updated dependencies etc

Author: chrishayuk

README.md

@@ -4,7 +4,7 @@
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Tests](https://img.shields.io/badge/tests-202%20passing-brightgreen.svg)]()
+[![Tests](https://img.shields.io/badge/tests-264%20passing-brightgreen.svg)]()
 [![Coverage](https://img.shields.io/badge/coverage-90%25-brightgreen.svg)]()
 
 Dead simple session management with automatic expiration, multiple storage backends, and multi-tenant isolation. Perfect for web apps, APIs, and any system needing reliable sessions.
@@ -117,14 +117,15 @@ Session Lifecycle:
     [Done]
 ```
 
-## ✨ What's New in v0.5
+## ✨ What's New in v0.6
 
 - **🎯 Pydantic Native**: All models are Pydantic-based with automatic validation
 - **🔒 Type-Safe Enums**: No more magic strings - `SessionStatus.ACTIVE`, `ProviderType.REDIS`
 - **📦 Exported Types**: Full IDE autocomplete for `SessionMetadata`, `CSRFTokenInfo`, etc.
 - **⚡ Async Native**: Built from ground-up for async/await
 - **🔄 Backward Compatible**: Existing code works unchanged
-- **✅ 90%+ Test Coverage**: 202 tests, battle-tested
+- **🗂️ Bounded LRU Cache**: In-process session cache is capped at 1024 entries (evicts LRU) — no unbounded memory growth
+- **✅ 90%+ Test Coverage**: 264 tests, battle-tested
 
 ```python
 from chuk_sessions import SessionManager, SessionStatus, SessionMetadata

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "chuk-sessions"
-version = "0.6.1"
+version = "0.6.2"
 description = "CHUK Sessions provides a comprehensive, async-first session management system with automatic expiration, and support for both in-memory and Redis storage backends. Perfect for web applications, MCP servers, API gateways, and microservices that need reliable, scalable session handling."
 readme = "README.md"
 license = {text = "Apache-2.0"}

src/chuk_sessions/__init__.py

@@ -10,7 +10,7 @@
 from __future__ import annotations
 
 # Version
-__version__ = "0.5.1"
+__version__ = "0.6.2"
 
 # Core imports
 from .api import get_session, session

src/chuk_sessions/models.py

@@ -15,6 +15,7 @@
 from pydantic import BaseModel, Field, model_validator
 
 from .enums import SessionStatus, TokenType
+from .utils import utc_now_iso
 
 
 class SessionMetadata(BaseModel):
@@ -50,7 +51,7 @@ class SessionMetadata(BaseModel):
     @model_validator(mode="after")
     def set_default_timestamps(self) -> SessionMetadata:
         """Set default timestamps if not provided."""
-        now_iso = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+        now_iso = utc_now_iso()
         if self.created_at is None:
             self.created_at = now_iso
         if self.last_accessed is None:
@@ -66,9 +67,7 @@ def is_expired(self) -> bool:
 
     def touch(self) -> None:
         """Refresh the last-accessed timestamp to 'now'."""
-        self.last_accessed = (
-            datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-        )
+        self.last_accessed = utc_now_iso()
 
     # Backward compatibility methods
     def to_dict(self) -> dict[str, Any]:

src/chuk_sessions/providers/memory.py

@@ -5,12 +5,15 @@
 
 from __future__ import annotations
 
+import logging
 import os
 import time
 import asyncio
 from contextlib import asynccontextmanager
 from typing import Dict, Tuple, Any, Callable, AsyncContextManager
 
+logger = logging.getLogger(__name__)
+
 # Default TTL from environment or 1 hour
 _DEFAULT_TTL = int(os.getenv("SESSION_DEFAULT_TTL", "3600"))
 
@@ -37,6 +40,7 @@ async def get(self, key: str):
             value, exp = entry
             if exp < time.time():
                 del _MemorySession._cache[key]
+                logger.debug("Memory session key expired and evicted: %s", key)
                 return None
             return value
 

src/chuk_sessions/session_manager.py

@@ -18,6 +18,7 @@
 import os
 import time
 import uuid
+from collections import OrderedDict
 from datetime import datetime, timedelta, timezone
 from typing import Any, AsyncContextManager, Callable, Optional
 
@@ -75,8 +76,9 @@ def __init__(
 
             self.session_factory = factory_for_env()
 
-        # local LRU-ish cache
-        self._session_cache: dict[str, SessionMetadata] = {}
+        # bounded LRU in-process cache
+        self._max_cache_size = 1024
+        self._session_cache: OrderedDict[str, SessionMetadata] = OrderedDict()
         self._cache_lock = asyncio.Lock()
 
         logger.debug("SessionManager initialised for sandbox: %s", self.sandbox_id)
@@ -125,7 +127,7 @@ async def allocate_session(
         await self._store_session_metadata(metadata)
 
         async with self._cache_lock:
-            self._session_cache[session_id] = metadata
+            self._cache_put(session_id, metadata)
 
         logger.debug("Session allocated: %s (user=%s)", session_id, user_id)
         return session_id
@@ -140,7 +142,7 @@ async def validate_session(self, session_id: str) -> bool:
                 return True
             return False
         except Exception as err:
-            logger.debug("Session validation failed for %s: %s", session_id, err)
+            logger.warning("Session validation failed for %s: %s", session_id, err)
             return False
 
     async def get_session_info(self, session_id: str) -> Optional[dict[str, Any]]:
@@ -182,7 +184,7 @@ async def update_session_metadata(
             await self._store_session_metadata(metadata)
 
             async with self._cache_lock:
-                self._session_cache[session_id] = metadata
+                self._cache_put(session_id, metadata)
             return True
         except Exception as err:
             logger.error(
@@ -207,7 +209,7 @@ async def extend_session_ttl(self, session_id: str, additional_hours: int) -> bo
             await self._store_session_metadata(metadata)
 
             async with self._cache_lock:
-                self._session_cache[session_id] = metadata
+                self._cache_put(session_id, metadata)
             logger.debug("Extended session %s by %dh", session_id, additional_hours)
             return True
         except Exception as err:
@@ -235,6 +237,16 @@ async def delete_session(self, session_id: str) -> bool:
     # Internal helpers
     # ──────────────────────────────────────────────────────────────────────
 
+    def _cache_put(self, session_id: str, metadata: SessionMetadata) -> None:
+        """Insert/update an entry and evict the LRU entry if over capacity.
+
+        Must be called while holding _cache_lock.
+        """
+        self._session_cache[session_id] = metadata
+        self._session_cache.move_to_end(session_id)
+        if len(self._session_cache) > self._max_cache_size:
+            self._session_cache.popitem(last=False)
+
     def _generate_session_id(self, user_id: Optional[str] = None) -> str:
         timestamp = int(time.time())
         rnd = uuid.uuid4().hex[:8]
@@ -266,7 +278,7 @@ async def _get_session_metadata(self, session_id: str) -> Optional[SessionMetada
                 return None
             # re-cache
             async with self._cache_lock:
-                self._session_cache[session_id] = metadata
+                self._cache_put(session_id, metadata)
             return metadata
         except Exception as err:
             logger.debug("Failed fetching session %s: %s", session_id, err)
@@ -296,7 +308,7 @@ async def _store_session_metadata(self, metadata: SessionMetadata) -> None:
                 await session.setex(key, ttl, json.dumps(metadata.to_dict()))
 
             async with self._cache_lock:
-                self._session_cache[metadata.session_id] = metadata
+                self._cache_put(metadata.session_id, metadata)
         except Exception as err:
             logger.error("Session storage failed for %s: %s", metadata.session_id, err)
             raise SessionError(f"Session storage failed: {err}") from err
@@ -320,6 +332,7 @@ async def cleanup_expired_sessions(self) -> int:
     def get_cache_stats(self) -> dict[str, Any]:
         return {
             "cached_sessions": len(self._session_cache),
+            "max_cache_size": self._max_cache_size,
             "sandbox_id": self.sandbox_id,
             "default_ttl_hours": self.default_ttl_hours,
         }

src/chuk_sessions/utils/__init__.py

@@ -0,0 +1,9 @@
+from datetime import datetime, timezone
+
+
+def utc_now_iso() -> str:
+    """Return the current UTC time as an ISO 8601 string with a Z suffix."""
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+__all__ = ["utc_now_iso"]