Redis

Seven patch releases fixed a heap buffer overflow in the cluster bus, triggerable by a PUBLISH or SPUBLISH message larger than 4GB.

A cluster-bus overflow is patched across every supported line.

• 8.10.3, 8.8.4, 8.6.8, 8.4.8, 8.2.11, 7.4.12, and 7.2.17 carry the same fix and are all marked security-urgent.
• Only cluster mode is exposed — the oversized message has to propagate between nodes to trigger the overflow.

node-redis 6.4.0 beta fails traffic over to a healthy database.

• Four new constructors — createMultiDbClient, createMultiDbClientPool, createMultiDbCluster, and createMultiDbSentinel — connect to several Redis endpoints and move traffic off a failing one, using health checks, a circuit breaker, and configurable failover. The API is experimental and may change before stable.
• Client-side caching gained OPTIN and OPTOUT tracking modes with a per-call cache option.
• New commands: the BLESS family, Cuckoo CF.MEXISTS, a Count-Min Sketch cell size, HNSW vector compression, and more FT.SEARCH options.

go-redis 9.23.0 raises the Go floor and gives pipelines their own pool.

• The module's go directive moved from 1.24 to 1.26; builds on Go 1.24 or 1.25 must upgrade their toolchain.
• Every Client, failover and cluster node clients included, now creates a dedicated pool for Pipeline, TxPipeline, and autopipeline work, so pipeline traffic stops competing with regular commands for main-pool connections. The pool dials only when needed, holds zero connections when idle, and falls back to the main pool when full.