chore(main): release 0.21.0

[cachekit-release-bot]

🤖 I have created a release beep boop

0.21.0 (2026-10-02)

⚠ BREAKING CHANGES

• reliability: removed the cachekit.reliability.profiles module, with ReliabilityProfile, ProfileConfig, PROFILE_CONFIGS, get_profile_config, get_profile_description, recommend_profile, HIGH_THROUGHPUT_THRESHOLD_RPS and LOW_THROUGHPUT_THRESHOLD_RPS; cachekit.reliability no longer re-exports ReliabilityProfile, ProfileConfig, get_profile_config or recommend_profile. No cachekit API read these values, so no runtime behaviour changes.
• encryption: a master key with no stated encryption intent fails at construction (LAB-4739) (#411)
• config: CachekitConfig.l1_enabled, CachekitConfig.enable_prometheus_metrics, CachekitConfig.backend_provider_class and CachekitIOBackendConfig.max_retries are removed, along with their env vars CACHEKIT_L1_ENABLED, CACHEKIT_ENABLE_PROMETHEUS_METRICS, CACHEKIT_BACKEND_PROVIDER_CLASS and CACHEKIT_MAX_RETRIES. Passing one of these fields to the constructor now raises ValidationError. A still-exported env var is ignored, so startup is unaffected.
• interop: an interop namespace or operation containing .. now raises ConfigurationError at decoration time, on every backend; the manual generate_interop_key helper raises InteropError. Rename the segment; its keys become a full cache miss.

Features

• encryption: a master key with no stated encryption intent fails at construction (LAB-4739) (#411) (2baad1b)
• l1-only: back off a failed background refresh before retrying it (LAB-7442) (#462) (b6f3d46)

Bug Fixes

• build: remove build-pgo target and unused PGO profiles (LAB-7151) (#426) (a8c8f16)
• cachekitio: DELETE never reports existence, so a 404 raises (LAB-5580) (#447) (e56a139)
• cachekitio: key the async client per running event loop (LAB-7102) (#433) (c6a04b9)
• cachekitio: reject the empty cache key client-side (LAB-6550) (#397) (9c2c2be)
• config: drop raw-input locals from RedactingSettings frames before raising (LAB-4766) (#386) (0722b08)
• config: honour an explicit redis_url kwarg when REDIS_URL is set (LAB-6831) (#418) (74d12c1)
• config: intent presets accept overrides of the fields they set (LAB-5361) (#390) (3d02435)
• config: redact config validation errors raised through the core schema (LAB-5213) (#404) (25baba1)
• config: remove four config fields nothing reads (LAB-4765) (#394) (4307cd5)
• decorators: async return value the cache write cannot serialize no longer counts toward the circuit breaker (LAB-7461) (#442) (e410aa7)
• decorators: key and name the registry set by a str namespace's exact value (LAB-6197) (#388) (74937d5)
• decorators: key-generation failures no longer count toward the circuit breaker (LAB-5376) (#381) (67732fb)
• decorators: L1-only encryption refusal names the full backend resolution order (LAB-6738) (#413) (704db62)
• decorators: log failed L2 deletes of a no-args invalidation once, with the count (LAB-6074) (#383) (ff952ef)
• decorators: re-raise KeyringConfigurationError from @cache L2 reads (LAB-4841) (#393) (eb6a6e4)
• decorators: re-raise KeyringConfigurationError from @cache writes (LAB-6519) (#396) (08179ba)
• decorators: re-track a key on any exception from its L2 delete (LAB-6198) (#382) (5bef998)
• decorators: run a decorated function at most once when it raises BackendError (LAB-5360) (#429) (7be20d7)
• decorators: serve L1 hits whatever the circuit-breaker state (LAB-5351) (#385) (6407b58)
• deps: raise urllib3 to 2.8.0 for three 2026-09-30 advisories (LAB-6743) (#412) (90d705c)
• encryption: resolve the caller's tenant on encrypted reads (LAB-4260) (#410) (0f436f1)
• file: miss on nonzero header flags; correct File backend docs (LAB-7152) (#431) (6f649c9)
• interop: hash str/int/float/bytes subclass arguments as their exact base-type value (LAB-6201) (#384) (4044866)
• interop: reject double-dot interop segments (LAB-5906) (#391) (5ade81d)
• l1: at-fork hook repairs every cache even when its drop warning raises (LAB-6370) (#392) (b75bcbb)
• l1: never clear a cache under a live lock holder on fork reset (LAB-6375) (#416) (468c7c8)
• l1: remove the old entry before eviction on update (LAB-6897) (#419) (eb7af5f)
• l1: start no cleanup thread in a child forked without at-fork hooks (LAB-7271) (#436) (c3fabda)
• memcached: pool connections per server so threads never share a socket (LAB-6744) (#414) (7d5da3a)
• memcached: raise when HashClient skips a command in its retry window (LAB-6740) (#432) (20fce0e)
• metrics: export circuit_breaker_state to Prometheus as a per-state count (LAB-6403) (#428) (1f05bd4)
• metrics: give a forked child its own batching state and record synchronously after shutdown (LAB-6779) (#434) (7b985b0)
• metrics: record label-less generic counters and histograms (LAB-6389) (#403) (a57569c)
• metrics: restart the batching worker when auto-detect returns to batched mode (LAB-6376) (#407) (dab6b08)
• redis: size every pool from config (default 50) and wait on exhaustion (LAB-7457) (#444) (e2a4c55)
• redis: wire socket_keepalive into both connection pools (LAB-7150) (#427) (87ed6b8)
• reliability: count CLOSED breaker failures in a 60 s rolling window (LAB-5352) (#405) (22a4178)
• security: keep secrets wrapped in cachekit frames on raised errors (LAB-6515) (#430) (02fb730)
• serializers: classify a non-encodable compressed header as corruption (LAB-6354) (#380) (1971dd6)
• serializers: integrity-off AutoSerializer refuses a header format no writer emits (LAB-6359) (#387) (b475b6d)
• swr: log failed and skipped background refreshes at WARNING (LAB-7456) (#446) (1ba3312)

Performance Improvements

• backends: batch L2 deletes in whole-function invalidation (LAB-6075) (#408) (db0345e)
• cachekitio: return the 404 miss before raise_for_status (LAB-7066) (#423) (d2934eb)
• keys: fast-path exact primitives in key normalisation (LAB-7068) (#422) (84db725)
• redis: cache the redis.Redis client per PooledClientProvider (LAB-7075) (#421) (b3312de)
• serializers: hash checksummed Arrow/NumPy bodies once per read (LAB-6371) (#406) (df121d8)

Code Refactoring

• reliability: delete unconsumed reliability profiles module (LAB-6352) (#445) (0b71441)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: cachekit-io/cachekit-py/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e6652455-01ca-4ab9-b17f-79dd20fd4f4c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!