On 10/26/26 1:51 PM, Joe Orton wrote:
> On Mon, Oct 26, 2026 at 12:27:48PM +0100, Arturo Bernal wrote:
>> Hi Joe,
>>
>> Looks good to me overall. Just a few thoughts, unless I'm missing something.
>>
>> For mod_lua, I don't think server/thread scopes are actually documented as
>> not thread-safe. My understanding is that the main concern is state
>> surviving across requests. I'd also be a bit cautious about excluding all
>> memory corruption involving persistent scopes.
>
> OK I removed that paragraph.
Isn't the below the paragraph we are talking about?
+The non-default long-lived `LuaScope server`, `thread` and `conn`
+settings share one Lua VM across requests, and `server`/`thread` are
+documented as not thread-safe. A VM that outlives the request it was
+used for, together with any request-bound object retained in it across
+requests (the request userdata, a request-derived table, a database
+result or prepared statement), is a script-lifecycle hazard owned by
+the trusted author of the configuration. Stale-pointer crashes,
+cross-request disclosure and memory corruption which depend on one of
+these scopes are therefore out of scope; the default `LuaScope once`
+gives each request a fresh VM.
If yes it is still in the new patch.
Regards
Rüdiger
