Log message:
redis: updated to 7.0.11

Redis 7.0.11 Released Mon Apr 17 16:00:00 IST 2023
================================================================================

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create
  an invalid hash field that will crash Redis on access

Bug Fixes
=========

* Add a missing fsync of AOF file in rare cases
* Disconnect pub-sub subscribers when revoking allchannels permission

Platform / toolchain support related improvements
=================================================

* Fix a compiler fortification induced crash when used with link time optimizations

Log message:
redis: updated to 7.0.10

7.0.10

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:

(CVE-2023-28425) Specially crafted MSETNX command can lead to assertion and \ 
denial-of-service

Bug Fixes

Large blocks of replica client output buffer may lead to PSYNC loops and \ 
unnecessary memory usage
Fix CLIENT REPLY OFF|SKIP to not silence push notifications
Trim excessive memory usage in stream nodes when exceeding stream-node-max-bytes
Fix module RM_Call commands failing with OOM when maxmemory is changed to zero

Log message:
redis: updated to 7.0.9

Redis 7.0.9

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD
  commands can trigger an integer overflow, resulting in a runtime assertion
  and termination of the Redis server process.
* (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially
  crafted pattern to trigger a denial-of-service attack on Redis, causing it to
  hang and consume 100% CPU time.

Bug Fixes
=========
* Fix a crash when reaching the maximum invalidations limit of client-side tracking
* Fix a crash when SPUBLISH is used after passing the cluster-link-sendbuf-limit
* Fix possible memory corruption in FLUSHALL when a client watches more than one key
* Fix cluster inbound link keepalive time
* Flush propagation list in active-expire of writable replicas to fix an assertion
* Avoid propagating DEL of lazy expire from SCAN and RANDOMKEY as MULTI-EXEC

Performance and resource utilization improvements
=================================================
* Avoid realloc to reduce size of strings when it is unneeded
* Improve CLUSTER SLOTS reply efficiency for non-continuous slots

Log message:
redis: updated to 7.0.8

Redis 7.0.8 Released Mon Jan 16 12:00:00 IDT 2023

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO
  commands can drive Redis to OOM panic
* (CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER
  commands can lead to denial-of-service

Bug Fixes
* Avoid possible hang when client issues long KEYS, SRANDMEMBER, HRANDFIELD,
  and ZRANDMEMBER commands and gets disconnected by client output buffer limit
* Make sure that fork child doesn't do incremental rehashing
* Fix a bug where blocking commands with a sub-second timeout would block forever
* Fix sentinel issue if replica changes IP

Log message:
redis: updated to 7.0.7

Redis 7.0.7
===========

Upgrade urgency: MODERATE, Contains fix for a regression in Geo commands.

Bug Fixes
* Fix regression from Redis 7.0.6 in distance replies of Geo commands

Log message:
redis: updated to 7.0.6

Redis 7.0.6
===========

Upgrade urgency: MODERATE, Contains fixes for a few non-critical or unlikely bugs,
and some dramatic optimizations to Geo, EVAL, and Sorted sets commands.

Potentially Breaking Bug Fixes for new Redis 7.0 features
=======================================================

* RM_ResetDataset module API should not clear the functions
* RM_Call module API used with the "C" flag to run scripts, would now cause
  the commands in the script to check ACL with the designated user

Performance and resource utilization improvements
=================================================

* Geo commands speedups
* Fix EVAL command performance regression from Redis 7.0
* Reduce EXPIRE commands performance regression from Redis 7.0
* Optimize commands returning double values, mainly affecting zset commands
* Optimize Lua parsing of some command responses
* Optimize client memory usage tracking operation while client eviction is disabled

Platform / toolchain support related improvements
=================================================

* Fix compilation on Solaris

Module API changes
==================

* RM_SetContextUser, RM_SetModuleUserACLString, RM_GetModuleUserACLString
* Fix crash in CLIENT_CHANGE event, when the selected database is not 0

Changes in CLI tools
====================

* redis-benchmark avoid aborting on NOPERM from CONFIG GET

Bug Fixes
=========

* Avoid hang of diskless replication fork child when parent crashes
* Fix crash with module API of list iterator and RM_ListDelete
* Fix TLS error handling to avoid connection drops on timeouts
* Fix runtime changes to cluster-announce-*-port to take effect on the local node too
* Fix sentinel function that compares hostnames if failed resolve
* Fix MIGRATE with AUTH set to "keys" is getting wrong key names \ 
leading to MOVED or ACL errors

Fixes for issues in previous releases of Redis 7.0
--------------------------------------------------

* Fix command line startup --sentinel problem
* Fis missing FCALL commands in monitor
* Fix CLUSTER SHARDS showing empty hostname
* Replica that asks for rdb-only could have missed the EOF and hang

Log message:
redis: Update redis.sh requirement

pkgsrc changes:
---------------
  * "network" is not a requirement provided by pkgtools/rc.d-boot. Use
    NETWORKING instead.

Log message:
redis: updated to 7.0.5

Redis 7.0.5 Released Wed Sep 21 20:00:00 IST 2022
================================================================================

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2022-35951) Executing a XAUTOCLAIM command on a stream key in a specific
  state, with a specially crafted COUNT argument, may cause an integer overflow,
  a subsequent heap overflow, and potentially lead to remote code execution.
  The problem affects Redis versions 7.0.0 or newer
  [reported by Xion (SeungHyun Lee) of KAIST GoN].

Module API changes
==================

* Fix RM_Call execution of scripts when used with M/W/S flags to properly
  handle script flags
* Fix RM_SetAbsExpire and RM_GetAbsExpire API registration

Bug Fixes
=========

* Fix a hang when eviction is combined with lazy-free and \ 
maxmemory-eviction-tenacity is set to 100
* Fix a crash when a replica may attempt to set itself as its master as a result \ 
of a manual failover
* Fix a bug where a cluster-enabled replica node may permanently set its \ 
master's hostname to '?'
* Fix a crash when a Lua script returns a meta-table

Fixes for issues in previous releases of Redis 7.0
--------------------------------------------------

* Fix redis-cli to do DNS lookup before sending CLUSTER MEET
* Fix crash when a key is lazy expired during cluster key migration
* Fix AOF rewrite to fsync the old AOF file when a new one is created
* Fix some crashes involving a list containing entries larger than 1GB
* Correctly handle scripts with a non-read-only shebang on a cluster replica
* Fix memory leak when unloading a module
* Fix bug with scripts ignoring client tracking NOLOOP
* Fix client-side tracking breaking protocol when FLUSHDB / FLUSHALL / SWAPDB is \ 
used inside MULTI-EXEC
* Fix ACL: BITFIELD with GET and also SET / INCRBY can be executed with \ 
read-only key permission
* Fix missing sections for INFO ALL when also requesting a module info section

================================================================================
Redis 7.0.4 Released Monday Jul 18 12:00:00 IST 2022
================================================================================

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2022-31144) A specially crafted XAUTOCLAIM command on a stream
  key in a specific state may result with heap overflow, and potentially
  remote code execution. The problem affects Redis versions 7.0.0 or newer.

================================================================================
Redis 7.0.3 Released Monday Jul 11 12:00:00 IST 2022
================================================================================

Upgrade urgency: MODERATE, specifically if you're using a previous release of
Redis 7.0, contains fixes for bugs in previous 7.0 releases.

Performance and resource utilization improvements
=================================================

* Optimize zset conversion on large ZRANGESTORE
* Optimize the performance of sending PING on large clusters
* Allow for faster restart of Redis in cluster mode

INFO fields and introspection changes
=====================================

* Add missing sharded pubsub keychannel count to CLIENT LIST
* Add missing pubsubshard_channels field in INFO STATS

Module API changes
==================

* Add RM_StringToULongLong and RM_CreateStringFromULongLong
* Add RM_SetClientNameById and RM_GetClientNameById

Changes in CLI tools
====================

* Add missing cluster-port support to redis-cli --cluster

Other General Improvements
==========================

* Account sharded pubsub channels memory consumption
* Allow ECHO in loading and stale modes
* Cluster: Throw -TRYAGAIN instead of -ASK on migrating nodes for multi-key
  commands when the node only has some of the keys

Bug Fixes
=========

* TLS: Notify clients on connection shutdown
* Fsync directory while persisting AOF manifest, RDB file, and config file
* Script that made modification will not break with unexpected NOREPLICAS error
* Cluster: Fix a bug where nodes may not acknowledge a CLUSTER FAILOVER TAKEOVER
  after a replica reboots
* Cluster: Fix crash during handshake and cluster shards call

Fixes for issues in previous releases of Redis 7.0
--------------------------------------------------

* TLS: Fix issues with large replies
* Correctly report the startup warning for vm.overcommit_memory
* redis-server command line allow passing config name and value in the same argument
* Support --save command line argument with no value for backwards compatibility
* Fix CLUSTER RESET command regression requiring an argument

================================================================================
Redis 7.0.2 Released Sunday Jun 12 12:00:00 IST 2022
================================================================================

Upgrade urgency: MODERATE, specifically if you're using a previous release of
Redis 7.0, contains fixes for bugs in previous 7.0 releases.

Bug Fixes
=========

* Fixed SET and BITFIELD commands being wrongly marked movablekeys
  Regression in 7.0 possibly resulting in excessive roundtrip from cluster clients.
* Fix crash when /proc/sys/vm/overcommit_memory is inaccessible
  Regression in 7.0.1 resulting in crash on startup on some configurations.

================================================================================
Redis 7.0.1 Released Wed Jun 8 12:00:00 IST 2022
================================================================================

Upgrade urgency: MODERATE, specifically if you're using a previous release of
Redis 7.0, contains some behavior changes for new 7.0 features and important
fixes for bugs in previous 7.0 releases.

Improvements
============

* Add warning for suspected slow system clocksource setting
  Add --check-system command line option.
* Allow read-only scripts (*_RO commands, and ones with `no-writes` flag)
  during CLIENT PAUSE WRITE
* Add `readonly` flag in COMMAND command for EVAL_RO, EVALSHA_RO and FCALL_RO
* redis-server command line arguments now accept one string with spaces
  for multi-arg configs

Potentially Breaking Changes
============================

* Omitting a config option value in command line argument no longer works
* Hide the `may_replicate` flag from the COMMAND command response

Potentially Breaking Changes for new Redis 7.0 features
-------------------------------------------------------

* Protocol: Sharded pubsub publish emits `smessage` instead of `message`
* CLUSTER SHARDS returns slots as RESP integers, not strings
* Block PFCOUNT and PUBLISH in read-only scripts (*_RO commands, and no-writes)
* Scripts that declare the `no-writes` flag are implicitly `allow-oom` too

Changes in CLI tools
====================

* redis-cli --bigkeys, --memkeys, --hotkeys, --scan. Finish nicely after Ctrl+C

Platform / toolchain support related improvements
=================================================

* Support tcp-keepalive config interval on MacOs
* Support RSS metrics on Haiku OS

INFO fields and introspection changes
=====================================

* Add isolated network metrics for replication.

Module API changes
==================

* Add two more new checks to RM_Call script mode
* Add new RM_Call flag to let Redis automatically refuse `deny-oom` commands
* Add module API RM_MallocUsableSize
* Add missing REDISMODULE_NOTIFY_NEW
* Fix cursor type in RedisModuleScanCursor to handle more than 2^31 elements
* Fix RM_Yield bugs and RM_Call("EVAL") OOM check bug
* Fix bugs in enum configs with overlapping bit flags

Bug Fixes
=========

* FLUSHALL correctly resets rdb_changes_since_last_save INFO field
* FLUSHDB is now propagated to replicas / AOF, even if the db is empty
* Replica fail and retry the PSYNC if the master is unresponsive
* Fix ZRANGESTORE crash when zset_max_listpack_entries is 0

Fixes for issues in previous releases of Redis 7.0
--------------------------------------------------

* CONFIG REWRITE could cause a config change to be dropped for aliased configs
* CONFIG REWRITE would omit rename-command and include lines
  NOTE: Affected users who used Redis 7.0.0 to rewrite their configuration file
  should review and fix the file.
* Fix broken protocol after MISCONF (persistence) error
* Fix --save command line regression
* Fix possible regression around TLS config changes. re-load files even if the
  file name didn't change.
* Re-add SENTINEL SLAVES command, missing in redis 7.0
* BZMPOP gets unblocked by non-key args and returns them
* Fix possible memory leak in XADD and XTRIM

================================================================================
Redis 7.0.0 GA  Released Wed Apr 27 12:00:00 IST 2022
================================================================================

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script
  can cause NULL pointer dereference which will result with a crash of the
  redis-server process. This issue affects all versions of Redis.
  [reported by Aviv Yahav].
* (CVE-2022-24735) By exploiting weaknesses in the Lua script execution
  environment, an attacker with access to Redis can inject Lua code that will
  execute with the (potentially higher) privileges of another Redis user.
  [reported by Aviv Yahav].

New Features
============

* Keyspace event for new keys

Command replies that have been extended
---------------------------------------

* COMMAND DOCS shows deprecated_since field in command args
* COMMAND DOCS shows module name where applicable

Potentially Breaking Changes
============================

* Replicas panic when they fail writing persistence
* Prevent cross slot operations in functions and scripts with shebang
* Rephrased some error responses about invalid commands or args
* Lua scripts do not have access to the print() function

Performance and resource utilization improvements
=================================================

* Speed optimization in streams
* Speed optimization in command execution pipeline
* Speed optimization in listpack encoded sorted
* Speed optimization in latency tracking at INFO (relevant for 7.0 RCs)
* Speed optimization when there are many replicas (relevant for 7.0 RCs)

New configuration options
=========================

* Allow ignoring disk persistence errors on replicas
* Allow abort with panic when replica fails to execute a command sent by the master
* Allow configuring shutdown flags of SIGTERM and SIGINT
* Allow attaching an operating system-specific identifier to Redis sockets

Module API changes
==================

* Add argument specifying ACL reason for module log entry
  Breaking API compatibility with 7.0 RCs
* Add the deprecated_since field in command args of COMMAND DOCS
  Breaking API/ABI compatibility with 7.0 RCs
* Add module API flag for using enum configs as bit flags
* Add RM_PublishMessageShard
* Add RM_MallocSizeString, RM_MallocSizeDict
* Add RM_TryAlloc

Bug Fixes
=========

* Replica report disk persistence errors in PING
* Fixes around rejecting commands on replicas and AOF when they must be respected
* Durability fixes for appendfsync=always policy

Fixes for issues in previous release candidates of Redis 7.0
------------------------------------------------------------

* Fix possible crash on CONFIG REWRITE
* Fix regression not aborting transaction on errors
* Fix auto-aof-rewrite-percentage based AOFRW trigger after restart
* Fix bugs when AOF enabled after startup, in case of failure before the first \ 
rewrite completes
* Fix RM_Yield module API bug processing future commands of the current client

Log message:
redis: update to 6.2.7.

================================================================================
Redis 6.2.7 Released Wed Apr 27 12:00:00 IDT 2022
================================================================================

Upgrade urgency: SECURITY, contains fixes to security issues.

Security Fixes:
* (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script
  can cause NULL pointer dereference which will result with a crash of the
  redis-server process. This issue affects all versions of Redis.
  [reported by Aviv Yahav].
* (CVE-2022-24735) By exploiting weaknesses in the Lua script execution
  environment, an attacker with access to Redis can inject Lua code that will
  execute with the (potentially higher) privileges of another Redis user.
  [reported by Aviv Yahav].

Potentially Breaking Fixes
==========================

* LPOP/RPOP with count against non-existing list return null array (#10095)
* LPOP/RPOP used to produce wrong replies when count is 0 (#9692)

Performance and resource utilization improvements
=================================================

* Speed optimization in command execution pipeline (#10502)
* Fix regression in Z[REV]RANGE commands (by-rank) introduced in Redis 6.2 (#10337)

Platform / toolchain support related improvements
=================================================

* Fix RSS metrics on NetBSD and OpenBSD (#10116, #10149)
* Fix OpenSSL 3.0.x related issues (#10291)

Bug Fixes
=========

* Lua: Add checks for min-slave-* configs when evaluating Lua scripts (#10160)
* Lua: fix crash on a script call with many arguments, a regression in v6.2.6 (#9809)
* Tracking: Make invalidation messages always after command's reply (#9422)
* Fix excessive stream trimming due to an overflow (#10068)
* Add missed error counting for INFO errorstats (#9646)
* Fix geo search bounding box check causing missing results (#10018)
* Improve EXPIRE TTL overflow detection (#9839)
* Modules: Fix thread safety violation when a module thread adds an error reply, \ 
broken in 6.2 (#10278)
* Modules: Fix missing and duplicate error stats (#10278)
* Module APIs: release clients blocked on module commands in cluster resharding
  and down state (#9483)
* Sentinel: Fix memory leak with TLS (#9753)
* Sentinel: Fix issues with hostname support (#10146)
* Sentinel: Fix election failures on certain container environments (#10197)

Log message:
databases: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

The following distfiles could not be fetched (some may be only fetched
conditionally):

./databases/cstore/distinfo D6.data.ros.gz
./databases/cstore/distinfo cstore0.2.tar.gz
./databases/cstore/distinfo data4.tar.gz