Skip to content

Chore/fixing cache desync#6

Merged
sn merged 2 commits into
mainfrom
chore/fixing-cache-desync
May 15, 2026
Merged

Chore/fixing cache desync#6
sn merged 2 commits into
mainfrom
chore/fixing-cache-desync

Conversation

@sn

@sn sn commented May 15, 2026

Copy link
Copy Markdown
Contributor

This pull request introduces several important improvements to the nitro-datastore package, focusing on enhanced security for file saving, improved cache consistency for data views, and more robust test coverage. The changes also include a version bump to 1.0.6.

Security and File Saving Enhancements:

  • Added a base_dir parameter to the NitroDataStore.save() method, restricting file saves to a specified directory, and implemented path traversal protection to prevent writing outside this directory. The method now resolves and validates the target path before creating any directories, raising a ValueError if traversal is detected. [1] [2]
  • Added comprehensive tests to verify that save() enforces the base_dir restriction, blocks path traversal and absolute paths outside the sandbox, and does not create unauthorized directories.

Cache Consistency and Performance:

  • Improved the cache key for path listing in list_paths() to include the data object's identity, ensuring correct cache scoping for subviews and preventing collisions.
  • Modified the internal value wrapping logic so that child NitroDataStore views share the parent’s path cache, ensuring cache invalidation propagates across all views of the same data.
  • Added a suite of tests to verify that cache invalidation is consistent across parent, child, and sibling views, and that mutations in one view are reflected in others.

Versioning:

  • Bumped the package version to 1.0.6 in both __init__.py and pyproject.toml. [1] [2]

These changes improve the package’s security posture, data consistency, and reliability, especially in multi-view and file operation scenarios.

@sn sn self-assigned this May 15, 2026
@sn sn merged commit 3a19e80 into main May 15, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant