• Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592 by @kim-jhyeon, reported in #590):
  • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
  • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
  • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

• Worked around a ThreadSanitizer false positive (#602):
  • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
  • std::sync::Arc has a similar workaround.
• Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603):
  • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
  • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.

• Fixed a bug where re-inserting an expired entry could cause it to lose its expiration time and remain in the cache indefinitely when using a custom Expiry policy with per-entry expiration. (#582 by @jiangzhe, #581 by @atrocities, reported in #575):
  • This occurred when an entry that had expired but not yet been evicted was re-inserted, and expire_after_update returned None. This primarily affected users who only override expire_after_create, since the default expire_after_update returns duration_until_expiry, which is None for expired entries.
  • This bug was introduced by the changes in v0.12.13 (#549 and #564).
  • Subtle behavior change:
    • Before this fix, re-inserting an expired entry was treated as an update, so Expiry::expire_after_update was called.
    • After this fix, re-inserting an expired entry is treated as a creation, so Expiry::expire_after_create is called instead.
    • This may change the expiration time of re-inserted entries, depending on your Expiry trait implementation.
• Fixed flaky tests cht::segment::tests::drop_many_values and drop_many_values_concurrent that were failing on high-core-count machines (#586):
  • These tests were using a CPU-dependent segment count, causing inconsistent bucket array shrinking behavior of the internal segmented hash map across different machines.
  • Changed these tests to use a fixed segment count (4) for consistent results.

• Disabled flaky GC-dependent tests by default using run_flaky_tests cfg (#584):
  • These tests rely on epoch-based garbage collection (crossbeam-epoch) timing that is not guaranteed, causing intermittent failures.
  • Fixed #539 and #580.
  • To run these tests, set RUSTFLAGS='--cfg run_flaky_tests'.

• Fixed a race condition in the and_compute_with method in the future::Cache. (#574 by @Squadrick):
  • When multiple calls are made concurrently for the same key, the f closure may read a stale value, causing the first update to be lost when it is overwritten by a later one.

• Use dep: keyword in the crate features. (#577 by @alexanderkjall).

• Fixed/mitigated use-after-free issues in the hierarchical timer wheels when Expiry returns None (Issue #565, reported by @sharksforarms).
  • Fixed a bug that caused freed timer nodes to remain in the timer wheels in some edge cases (#566 by @powergee).
  • The mitigation added to v0.12.12 was enhanced by atomically reading the expiration state to prevent rare race conditions that could cause use-after-free issues (#570).
• Fixed Expiry::expire_after_update not clearing expiration time for expired entries (future::Cache: #549, by @singulared, sync::Cache: #564).

Bumped the minimum supported Rust version (MSRV) to 1.71.1, released on August 3, 2023 (#555).

• Mitigated use-after-free panic in the hierarchical timer wheels when Expiry returns None (#548, by @awarus).
• Fixed a subtle undefined behavior in the internal deque::move_to_back method (found by Miri) (#553).

• impl Expiry for some types (#519, by @koushiro).

• Removed several unneeded files from the published package (#541, by @weiznich).
• Removed the once_cell crate from the dependencies (#520, by @Expyron).
• Removed the rustc_version crate from the dev-dependencies (#554).