Fix thread-safety of Headers::Normalizer cache

Move the normalizer's header name cache from a shared instance variable
(@cache) to per-thread storage (Thread.current), eliminating a race
condition when multiple threads share a normalizer instance.

Author: sferik

CHANGELOG.md

@@ -47,6 +47,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Thread-safety: `Headers::Normalizer` cache is now per-thread via
+  `Thread.current`, eliminating a potential race condition when multiple
+  threads share a normalizer instance
 - Instrumentation feature now correctly starts a new span for each retry
   attempt, fixing `NoMethodError` with `ActiveSupport::Notifications` when
   using `.retriable` with the instrumentation feature (#826)

lib/http/headers/normalizer.rb

@@ -11,16 +11,8 @@ class Normalizer
       # Pattern matching header name part separators (hyphens and underscores)
       NAME_PARTS_SEPARATOR_RE = /[-_]/
 
-      # Creates a new Normalizer with an empty cache
-      #
-      # @example
-      #   normalizer = HTTP::Headers::Normalizer.new
-      #
-      # @return [Normalizer]
-      # @api public
-      def initialize
-        @cache = {} #: Hash[String, String]
-      end
+      # Thread-local cache key for normalized header names
+      CACHE_KEY = :http_headers_normalizer_cache
 
       # Normalizes a header name to canonical form
       #
@@ -31,7 +23,8 @@ def initialize
       # @api public
       def call(name)
         name  = name.to_s
-        value = (@cache[name] ||= normalize_header(name))
+        cache = (Thread.current[CACHE_KEY] ||= {})
+        value = (cache[name] ||= normalize_header(name))
 
         value.dup
       end

sig/http.rbs

@@ -248,25 +248,10 @@ module HTTP
 
   class Headers
     class Normalizer
-      CANONICAL_NAME_RE: Regexp
       COMPLIANT_NAME_RE: Regexp
       NAME_PARTS_SEPARATOR_RE: Regexp
+      CACHE_KEY: Symbol
 
-      @cache: Cache
-
-      class Cache
-        MAX_SIZE: Integer
-
-        @store: Hash[String, String]
-
-        def initialize: () -> void
-        def get: (String key) -> String?
-        alias [] get
-        def set: (String key, String value) -> String
-        alias []= set
-      end
-
-      def initialize: () -> void
       def call: (String | Symbol name) -> String
 
       private

test/http/headers/normalizer_test.rb

@@ -6,6 +6,8 @@
   cover "HTTP::Headers::Normalizer*"
   let(:normalizer) { HTTP::Headers::Normalizer.new }
 
+  before { Thread.current[HTTP::Headers::Normalizer::CACHE_KEY] = nil }
+
   describe "#call" do
     it "normalizes the header" do
       assert_equal "Content-Type", normalizer.call("content_type")