Skip to content

SoulCache v1.1.0 — Security Hardening, Correctness Fixes, and Performance

Choose a tag to compare

View all tags
@kasihagustinusT kasihagustinusT released this 06 Aug 02:51
· 24 commits to main since this release
v1.1.0
ae25751

SoulCache v1.1.0

High-performance data fetching and caching runtime for TypeScript. Zero runtime dependencies. Framework-agnostic.

This release ships security hardening, correctness fixes, packaging improvements, and documentation accuracy updates. The public API is fully compatible with v1.0.0.

Highlights

  • Memory-bounded caching — MemoryAdapter now accepts maxEntries to cap stored entries.
  • Hardened serialization — deepEqual guards recursion depth; deserialize validates dehydrated-state shape before hydrating, rejecting malformed or hostile payloads.
  • Correct cache eviction — LRU eviction score formula corrected so recently and frequently accessed entries are evicted last.
  • Robust mutation callbacks — onSuccess/onError/onSettled are isolated per callback; a throwing callback no longer corrupts mutation state or skips onSettled.
  • Smaller, cleaner packages — minification enabled for @soulcache/core and @soulcache/react; DevTools packages no longer bundle the core source tree.
  • Bounded infinite queries — default maxPages changed from unbounded to 50; navigation flags are recomputed after page-window eviction.

What's Changed

Security

  • MemoryAdapter now accepts a maxEntries option to cap stored entries and bound memory use.
  • deepEqual now guards recursion depth to prevent stack-overflow attacks on pathological input.
  • deserialize now validates the dehydrated-state shape before hydrating, rejecting malformed or hostile payloads.
  • EventBus now enforces a per-type handler limit (maxHandlersPerType) to prevent unbounded listener growth.

Correctness

  • LRU eviction score formula corrected so recently/frequently accessed entries are evicted last.
  • Mutation onSuccess/onError/onSettled callbacks are now isolated per callback; a throwing callback no longer corrupts mutation state or skips onSettled.
  • Retry-engine event listeners are individually isolated; toError() preserves name/message for non-Error thrown values (e.g. DOMException).
  • InfiniteQuery default maxPages changed from Infinity to 50; navigation flags are recomputed after page-window eviction.
  • Hydration mergeStrategy: 'merge' now preserves existing data and hydrates only entries without data.
  • EventBus adds monotonic sequence numbers and opt-in coalesced delivery.

Performance & Packaging

  • Build minification enabled for @soulcache/core and @soulcache/react.
  • DevTools packages no longer bundle the core source tree (devtools 319 -> 19 files; devtools-core 319 -> 35 files).
  • No benchmark regressions; @soulcache/core bundle remains approximately 16 KB (gzip).

Documentation

  • Corrected bundle-size, retry, background-refetch, and plugin-system claims across the docs site.
  • New DevTools guide; corrected infinite-query, hydration, mutation, and query-client API references.
  • Roadmap and release notes updated with verified test counts.

Testing

  • 1312/1312 tests passing in the root suite (core + devtools + devtools-core); 199/199 React bindings tests passing.
  • New regression suites: EventBus handler caps, InfiniteQuery maxPages window, mutation callback isolation, retry listener isolation, hydration merge.
  • Public API verified compatible with the v1.0.0 baseline.

Breaking Changes

None. The public API surface is fully compatible with v1.0.0 (verified against the API baseline).

Upgrade Notes

No code changes are required to upgrade. Review the following behavioral changes:

  • InfiniteQuery now defaults to a maxPages window of 50. Configure maxPages explicitly if you relied on unbounded page retention.
  • Mutation callbacks are now isolated. If your onSuccess/onError throws, wrap the body in try/catch — other callbacks and onSettled will still run.
  • Eviction order may differ for caches near their capacity because of the corrected LRU scoring. With MemoryAdapter.maxEntries, verify eviction behavior in tests.

Known Limitations

  • Retry engine and background refetching remain internal modules; integration is targeted for a future milestone.
  • The plugin system is internal and not yet part of the public API.

Credits

Maintained by Kasih Agustinus and the SoulCache contributors.

Full Changelog

Assets 2
Loading