chore(deps): update dependency redis to v4.4.4 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
redis (changelog)	==4.3.6 -> ==4.4.4

GitHub Vulnerability Alerts

CVE-2023-28859

redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.

---

Release Notes

redis/redis-py (redis)

v4.4.4: 4.4.4

Compare Source

Changes

Upgrade urgency: SECURITY, contains fixes to security issues.

• (CVE-2023-28859) - Cancelling an async future does not, properly trigger, leading to a potential data leak in specific cases.
• (CVE-2023-28858) - Cancelling an async future does not, properly trigger, leading to a potential data leak in specific cases.

🐛 Bug Fixes

• Fixing cancelled async futures (#​2671 )

v4.4.3: 4.4.3

Compare Source

Changes

Update urgency: HIGH: There is a critical bug that may affect a subset of users. Upgrade!

🐛 Bug Fixes

• CWE-404 AsyncIO Race Condition Fix (#​2624, #​2579)

v4.4.2: 4.4.2

Compare Source

Changes

Note: this release include #​2548 and it is suggested that users upgrade immediately.

🧪 Experimental Features

• Add support for BF.CARD (#​2545)

🚀 New Features

• Add support for custom connection pool class in NodesManager (#​2547)

🐛 Bug Fixes

• Allow replica to master promotion in nodes_cache (#​2549)
• Security Fix: Updating graph parser for potential injection cases (#​2548)

Contributors

We'd like to thank all the contributors who worked on this release!

@​Threated, @​dvora-h, @​shacharPash and @​zakaf

v4.4.1: 4.4.1

Compare Source

Changes

🚀 New Features

• Add dialect to FT.AGGREGATE (#​2537)
• Add support for resetchannels in ACL SETUSER (#​2514)
• Allow EVAL_RO and EVALSHA_RO to be routed to read replica (#​2494)
• Add timeout parameter for SentinelManagedConnection (#​2495)
• Add TIMEOUT to query class (#​2519)
• Add support for certain LATENCY commands (#​2503)

🐛 Bug Fixes

• Add type checking to __eq__ in graph classes (#​2531)
• Accept str for ex parameter in set command (#​2529)
• Fix for Unhandled exception related to self.host with unix socket (#​2520)
• Make PythonParser resumable (#​2510)

🧰 Maintenance

• Fix incorrect _disconnect_raise docstring (#​2534)
• Remove DeprecationWarning by replace get_event_loop with get_running_loop (#​2530)
• Fix AttributeError when trying to split library version (#​2539)
• Including startup instructions via redis-stack docker (#​2535)
• Fix JSON.ARRINDEX test (#​2527)
• Add OpenTelemetry example with Uptrace backend (#​2452)
• Switch docs to furo theme (#​2492)
• Combine auto-concatenated strings (#​2482)
• Updating graph tests to support new execution plan (#​2486)
• Raising NotImplementedError for certain CLUSTER and LATENCY commands (#​2504) (#​2501)

Contributors

We'd like to thank all the contributors who worked on this release!

@​DvirDukhan, @​SessionIssue, @​YiuRULE, @​chayim, @​dgilmanAIDENTIFIED, @​dvora-h, @​kristjanvalur, @​mohsinhaider, @​raz-mon, @​shacharPash, @​stitchWzc, @​uglide, @​vmihailenco, @​winmorre and @​zakaf

v4.4.0: Version 4.4.0

Compare Source

Changes

4.4.0rc4 release notes
4.4.0rc3 release notes
4.4.0rc2 release notes
4.4.0rc1 release notes

🚀 New Features (since 4.4.0rc4)

• Async clusters: Support creating locks inside async functions (#​2471)

🐛 Bug Fixes (since 4.4.0rc4)

• Async: added 'blocking' argument to call lock method (#​2454)
• Added a replacement for the default cluster node in the event of failure. (#​2463)
• Fixed geosearch: Wrong number of arguments for geosearch command (#​2464)

🧰 Maintenance (since 4.4.0rc4)

• Updating dev dependencies (#​2475)
• Removing deprecated LGTM (#​2473)
• Added an explicit index name in RediSearch example (#​2466)
• Adding connection step to bloom filter examples (#​2478)

Contributors (since 4.4.0rc4)

We'd like to thank all the contributors who worked on this release!

@​Sibuken, @​barshaul, @​chayim, @​dvora-h, @​nermiller, @​uglide and @​utkarshgupta137

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.