✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

✅ PR preview is ready!

Summary

This PR adds a new scope parameter to st.cache_data and st.cache_resource decorators, enabling session-level caching alongside the existing global caching. Key changes include:

• New scope parameter: Accepts "global" (default) or "session" values
• Session-scoped cache storage: Session caches are stored separately using the session ID as a key dimension
• Automatic cleanup: Session caches are cleared when sessions disconnect or shut down, with on_release callbacks invoked
• New clear_session() API method: Added to both cache APIs for programmatic session cache clearing

This feature addresses several GitHub issues (#8545, #6703) by enabling session-scoped resource management and disconnect hooks.

Code Quality

The implementation is clean and follows existing codebase patterns well:

Strengths:

• Consistent implementation across both cache_data and cache_resource APIs
• Proper type annotations using CacheScope type alias
• Thread-safe implementation with appropriate locking in DataCaches and ResourceCaches
• Clear error messages for invalid scope values
• Well-documented with comprehensive docstrings explaining behavior and edge cases

Minor Issues:

1. Unused function in test file (lib/tests/streamlit/runtime/caching/cache_utils_test.py, lines 26-29):

   def function_for_testing(
       pos_one: int, pos_two: int, _scope: str, pos_three: int
   ) -> str:
       """Dummy function for testing function caches."""
       return f"{pos_one}-{pos_two}-{_scope}-{pos_three}"

   This function is defined but never used in the test file.

2. Missing return type annotation on clear_session methods (cache_data_api.py line 693, cache_resource_api.py line 603):
   For consistency with other methods, consider adding explicit -> None return type annotation.

3. Double cache clearing on shutdown: clear_session_caches() is called both in app_session.py:shutdown() (line 277) and in _handle_scriptrunner_event_on_event_loop() (line 706) when shutdown is requested. While this is idempotent and safe, it may cause redundant work. This appears intentional to ensure cleanup in all scenarios (sync and async paths).

Test Coverage

The test coverage is comprehensive and well-structured:

Covered scenarios:

• ✅ Session scope cache lookups with multiple sessions (test_session_scope_handles_lookup)
• ✅ Clearing individual session caches without affecting others (test_session_scope_handles_clear)
• ✅ Bad scope parameter validation (test_bad_scope_raises_exception)
• ✅ get_session_id_or_throw function behavior (GetSessionIdOrThrowTest)
• ✅ clear_session_caches method in AppSession (test_clear_session_caches)
• ✅ Shutdown behavior calling clear_session (test_shutdown)
• ✅ Parameterized tests covering both cache_data and cache_resource

Tests follow best practices:

• Uses @parameterized.expand to reduce code duplication
• Uses proper mocking with patch.object
• Tests include docstrings describing their purpose
• Tests verify cache isolation between sessions

Potential additions (optional):

• Test for on_release callback being invoked when session cache is cleared (for cache_resource)
• Integration test for interaction between session-scoped and global-scoped caches with the same function key
• Test for behavior when persist="disk" is combined with scope="session" (edge case)

Backwards Compatibility

✅ Fully backwards compatible:

• The scope parameter defaults to "global", preserving existing behavior
• No breaking changes to existing APIs or method signatures
• Existing user code will continue to work without modification
• Global cache behavior is unchanged

Security & Risk

No security concerns identified:

• Memory is properly managed with cache cleanup on session disconnect
• Thread safety is maintained with appropriate locking
• No new attack vectors introduced

Low regression risk:

• Changes are additive and well-isolated
• The default behavior (scope="global") is unchanged
• Edge cases are documented (e.g., reconnected sessions may repopulate cache)

Note on documented behavior:
The docstring correctly notes that "disconnected sessions can reconnect - so it is possible for the cache to populate multiple times in a single session for the same key." This is appropriate documentation of expected behavior.

Recommendations

1. Remove unused test function: Delete function_for_testing from cache_utils_test.py (lines 26-29) as it serves no purpose.

2. Add return type annotation (optional): Add -> None to clear_session methods in both API classes for consistency:

   def clear_session(self, session_id: str) -> None:

3. Consider adding typing test (optional): Add a test case in lib/tests/streamlit/typing/cache_types.py to verify the scope parameter is properly typed:

   @st.cache_data(scope="session")
   def cached_data_fn_with_scope(arg1: int) -> bool:
       return True

4. Consider adding example (optional): Adding a usage example for session-scoped caching in the docstring would help users understand the feature:

   >>> @st.cache_resource(scope="session", on_release=lambda x: x.close())
   ... def get_session_connection():
   ...     return create_connection()

Verdict

APPROVED: This is a well-implemented feature that addresses a real user need for session-scoped caching. The code quality is high, test coverage is comprehensive, and the implementation follows existing patterns in the codebase. The minor issues noted (unused test function, missing return type annotation) are not blockers and can be addressed in a follow-up if desired.

This is an automated AI review. Please verify the feedback and use your judgment.