Audit fixes (2026-09) - #3
Merged
Merged
Conversation
…ntics
- add(): make the persistent path atomic via ephpm_kv_setnx instead of the
racy exists()-then-set(). WordPress uses wp_cache_add() as a cron/lock
mutex, so two concurrent add()s must not both win. The runtime-only
(non-persistent) path keeps its check-then-set behavior.
- KvOpsInterface/SapiKvOps/InMemoryKvOps: add setnx() (the atomic add
primitive; true=inserted, false=already present or OOM).
- SapiKvOps::incrBy(): stop masking a non-integer stored value. The SAPI
returns false in that case and (int) false === 0 silently swallowed it;
now it throws RuntimeException as the interface documents.
- wp_cache_supports('flush_group') now returns false. The persistent tier
cannot be selectively flushed (no key-scan primitive), so advertising it
over-promised. Batch caps and flush_runtime stay advertised.
- incr()/decr(): align with WP core — a missing key returns false rather
than being created at the delta (the raw KV incr_by would create it).
Applies to both the persistent (existsInStore gate) and runtime paths.
- get() with force=true on a non-persistent group now stays local instead
of spuriously missing through to the (absent) persistent store.
- README: current release v0.10.2 (v0.1.2 floor preserved); document the
atomic add, flush_group=false, and incr miss semantics; list ephpm_kv_setnx.
- Tests: atomic add() race (two caches over one backend), add() uses setnx,
incr miss -> false (persistent + non-persistent), force-read of a
non-persistent group stays local, setnx (InMemory + SAPI stub), and the
incrBy non-integer throw. wp_cache_supports('flush_group') === false.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audited KV/cache fixes for cache-wordpress. Adopts
ephpm_kv_setnxwhere it was missing (atomicadd()/NX/locks), stops reporting OOM writes as success, fixes theincrByfalse->0 cast across the copied KvOps, and refreshes docs/CI. Every behavioral change has a test (agent ran the suite green in WSL PHP 8.5).