTF-8 is now a Config error from CachekitConfig::from_env() and CacheKit::from_env(), where it was read as unset and gave a plaintext client.
• l1: refuse l1 on wasm32-unknown-unknown at compile time (LAB-7884) (#127)
• encryption: the raw-bytes master-key APIs (EncryptionLayer::new, EncryptionLayer::with_previous_keys, CacheKitBuilder::encryption_from_bytes and CacheKitBuilder::encryption_from_bytes_with_previous) now require keys of exactly 32 bytes, current and previous, and return CachekitError::Config for any other length. Callers that pass longer keys to a raw-bytes API, including hex keys decoded manually, now get an error at construction. Use exactly 32-byte keys, the only length every SDK accepts (openssl rand -hex 32), or pass the hex string to .encryption() or use CacheKit::from_env().
• interop: an interop namespace or operation containing .. now fails: interop_key returns InvalidKey, and #[cachekit] does not compile. Rename the segment; its keys become a full cache miss.
• intents: CacheKit::secure takes the master key as a hex string (master_key_hex: &str) instead of raw bytes (master_key: &[u8]). The key must decode to at least 32 bytes and is validated before any Redis connection is attempted. There is no longer a raw-bytes preset; decoded bytes go through CacheKitBuilder::encryption_from_bytes. The new CacheKit::secure_from_env reads the key from CACHEKIT_MASTER_KEY.
• interop: reject reserved namespaces ns and nsapi (LAB-5876) (#89)
• intents: CacheKit::minimal now enables an in-process L1 cache (1000 entries, no stale-while-revalidate, no cross-process invalidation). A minimal read may serve an L1 entry for up to its 300 s TTL after another writer changed the value in Redis. Chain .no_l1() on the returned builder to restore read-through-every-time behaviour.
• intents: CacheKit::encrypted(url, key) is now CacheKit::secure(url, key), and the SecureCache accessor cache.secure() is now cache.secure_cache(). Migration: rename both call sites; behaviour, defaults and feature gates are unchanged.
• the public module cachekit::key (and cachekit::key::generate_cache_key) is removed. It was never protocol-conformant and had no supported use. For cross-SDK, spec-conformant keys use the interop/v1 keygen (interop_key(), arriving with cachekit-rs#33 / LAB-246). The #[cachekit] macro's derived keys are unchanged.

Features

• #[cachekit] mints interop/v1 keys — retire legacy non-conformant keygen (LAB-424) (#35) (ff1d490)
• backend: add Memcached and File backends (LAB-429) (#44) (3afe8e7)
• backend: Redis lock + Workers lock/TTL capability parity (LAB-426) (#37) (f6cf7b7)
• CachekitIO backend full parity — session, metrics, SSRF, errors, locking, TTL (88f1344)
• CachekitIO backend full parity (session, metrics, SSRF, locking, TTL) (b8bc4bb)
• encryption: keyring rotation — previous_master_keys + sequential decrypt (LAB-686) (#63) (8b9e7ac)
• encryption: rotate hex master keys for any tenant via encryption_with_previous (#156) (98792f8)
• encryption: surface hardware-acceleration detection (LAB-523) (fd03a12)
• implement #[cachekit] proc-macro and Workers backend (7ae2f05)
• implement Backend and TtlInspectable traits with wasm32 support (fa8e612)
• implement Blake2b-256 cache key generation (0bb1df0)
• implement CacheKit client with L1 cache and builder pattern (5fb63e7)
• implement CachekitConfig with builder and env parsing (8caad1d)
• implement CachekitIO HTTP backend for native targets (556d935)
• implement error types with HTTP status mapping (219e737)
• implement L1 in-memory cache with per-entry TTL via moka Expiry (c458f6c)
• implement MessagePack serializer (e97cd82)
• implement Redis backend with TtlInspectable support (4777e3a)
• implement zero-knowledge encryption layer with AAD v0x03 (3ced335)
• intent-based cache API (#19) (e86172b)
• intents: CacheKit::io falls back to CACHEKIT_API_KEY via io_from_env (LAB-4647) (#86) (464b9d2)
• intents: CacheKit::secure takes a hex master key, add secure_from_env (LAB-4645) (#88) (50211d3)
• interop mode (interop/v1) — first in-SDK keygen + Rust vector verification [LAB-246] (#33) (188c170)
• l1: LAB-728 stale-while-revalidate — serve stale + single-flight background refresh (#47) (068b84a)
• observability: live read counters, auto-wired SaaS telemetry, tracing events (LAB-521) (#81) (afe77ad)
• reliability: retry, circuit breaker, graceful degradation, single-flight (LAB-518) (#43) (e9b9a1e)
• rs: surface rotation drain signal via decrypt_indexed (LAB-1678) (#74) (15b94cf)
• unsync feature flag for ?Send contexts (#16) (c52c3f2)

Bug Fixes

• backend: send X-CacheKit-TTL, not the deprecated X-TTL, on writes (LAB-7676) (#124) (a43963e)
• cachekitio: 5 s read / 10 s write timeouts inside one retry deadline, no retry on quota 429s (LAB-7123) (#134) (a7685a5)
• cachekitio: DELETE never reports existence, so a 404 is an error (LAB-5580) (#116) (4b11ab7)
• cachekitio: never follow redirects on Workers; tighten API URL validation and send the URL as parsed (LAB-8208) (#143) (5839b40)
• cachekitio: reject reserved cache-key segments in request path (LAB-2878) (#76) (0ed7e1d)
• cachekitio: reject the empty cache key; test path encoding from the protocol fixture (LAB-6551) (#100) (4d11fc1)
• cachekitio: send a sub-second refresh_ttl as 1 second (LAB-8206) (#142) (d32b34a)
• encryption: bind the namespaced storage key in the AES-GCM AAD (LAB-6396) (#135) (26995d5)
• encryption: encrypt every value read and write once a key is configured (LAB-4676) (#133) (5a963d9)
• encryption: raw-bytes master keys must be exactly 32 bytes (LAB-4663) (#103) (f85d121)
• file: return a miss for entries with nonzero flags or reserved bytes (LAB-7153) (#107) (6d48ece)
• flight: sweep a cold-key burst's dead slots after a lease timeout (LAB-8330) (#153) (05451cd)
• intents: CacheKit::minimal enables L1 with SWR off per intent-preset contract (LAB-4644) (#85) (e0d4388)
• intents: secure_from_env reads CACHEKIT_PREVIOUS_MASTER_KEYS (LAB-6591) (#102) (dda7f42)
• interop: reject double-dot interop segments (LAB-5906) (#98) (8480457)
• interop: reject reserved namespaces ns and nsapi (LAB-5876) (#89) (5e3aa2f)
• l1: correct the wasm32-unknown-unknown guard text (LAB-7919) (#128) (706db14)
• l1: guard LAB-728 SWR refresh commits (#48) (e31109b)
• l1: honour X-CacheKit-Freshness and Fresh-For before backfilling L1 (LAB-7155) (#109) (658b198)
• l1: refuse l1 on wasm32-unknown-unknown at compile time (LAB-7884) (#127) (0684e55)
• macros: accept any E: From<CachekitError> in #[cachekit] (#155) (13c3798)
• readme: pin the current release and bump the pins on every release (LAB-8219) (#141) (68409f5)
• redis: set a 5 s command timeout on the fred client (LAB-7154) (#108) (72db7c7)
• reliability: clamp max_concurrent to Semaphore::MAX_PERMITS; add ReliabilityConfig::disabled() (LAB-729) (#50) (d851797)
• resolve critical issues from expert panel review (41d2189)
• secure: evict L1 copy when decryption fails (LAB-5570) (#87) (fe5170d)
• serialize config env var tests to prevent race condition (79a1359)
• serializer: enforce decode depth in the structural guard and vendor decode-bounds 1.1.0 (LAB-3481) (b45be1a)
• serializer: own the msgpack decode depth bound and add a structural walk (LAB-2503) (#73) (306c1b1)
• serializer: reject trailing bytes after the MessagePack document on every read (LAB-8182) (#140) (06ed843)
• swr: stand a refresh down on a held lock instead of polling it (LAB-8236) (#147) (dcec81e)
• ttl: send a sub-second write TTL as 1 and bound L1 by the wire TTL (LAB-7733) (#131) (109ead8)
• use snake_case wire names for lock acquire request/response (#34) (40b7277)
• wasm32-safe session clock + wasm32 runtime CI tests (LAB-1079) (#60) (1394a37)

Performance Improvements

• bench: instruction-gated hot-path bench and a client wall-time probe (LAB-7057) (#110) (d561d70)
• cachekitio: keep pooled connections 390 s and send a cachekit-rs User-Agent (LAB-7085) (#125) (64a0b77)
• cachekitio: prebuild static request headers and drop per-request formatting, copies and UUID jitter (LAB-7088) (#126) (7ae6765)
• file: stripe the in-process lock per key so reads skip unrelated fsyncs (LAB-7086) (#106) (e9980df)
• file: sweep orphaned temp files on first set, not on build (LAB-7381) (#113) (222a916)
• flight: detach a stored fill's unlock and bound the contested poll by a deadline (LAB-7122) (#149) (f5b13b9)
• l1: store L1 payloads as shared Bytes instead of copying on every hit (LAB-7089) (#123) (d14def6)
• serializer: decode with rmp-serde's borrowed slice reader (LAB-7090) (#122) (282d864)

Security

• send lock_id via X-CacheKit-Lock-Id header, not query string (#24) (#29) (f381e41)

Code Refactoring

• intents: rename CacheKit::encrypted to CacheKit::secure (LAB-4651) (#82) (11802d9)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • cachekit-macros bumped from 0.11.0 to 0.12.0

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: cachekit-io/cachekit-rs/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ee733fff-e42c-4c48-9c25-21e8b2ee4ae9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[27Bslash6]

Superseded: 0.11.0 is now released. The next releasable commit opens a fresh release PR.