redis: upgrade 8.0.0 -> 8.0.6

License-Update:
- Upstream has removed incorrect gplv3 text from the license (because agplv3
  is the correct), which changed the checksum
- The recipe had incorrect license indication. Redis 8 is not BSD licensed,
  but depending on the user's choice, it's agplv3 or sspl (or custom redis
  license, which is not added to the list)

Changelogs:
8.0.6:
- Security fix: A user can manipulate data read by a connection by
  injecting \r\n sequences into a Redis error reply

8.0.5:
Bugfixes:
- HGETEX - potential crash when FIELDS is used and numfields is missing
- Potential crash on HyperLogLog with 2GB+ entries
- Cuckoo filter - Division by zero in Cuckoo filter insertion
- Cuckoo filter - Counter overflow
- Bloom filter - Arbitrary memory read/write with invalid filter
- Bloom filter - Out-of-bounds access with empty chain
- Bloom filter - Restore invalid filter [We thank AWS security for
  responsibly disclosing the security bug]
- Top-k - Out-of-bounds access

8.0.4:
Security fixes
- (CVE-2025-49844) A Lua script may lead to remote code execution
- (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
- (CVE-2025-46818) A Lua script can be executed in the context of another user
- (CVE-2025-46819) LUA out-of-bound read

New Features
- VSIM: new EPSILON argument to specify maximum distance

Bug fixes
- Potential use-after-free after pubsub and Lua defrag
- Potential crash on Lua script defrag
- HINCRBYFLOAT removes field expiration on replica
- Prevent CLIENT UNBLOCK from unblocking CLIENT PAUSE
- Endless client blocking for blocking commands
- Vector sets - RDB format is not compatible with big endian machines
- EVAL crash when error table is empty
- Gracefully handle short read errors for hashes with TTL during full sync

8.0.3:
Security fixes
- (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
- (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error

New Features
- VSIM: Add new WITHATTRIBS to return the JSON attribute associated with an element

Bug fixes
- A short read may lead to an exit() on a replica
- db->expires is not defragmented

8.0.2:
Security fixes
- (CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE

Bug fixes
- Cron-based timers run twice as fast when active defrag is enabled

Other general improvements
- LOLWUT for Redis 8

8.0.1:
Performance and resource utilization improvements
- Vector sets - faster VSIM FILTER parsing

Bug fixes
- Query Engine - revert default policy search-on-timeout to RETURN
- Query Engine - @__key on FT.AGGREGATE used as reserved field name preventing access to Redis keyspace
- Query Engine - crash when calling FT.CURSOR DEL while retrieving from the CURSOR

Notes
- Fixed wrong text in the license files

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2026-03-08 19:59:15 +01:00 committed by Khem Raj
parent 75e14941ba
commit ec741a75f0
No known key found for this signature in database
GPG Key ID: BB053355919D3314
9 changed files with 3 additions and 3 deletions

View File

@ -2,8 +2,8 @@ SUMMARY = "Redis key-value store"
DESCRIPTION = "Redis is an open source, advanced key-value store."
HOMEPAGE = "http://redis.io"
SECTION = "libs"
LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=4feb9943a139a170b9d6ed6ec3342d0c"
LICENSE = "AGPL-3.0-only | SSPL-1.0"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=9f1da87999fb281d8a9e3e3b2d0403b4"
DEPENDS = "readline lua ncurses"
SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
@ -16,7 +16,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
file://0004-src-Do-not-reset-FINAL_LIBS.patch \
file://0005-Define-_GNU_SOURCE-to-get-PTHREAD_MUTEX_INITIALIZER.patch \
"
SRC_URI[sha256sum] = "cf395665ba5fcecc4ef7aed1d8ab19c268619d98595827565c82344160171262"
SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229"
RPROVIDES:${PN} = "virtual-redis"