Update dependency redis to v4.4.4 [SECURITY] #47
Merged
+1
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/pypi-redis-vulnerability
branch
from
cbd8d5a to
cd4bc83
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==4.2.2->==4.4.4GitHub Vulnerability Alerts
CVE-2023-28859
redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.
CVE-2023-28858
redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but are believed to be incomplete. CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.
Release Notes
redis/redis-py (redis)
v4.4.4: 4.4.4Compare Source
Changes
Upgrade urgency: SECURITY, contains fixes to security issues.
🐛 Bug Fixes
v4.4.3: 4.4.3Compare Source
Changes
Update urgency: HIGH: There is a critical bug that may affect a subset of users. Upgrade!
🐛 Bug Fixes
v4.4.2: 4.4.2Compare Source
Changes
Note: this release include #2548 and it is suggested that users upgrade immediately.
🧪 Experimental Features
🚀 New Features
🐛 Bug Fixes
Contributors
We'd like to thank all the contributors who worked on this release!
@Threated, @dvora-h, @shacharPash and @zakaf
v4.4.1: 4.4.1Compare Source
Changes
🚀 New Features
FT.AGGREGATE(#2537)resetchannelsinACL SETUSER(#2514)🐛 Bug Fixes
__eq__in graph classes (#2531)exparameter insetcommand (#2529)🧰 Maintenance
DeprecationWarningby replaceget_event_loopwithget_running_loop(#2530)JSON.ARRINDEXtest (#2527)Contributors
We'd like to thank all the contributors who worked on this release!
@DvirDukhan, @SessionIssue, @YiuRULE, @chayim, @dgilmanAIDENTIFIED, @dvora-h, @kristjanvalur, @mohsinhaider, @raz-mon, @shacharPash, @stitchWzc, @uglide, @vmihailenco, @winmorre and @zakaf
v4.4.0: Version 4.4.0Compare Source
Changes
4.4.0rc4 release notes
4.4.0rc3 release notes
4.4.0rc2 release notes
4.4.0rc1 release notes
🚀 New Features (since 4.4.0rc4)
🐛 Bug Fixes (since 4.4.0rc4)
geosearchcommand (#2464)🧰 Maintenance (since 4.4.0rc4)
Contributors (since 4.4.0rc4)
We'd like to thank all the contributors who worked on this release!
@Sibuken, @barshaul, @chayim, @dvora-h, @nermiller, @uglide and @utkarshgupta137
v4.3.6: 4.3.6Compare Source
Changes
Update urgency: HIGH: There is a critical bug that may affect a subset of users. Upgrade!
🐛 Bug Fixes
v4.3.5: Version 4.3.5Compare Source
Changes
This is a maintenance release of redis-py, prior to the release of 4.4.0. This release contains both bug fixes, and features, keeping pace with the release of redis-stack capabilities.
🚀 New Features
🐛 Bug Fixes
🧰 Maintenance
Contributors
We'd like to thank all the contributors who worked on this release!
@sileht, @utkarshgupta137, @dvora-h, @akx, @bodevone, @chayim, @DvirDukhan
v4.3.4: Version 4.3.4Compare Source
Changes
🔥 Breaking Changes
XAUTOCLAIMto return the full response, instead of only keys 2+ (#2252)🚀 New Features
🐛 Bug Fixes
🧰 Maintenance
Contributors
We'd like to thank all the contributors who worked on this release!
@Iglesys347, @barshaul, @dvora-h, @earthgecko, @elemoine, @falk-h, @kristjanvalur, @psrok1 and @utkarshgupta137
v4.3.3: Version 4.3.3Compare Source
Changes
🐛 Bug Fixes
🧰 Maintenance
Contributors
We'd like to thank all the contributors who worked on this release!
@dvora-h and @utkarshgupta137
v4.3.2: Version 4.3.2Compare Source
Changes
🚀 New Features
🐛 Bug Fixes
🧰 Maintenance
Contributors
We'd like to thank all the contributors who worked on this release!
@Avital-Fine, @Olegt0rr, @WisdomPill, @dvora-h, @grippy, @mfgnik, @rapidia, @ryanrussell and @utkarshgupta137
v4.3.1: Version 4.3.1Compare Source
Changes
🐛 Bug Fixes
Contributors
We'd like to thank all the contributors who worked on this release!
@dvora-h
v4.3.0: Version 4.3.0Compare Source
Changes
🔥 Breaking Changes
can_readwithredis.ConnectionError(#2140)🚀 New Features
PubSub.run()without previoussubscribe()(#2148)Retry(): Support negativeretriesvalue (#2110)🐛 Bug Fixes
🧰 Maintenance
Contributors
We'd like to thank all the contributors who worked on this release!
@Andrew-Chen-Wang, @Ankhas, @Avital-Fine, @JelleZijlstra, @chayim, @dvora-h, @enjoy-binbin, @kamyabzad, @kristjanvalur, @richli, @suxb201 and @utkarshgupta137
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.