Skip to content

Release v0.14.21 — Redis Cacher + seq/instanceID heartbeat + audit fixes - #43

Merged
explosivebit merged 8 commits into
mainfrom
release/v0.14.21
Apr 7, 2026
Merged

explosivebit merged 8 commits into
mainfrom
release/v0.14.21

Conversation

@explosivebit

Copy link
Copy Markdown
Contributor

Release v0.14.21

Highlights

  • Redis Cacher production-ready — start()/stop() lifecycle, 16 integration tests
  • seq/instanceID heartbeat checks — detects remote node restart/service changes (Node.js parity)
  • 10 audit findings fixed (3 CRITICAL, 4 HIGH, 3 MEDIUM)

Critical fixes

  • instanceID now persisted in process_node_info (was infinite re-discovery loop)
  • payload dict guard in _handle_heartbeat (crash on malformed packet)
  • Redis cacher logger fallback (crash if connect() before init())

Evidence

  • 2374 unit+e2e tests pass
  • 28/28 demo_matrix
  • 90/90 demo_comprehensive
  • mypy strict: 0 errors
  • 3 audit agents, all CRITICAL/HIGH fixed

🤖 Generated with Claude Code

explosivebit and others added 8 commits April 6, 2026 23:40
…ity)

Matches Node.js Moleculer base discoverer heartbeatReceived():
- seq mismatch → services changed on remote node → request fresh INFO
- instanceID mismatch → node restarted → request fresh INFO
- Also includes seq/instanceID in heartbeat payload so remote Python
  nodes can detect changes without waiting for INFO round-trip

Refs: Node.js base.js:205-229

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…integration tests

Fixes P0 gap: RedisCacher.start()/stop() now properly connect/disconnect.
Broker calls these during lifecycle — previously they were no-ops, meaning
Redis cacher was never actually connected.

Changes:
- start() → calls connect() (establishes Redis connection)
- stop() → calls disconnect() (graceful cleanup)
- init() resets connected=False (base sets True, wrong for network cachers)
- 16 integration tests with real Redis (get/set/delete/clean/ttl/keys/broker)

Evidence: 2371 tests pass, mypy 0, demo 28/28.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(cacher): Redis cacher production-ready + 16 integration tests
fix(transit): seq/instanceID heartbeat checks (Node.js parity)
…ion, ping loop

3 CRITICAL + 1 HIGH from Redis cacher audit:
- CRITICAL: self.logger set in __init__ as fallback (was only in init())
- CRITICAL: removed duplicate namespace prefix logic (BaseCacher.init handles it)
- CRITICAL: TTL validation — negative/zero TTL now warns and stores without expiry
  (was silently passing negative to Redis → ResponseError swallowed)
- HIGH: ping loop now pings first, then sleeps (detects immediate connection drop)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… discover cleanup

Heartbeat audit (2 CRITICAL, 1 HIGH, 2 MEDIUM):
- CRITICAL: instanceID now persisted in process_node_info (was causing
  infinite re-discovery loop — every heartbeat triggered DISCOVER)
- HIGH: seq comparison coerces to int (cross-language safety)
- MEDIUM: instanceID=None guard prevents spurious re-discovery on first contact

Security audit (1 CRITICAL, 1 HIGH):
- CRITICAL: payload dict type guard in _handle_heartbeat (prevents crash on
  malformed packet where payload is None or non-dict)
- HIGH: _discover_pending stale entries evicted in check_remote_nodes (prevents
  unbounded memory growth under network partitions)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Release v0.14.21:
- Redis Cacher production-ready (start/stop lifecycle, 16 integration tests)
- seq/instanceID heartbeat checks (Node.js parity)
- 10 audit findings fixed (3 CRITICAL: instanceID persistence,
  payload guard, logger fallback + 4 HIGH + 3 MEDIUM)

Evidence: 2374 tests, 28/28 demo matrix, 90/90 comprehensive, mypy 0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Version: 0.14.21 (supersedes 0.14.20)
CHANGELOG: both 0.14.20 and 0.14.21 entries preserved

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@explosivebit
explosivebit merged commit 2796578 into main Apr 7, 2026
4 checks passed
@codecov

codecov Bot commented Apr 7, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 60.00000% with 16 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
moleculerpy/cacher/redis.py 44.44% 9 Missing and 1 partial ⚠️
moleculerpy/transit.py 82.35% 1 Missing and 2 partials ⚠️
moleculerpy/discoverer.py 33.33% 1 Missing and 1 partial ⚠️
moleculerpy/__init__.py 0.00% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant