Fix a 5.8.2 regression and the SafeDisk gaps found by testing downstream libraries by avgvi · Pull Request #42 · secondwindoss/diskcache-community

Take the cursor of Cache.get's fast path from _con, so subclasses that override _con to open another database work again.

avgvi

committed

8a6cf83

Let SafeDisk store the classes in its allowlist, so memoize(typed=True) keys pass the write check, and refuse defaultdict(bool), which the reader refuses.

avgvi

committed

1d5f268

Let SafeDisk.with_numpy() store datetime64 and timedelta64 arrays, which raised ValueError from pickle.PickleBuffer.

avgvi

committed

9697a37

Check every SafeDisk write against the names its pickle looks up, as with_types disks do, and make refusal messages point to with_numpy() or say when no allowlist can help.

avgvi

committed

172181f

Type the modules argument of SafeDisk.with_types as a string or an iterable of strings, as the code accepts.

avgvi

committed

71ce95d

Refuse scipy, torch, bitstruct and pyahocorasick classes in SafeDisk.with_types, as numpy is, because crafted pickles of them crash the reader or run code.

avgvi

committed

ba2a4e6

Warn on the CVE page and in the migration guide that JSONDisk does not protect reads, and explain why Dash needs a cache folder of its own.

avgvi

committed

c622708

Draft the changelog for the adoption sweep fixes, with the issues known to remain.

avgvi

committed

67554fb

Raise pylint's module length limit to 4300 lines, which core.py now needs.

avgvi

committed

88e1202

Navigation Menu

Repository navigation

Fix a 5.8.2 regression and the SafeDisk gaps found by testing downstream libraries - #42

Fix a 5.8.2 regression and the SafeDisk gaps found by testing downstream libraries#42
avgvi merged 9 commits into
masterfrom
fix/adoption-sweep-5.8.3

Commits on Nov 3, 2026

Take the cursor of Cache.get's fast path from _con, so subclasses that override _con to open another database work again.

Let SafeDisk store the classes in its allowlist, so memoize(typed=True) keys pass the write check, and refuse defaultdict(bool), which the reader refuses.

Let SafeDisk.with_numpy() store datetime64 and timedelta64 arrays, which raised ValueError from pickle.PickleBuffer.

Check every SafeDisk write against the names its pickle looks up, as with_types disks do, and make refusal messages point to with_numpy() or say when no allowlist can help.

Type the modules argument of SafeDisk.with_types as a string or an iterable of strings, as the code accepts.

Refuse scipy, torch, bitstruct and pyahocorasick classes in SafeDisk.with_types, as numpy is, because crafted pickles of them crash the reader or run code.

Warn on the CVE page and in the migration guide that JSONDisk does not protect reads, and explain why Dash needs a cache folder of its own.

Draft the changelog for the adoption sweep fixes, with the issues known to remain.

Raise pylint's module length limit to 4300 lines, which core.py now needs.