fix: Per-entry cache TTL is ignored by the in-memory cache adapter

[mtrezza]

Issue

Two related defects in the in-memory cache adapter, plus the lru-cache upgrade that makes one of them fatal.

1. Per-entry TTL has never been applied. LRUCache.put() passed ttl as lru-cache's third positional argument, but that slot is an options object. Destructuring a number yields undefined for every option, so the per-entry TTL was silently discarded and the cache-wide TTL always won. Verified on the currently pinned 11.2.7:

new LRUCache({ max: 10, ttl: 5000 }).set('a', 1, 60000)
// -> stored entry has ttl: 5000, not 60000

The practical effect is that RedisCacheAdapter honours per-entry TTLs while InMemoryCacheAdapter ignores them, so the two adapters disagree. For example ParseGraphQLController caches its config with put(configCacheKey, graphQLConfig, 60000) but in-memory it actually expires after cacheTTL (5s by default).

2. this.ttl was never assigned. The default parameter put(key, value, ttl = this.ttl) read a property the constructor never set, so it was always undefined.

3. lru-cache@11.3.0 turns defect 1 into a hard failure. In an undocumented change (absent from the upstream CHANGELOG), set(), get(), has(), peek(), fetch(), forceFetch() and memo() now write back onto the caller-supplied options object:

set(k, v, setOptions = {}) {
  const { status = ... } = setOptions
  setOptions.status = status   // 11.2.7 only destructured, never wrote

Passing a non-object therefore throws. Bisected: 11.2.7 OK, 11.3.0–11.5.3 throw TypeError: Cannot create property 'status' on number '60000'. This is why the Dependabot bump (#10596) fails every CI job.

Two call sites passed a positional number, both on default code paths:

• src/Adapters/Cache/LRUCache.js — reached from ParseGraphQLController._putCachedGraphQLConfig through the default InMemoryCacheAdapter.
• src/LiveQuery/ParseLiveQueryServer.ts — the invalid-session-token negative cache, which fires whenever a LiveQuery client presents an INVALID_SESSION_TOKEN (the path covered by the spec for GHSA-2xm2-xj2q-qgpj).

This PR supersedes #10632, whose LRUCache.js fix it adopts, and #10596.

Closes #10596
Closes #10632

Approach

Fix both call sites to pass an options object, assign this.ttl in the constructor, and bump lru-cache to 11.5.2.

LRUCache.put() now maps the TTL explicitly:

• Infinity -> 0, which is how lru-cache expresses "never expires", matching RedisCacheAdapter's Infinity handling.
• any other positive finite number -> forwarded as { ttl }.
• anything else -> undefined, which is how lru-cache expresses "use the cache-wide TTL".

Infinity is deliberately not forwarded as-is. Node cannot express it as a timer duration: under ttlAutopurge it emits TimeoutOverflowWarning: Infinity does not fit into a 32-bit signed integer and clamps the timer to 1ms, so the purge timer re-fires every millisecond.

ParseLiveQueryServer now passes { ttl: this.config.cacheTimeout }. That one is behaviour-preserving by construction: authCache is built with ttl: config.cacheTimeout, so the explicit value equals the cache-wide one.

Behaviour change

Per-entry TTLs now take effect in the in-memory adapter. The most visible consequence is that the GraphQL config cache honours its intended 60000 instead of falling back to cacheTTL (5s by default), bringing it in line with the Redis adapter.

Breaking Changes

None.

Tests

Adds specs covering per-entry TTL longer than the cache TTL, shorter than the cache TTL, Infinity, a non-numeric TTL, and an omitted TTL. Four of them fail against the unfixed adapter on 11.5.2 with the same TypeError seen in CI, and all pass with the fix.

Verified locally: InMemoryCacheAdapter 8/8, CacheController 5/5, ParseGraphQLController 25/25, ParseLiveQuery 56/56, lint clean.

Known adapter difference, not changed here

RedisCacheAdapter treats ttl === 0 as "do not cache at all" (it returns before writing), whereas the in-memory adapter treats 0 as "not a positive TTL" and falls back to the cache-wide value. This PR keeps the existing in-memory behaviour rather than widening scope; worth a follow-up if full parity is wanted.

Tasks

• Add tests — per-entry TTL behaviour in spec/InMemoryCacheAdapter.spec.js

Summary by CodeRabbit

• Bug Fixes

  • Cache entries now respect their individual expiration settings, including durations longer than the default cache duration.
  • Entries with no valid individual duration use the configured default; entries set to never expire remain cached indefinitely.
  • Invalid session-token results now use the server’s configured cache duration.

• Maintenance

  • Updated the caching component to a newer version.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: ee12c6a2-7609-4917-923c-4b75803924ab

📥 Commits

Reviewing files that changed from the base of the PR and between 14ed717 and 408303a.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR upgrades lru-cache from 11.2.7 to 11.5.2 and updates cache calls to use its options-object TTL API. LRUCache now handles per-entry TTL values alongside the configured cache TTL. Tests cover longer, shorter, infinite, non-positive, and omitted entry TTLs.

Changes

LRU Cache TTL Handling

Layer / File(s)	Summary
Dependency and cache TTL behavior package.json, package-lock.json, src/Adapters/Cache/LRUCache.js, spec/InMemoryCacheAdapter.spec.js	The dependency and lockfile move to lru-cache 11.5.2. LRUCache passes TTL through the options object, maps Infinity to zero, passes positive finite TTLs through, and uses the configured cache TTL for other values. Tests cover these TTL behaviors.
Live Query cache integration src/LiveQuery/ParseLiveQueryServer.ts	Invalid-session-token cache entries pass cacheTimeout through the LRU options object.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 40830

The changed cache TTL handling matches the upgraded library’s API, and no actionable merge risk is established.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	[#10596] is met: lru-cache is upgraded to 11.5.2, and the affected calls use options objects. [#10632] is mostly met: LRUCache assigns this.ttl, and positive finite per-entry TTLs override the c…	Treat Infinity as an invalid per-entry TTL and forward undefined so lru-cache uses the cache-wide TTL. Update the Infinity test to verify that fallback.
Engage In Review Feedback	❓ Inconclusive	The supplied current review has zero actionable findings. It also states that this does not establish whether earlier posted review comments are absent or resolved. The repository contains no review-t…	Provide the full PR review discussion history, including earlier feedback comments, replies, and each comment's resolution state. Then verify that every item of feedback was discussed and either implemented in a commit or withdrawn by its r…

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title starts with the required fix: prefix and summarizes the per-entry TTL defect. The first word after the prefix is capitalized.
Description check	✅ Passed	The description explains the issue, approach, behavior change, and tests. It omits the template’s ## Pull Request section and its security and license notices, but the required technical details are…
Out of Scope Changes check	✅ Passed	The dependency update, TTL handling changes, LiveQuery options-object change, and tests all support [#10596] or [#10632]. The current PR summary reports only lru-cache lockfile changes; it does not …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Security Check	✅ Passed	No security vulnerability was introduced in the reviewed changes. The cache now passes an options object to lru-cache, accepts only positive finite TTLs or explicit Infinity, and remains bounded by ma…

Full details: Linked Issues check

Explanation

[#10596] is met: lru-cache is upgraded to 11.5.2, and the affected calls use options objects. [#10632] is mostly met: LRUCache assigns this.ttl, and positive finite per-entry TTLs override the cache TTL. However, LRUCache.put() maps Infinity to 0, so the entry never expires. Issue #10632 explicitly says Infinity must use the cache-wide TTL to avoid changing behavior for invalid TTLs. The added test requires the conflicting behavior.

Full details: Engage In Review Feedback

Explanation

The supplied current review has zero actionable findings. It also states that this does not establish whether earlier posted review comments are absent or resolved. The repository contains no review-thread metadata; the PR refs provide code changes only. Therefore, the available evidence cannot show whether the author engaged with all review feedback.

Resolution

Provide the full PR review discussion history, including earlier feedback comments, replies, and each comment's resolution state. Then verify that every item of feedback was discussed and either implemented in a commit or withdrawn by its reviewer.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.82%. Comparing base (73d8600) to head (408303a).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha   #10671   +/-   ##
=======================================
  Coverage   93.82%   93.82%           
=======================================
  Files         192      192           
  Lines       16875    16882    +7     
  Branches      252      252           
=======================================
+ Hits        15833    15840    +7     
  Misses       1020     1020           
  Partials       22       22           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 9.10.1-alpha.16

[parseplatformorg]

🎉 This change has been released in version 9.10.1