CVS commit: [pkgsrc-2026Q3] pkgsrc/databases/redis

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 13:18:46 UTC 2026

Modified Files:
        pkgsrc/databases/redis [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7377 - requested by taca
databases/redis: Security fix

Revisions pulled up:
- databases/redis/Makefile                                      1.107
- databases/redis/distinfo                                      1.96

---
   Module Name: pkgsrc
   Committed By:        adam
   Date:                Tue Nov 10 09:03:35 UTC 2026

   Modified Files:
        pkgsrc/databases/redis: Makefile distinfo

   Log Message:
   redis: updated to 8.10.3

   Redis 8.10.3

   Update urgency: `SECURITY`: There are security fixes in the release.

   Security fixes

   - Heap buffer overflow when propagating a `PUBLISH`/`SPUBLISH` message larger than 4GB over the cluster bus in cluster mode

   Redis 8.10.2

   Update urgency: `SECURITY`: There are security fixes in the release.

   Security fixes

   - Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
   - The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now 
warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` 
and the node starts only when `tls-cluster` authenticates the bus
   - TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
   - RedisSearch: KNN queries on indexes with very long vector field names could cause the server to crash
   - Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash


To generate a diff of this commit:
cvs rdiff -u -r1.106 -r1.106.2.1 pkgsrc/databases/redis/Makefile
cvs rdiff -u -r1.95 -r1.95.2.1 pkgsrc/databases/redis/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/databases/redis/Makefile
diff -u pkgsrc/databases/redis/Makefile:1.106 pkgsrc/databases/redis/Makefile:1.106.2.1
--- pkgsrc/databases/redis/Makefile:1.106       Mon Sep  7 08:42:39 2026
+++ pkgsrc/databases/redis/Makefile     Wed Nov 11 13:18:46 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.106 2026/09/07 08:42:39 jperkin Exp $
+# $NetBSD: Makefile,v 1.106.2.1 2026/11/11 13:18:46 maya Exp $
 
-DISTNAME=      redis-8.10.1
+DISTNAME=      redis-8.10.3
 CATEGORIES=    databases
 MASTER_SITES=  http://download.redis.io/releases/
 

Index: pkgsrc/databases/redis/distinfo
diff -u pkgsrc/databases/redis/distinfo:1.95 pkgsrc/databases/redis/distinfo:1.95.2.1
--- pkgsrc/databases/redis/distinfo:1.95        Thu Aug 20 07:52:06 2026
+++ pkgsrc/databases/redis/distinfo     Wed Nov 11 13:18:46 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.95 2026/08/20 07:52:06 adam Exp $
+$NetBSD: distinfo,v 1.95.2.1 2026/11/11 13:18:46 maya Exp $
 
-BLAKE2s (redis-8.10.1.tar.gz) = 61f0c8b91dfd6444290ce76335c953f9aae8d53b4d105656caf486f397d3830a
-SHA512 (redis-8.10.1.tar.gz) = 9212dabeb4b47a7e5ef06019a980e89013316446504d3bc97d95a536cc296fe77f654ce1fa813f2667ff7d6f21de16b0dbb8055522c02f409ba3d2ca6f6a399d
-Size (redis-8.10.1.tar.gz) = 21568866 bytes
+BLAKE2s (redis-8.10.3.tar.gz) = bf060fd6d56d8710b0d0d639493d1ad5bbe9ba6d4a5cffb17e014db5d72ea75f
+SHA512 (redis-8.10.3.tar.gz) = 8b73de77f2d13f1f12ef8ab12075afca79f7221bfcd886f31779e0d4b4cb7309eefd94e32de5ad8527c9681f2f5cac82fe8a46e0ad751ad9c3e4b3baf2233c78
+Size (redis-8.10.3.tar.gz) = 21647086 bytes
 SHA1 (patch-redis.conf) = a16fd0c559c9fbe0237b719d92a59259ae19c41a
 SHA1 (patch-src_Makefile) = a2817ec27efc11b11e77b4ed310a7dec7e1d39d4
 SHA1 (patch-src_hyperloglog.c) = 86d138b76271cc035b9fa28b0b5c3462430cd950