#3734 SPAM Pull request opened by ryanduguid Summary Prevents SDK sample HTTP caches from persisting authentication material in the repository or on disk without sanitisation. • disables persistent caching entirely for DummyJSON login and token-refresh POSTs; • moves sample response caches to a process-owned temporary directory by default, while allowing tests/callers to inject a path; • sanitises request

Authorization

,

Private-Token

, proxy/API-token headers, cookies, response

Set-Cookie

, URL userinfo and authentication query parameters before requests-cache serialisation; • removes recognised credential fields from valid JSON/form bodies and fails closed by clearing malformed JSON/form or unsupported opaque POST bodies from the cached representation; • clears response/request cookie jars and sanitises redirect request metadata; • uses the shared safe session in the DummyJSON, GitLab and unauthenticated Countries sample producers; • declares the previously implicit GitLab

requests-cache

runtime dependency and updates only its lock metadata; • ignores future

.http_cache/

directories without deleting or inspecting the 116 currently tracked cache fixtures. Confidentiality boundary This draft deliberately does not read, rewrite, delete or include the contents of any tracked cache file. Existing cache fixture classification, deletion, history remediation and credential rotation require a confidential maintainer review and are outside this code-only contribution. Verification at

6bc474405d308142b4cd97b08ec7d05f6f127c59

•

uv sync --locked --python 3.13 --no-dev --group testing --all-packages

completed; • all three sample cache producer modules imported from that clean locked environment; •

pytest tests/helpers/test_http_cache.py -q

— 3 passed using synthetic marker secrets only; • the cache-file regressions recursively scan only their own temporary synthetic cache and prove header/query/body/userinfo marker values are absent, including malformed JSON/form and opaque bodies; • the adapter snapshot proves authentication and request bodies still reach the transport before the response hook sanitises the cache representation; • Ruff check and format checks passed for every changed Python file; •

git diff --check

passed. No external API or service was contacted by the tests. Summary by Sourcery Keep SDK sample authentication material out of persistent HTTP caches while preserving safe caching behavior for sample data. New Features: • Add a shared safe filesystem-backed HTTP cache for SDK sample taps with configurable cache locations and credential-aware cache keys. Bug Fixes: • Prevent authentication material from being persisted in cached requests and responses, including headers, cookies, URL userinfo, authentication query parameters, JSON/form bodies, redirects, and response payloads. • Prevent distinct credentials and pagination cursors from incorrectly sharing cache entries. • Disable persistence for DummyJSON authentication and token-refresh requests. Enhancements: • Use the safe cache session across the Countries, DummyJSON, and GitLab sample producers while keeping live requests and caller-visible responses unchanged. Build: • Declare the shared cache extras and GitLab's requests-cache runtime dependency, updating the lock metadata. Tests: • Add comprehensive synthetic cache regression coverage for credential sanitisation, cache isolation, redirects, response handling, malformed and opaque bodies, and default cache placement. Chores: • Ignore future .http_cache directories without modifying existing tracked cache fixtures. meltano/sdk