Vulnerabilities & updates
Mon, September 28
8.12-m02-int: Explain a test [TIMEOUT] instead of killing it silently (#15879)
A hung test run tells us almost nothing today. When no client has made progress for --timeout seconds, test_server_cron prints the clients' last reported state, SIGKILLs every server via force_kill_all_servers and exits; --dump-logs only fires for a failed or excepted test, never for a timeout. So a 20-minute hang costs a whole CI run and produces a few lines. Collect the evidence before tearing the run down: Crash-report the surviving servers. SIGSEGV makes redis log a stack trace of every one of its threads plus INFO, the client list and the config (printCrashReport) and then die. The handl…
Fri, September 18
8.10.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.8.3
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.6.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
Thu, September 17
8.4.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.2.10
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus TimeSeries: Prevented Redis from crashing when adding samp…
Tue, September 15
8.12-m01-int: Add aof_cmd_duration estimate for AOF reload RTO visibility
Expose a best-effort AOF replay-time estimate in INFO persistence so operators can gauge reload RTO. Count time only for writes that enter the AOF, credit leftover call() time to synthetic rewrites, and skip the bookkeeping when AOF is off.
Thu, August 20
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security compares UserVerificationRequirement using identity ( == ) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED . The identity comparison evaluates to…
Tue, August 18
8.10.1
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access Vector Sets…
8.8.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
8.6.6
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
Thu, July 2
Laravel June product updates
You can now run Symfony apps on Laravel Cloud, managed Valkey caches and object storage are available in Forge, Bus::bulk() for efficient batch dispatch, and MCP client and server tooling across Laravel's AI stack. Here's everything that shipped in June.
Fri, May 1
What's new in Swift: April 2026 Edition
Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. The 1.0 release of valkey-swift was recently announced on the Valkey blog . We’ve invited one of the authors to be this month’s guest contributor: Hi, I’m Adam Fowler, an open source developer working in the Swift on server ecosystem. I am excited to announce the 1.0 release of valkey-swift - a production-grade Swift client for Valkey . Valkey is a high-performance datastore commonly used as a caching layer or message broker in server applications. It is an open source f…
Tue, February 3
Laravel January Product Releases
January brings Private Cloud, Valkey caching, expanded Cloud API, plus Forge backup options and Nightwatch real-time exception detection.
Sat, October 11
Bun 1.3
Bun 1.3 introduces zero-config frontend development, unified SQL API, built-in Redis client, security enhancements, package catalogs, async stack traces, VS Code test integration, and Node.js compatibility improvements.
Sun, September 28
Bun v1.2.23
Fixes 119 issues (addressing 412 👍). pnpm-lock.yaml migration for seamless switching from pnpm to bun install, Redis Pub/Sub support, concurrent test execution with configurable parallelism, platform-specific dependency filtering with --cpu and --os flags, system CA certificates support with --use-system-ca, Windows code signing for compiled executables, JSX configuration improvements in Bun.build, sql.array helper for parameterized arrays, randomized test ordering, stricter CI test defaults, process.report.getReport() on Windows, and numerous Node.js compatibility improvements including htt…
Thu, April 24
Unbound 1.23.0 released
We are pleased to announce the release of version 1.23.0 of the Unbound recursive DNS resolver. This release features changed defaults, fast reload, redis replica, DNS Error Reporting, and bug fixes. The fast reload is a feature that is listed as experimental. With unbound-control fast_reload the server can …
Thu, April 17
Bun v1.2.10
Fixes 33 bugs (addressing 33 👍). setImmediate gets faster. Reliability improvements for filesystem operations. Fixes test.failing with done callbacks. Fixes default idle timeout in Redis client. Fixes importing from 'bun' module with bytecode compilation. Default Docker image updated to Debian Bookworm.
Wed, April 9
Bun v1.2.9
Fixes 48 bugs (addressing 116 👍). Bun.redis is a builtin Redis client for Bun. `ListObjectsV2` support in `Bun.S3Client`, more `libuv` symbols, `require.extensions` & require.resolve paths, bugfixes in `node:http`, `AsyncLocalStorage`, and `node:crypto`. Shell reliability improvements.
Wed, December 13
Deno KV vs. Cloudflare Workers KV, Upstash Redis, AWS DynamoDB, and Google Firestore
We compare Deno KV to other serverless data stores on performance, price, developer experience, and more.
Wed, November 8
Unbound 1.19.0 released
We are pleased to announce the release of version 1.19.0 of the Unbound recursive DNS resolver. This release fixes a number of bugs, and adds some smaller features. The redis-logical-db option and cachedb-no-store option can be used for cachedb configuration. The disable-edns-do option can be used for working …
Tue, September 12
GitLab Patch Release: 16.3.3
On September 12, 2023, we released versions 16.3.3 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. GitLab Community Edition and Enterprise Edition 16.3.3 Pin redis-client to v0.17.0 Backport !6251 to 16-3-stable Backport create ci_pipelines iid sequence on new projects to 16.3 Backport 16.3 Fix cluster service reindexing params Patch UpdateCiMaxTotalYamlSizeBytesDefaultValue - stable branch Remove gdk base image and pin gdk sha Backport Enable sync with package metadata db by default Backport “Prevent pipeline creation while import…
GitLab Patch Release: 16.2.6
On September 12, 2023, we released versions 16.2.6 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. GitLab Community Edition and Enterprise Edition 16.2.6 Pin redis-client to v0.14.1 praefect: Handle replica paths in ’track-repository’ and ’track-repositories’ subcommands Backport create ci_pipelines iid sequence on new projects to 16.2 Backport “Drop bridge jobs on unknown failures” to 16.2 Backport “Prevent pipeline creation while import is running” to 16.2 Important notes on upgrading This version does not include any new migrati…
Tue, May 4
Vapor: Redis 6.x Clusters Are Now Available
Starting today, in addition to Redis 5.x Clusters, you may now also create and manage Redis 6.x Clusters. Redis 6.x is the latest version of open-source Redis software. This new version brings improved security and boosts the performance of your cache.
Mon, September 7
Forge: TLS v1.3, Redis Passwords and more!
Over the last few weeks, we've been working on many new features and enhancements in Forge. I often [tweet](https://twitter.com/jbrooksuk) about these changes since they don’t warrant a full-blown blo...