[dependabot]

Bumps valkey-io/valkey-glide/.github/workflows/semgrep.yml from eb954a09b68a3a45634b6c26573e5dca19ea1130 to 70006cc667a527e731aba2971fa57f8308704c1b.

Changelog

Sourced from valkey-io/valkey-glide/.github/workflows/semgrep.yml's changelog.

Changelog

Pending 2.6

Features

• All: Add support for Valkey 9.0 commands:
  • DELIFEQ (#6146)
• Java, Node, Python, Go: Add support for Valkey 9.1 commands:
  • HGETDEL (#6145)
• Java: Add support for Valkey 9.1 commands:
  • NX/XX support for HSETEX (#6154)
• All: Add support for Valkey 9.2 commands:
  • SISMEMBER with XX option (#7202)
• Python: Add support for Valkey 9.2 commands:
  • SET with IFNE option (#7237)
• Rust: Implement ToSingleValkeyArg and ToValkeyArgs for option types (#7381)
• Core: Add glide-rdma crate, an RDMA transfer layer over libfabric (loaded at runtime), for later RDMA support (#7177)

Fixes

• Core: GETSET compresses value when enabled (#7411)
• Core: Reject SET with IFEQ or IFNE when compression is enabled (#7365)
• Core/All: Scope acquire waits inside glide-core instead of each binding polling glide_scope_try_acquire in its own retry loop. A cause that waiting cannot fix (parent closed mid-wait, lazily connected mTLS parent with no certificate material yet, a connection request that cannot produce a scoped connection) now raises the binding's disconnect or request-error class immediately instead of a "pool exhausted" timeout after the full deadline, and a deadline error names the cause of the final attempt. One acquire makes one dial: the acquire awaits the connection it reserved a slot for, so the attempt-token dedupe that let a binding's repeat poll recognise its own in-flight creation is removed along with the loops. glide_scope_try_acquire and glide_scope_next_attempt_token (and the JNI and napi counterparts) are replaced by glide_scope_acquire_async / glide_scope_acquire_blocking / glide_scope_acquire_pipe (the last delivers to the Python async client's shared pipe); Node's IsolatedScope.acquire takes timeoutMs where it took maxRetries (#7112)
• Node: Log the disconnect warning when the Disconnection push arrives (#7277)
• Core, Go, Java, Node, Python, Rust: use uint32 for Go BackoffStrategy fields and harden reconnect RetryStrategy against out-of-range values; in Java an all-zero BackoffStrategy now means zero retries, matching the other clients (#6680)
• Java, Node: An ordinary client and a pooled client could be handed the same id because ordinary-client handles and pooled client_ids came from separate counters that both started at 1, so closing an ordinary client (including ClientPool.create's own connectivity probe) evicted a pooled client sharing its id — killing it outright, invalidating its scopes, or polluting its inflight accounting. Ordinary-client handles now draw from the same global allocator pooled ids use, so every id in the shared registry is unique (#6968)
• Java, Go: Fix slotForKey returning the wrong cluster slot for a key with an empty hash tag. The first } after the first { now closes the tag, and an empty tag ({}) hashes the whole key, so a scope pinned with a key like {}user}:1 targets the correct primary (#7251)
• Core: Scoped connections inherit the parent client's TLS certificate material and custom address resolver instead of silently falling back to system trust with no client certificate: a scope off an mTLS, custom-root-CA, or cert-reload parent now presents the same client certificate and trusts the same roots, uses the freshest material adopted after a rotation, and resolves its seed address through the parent's resolver on the standalone path. An acquire whose parent configured certificate material but has none to inherit yet fails with the reason rather than connecting without it (#7173)
• Core: IAM authentication now requires TLS. An IAM token is a bearer credential, so a client or scoped connection configured for IAM with TLS disabled was sending AUTH <username> <token> over plaintext TCP, where it could be captured and replayed. An IAM-configured client now fails to create when TLS is off — before any token manager exists, so initial AUTH, background refresh, and reconnect all fail closed — and a scope off an IAM parent is rejected before any connect when its request disables TLS. TLS-enabled IAM connections are unchanged. An empty IAM cluster_name or region is also now rejected at client creation, instead of failing later as an opaque connect timeout or server-side auth error (#7023)
• CI/Node: Fix Windows npm platform package publishing — add the missing node/npm/win32-x64-msvc/ platform stub so the Windows native module is published to npm on each release; fix deprecate-on-failure which was targeting the non-existent @valkey/valkey-glide-windows-x64-msvc instead of the correct @valkey/valkey-glide-win32-x64-msvc; fix prepublishOnly script which used removed napi-rs CLI v3 flags (--config → --package-json-path, --skip-gh-release → --no-gh-release); move napi prepublish out of the prepublishOnly npm lifecycle hook into an explicit CI step (napi-rs v3.8.3 workspace boundary check prevents running from the npm lifecycle cwd node/npm/glide/) and add workspaces: [] to node/package.json — an empty array satisfies napi-rs v3.8.3's Array.isArray(manifest.workspaces) boundary check without enrolling platform stubs as npm workspaces (which would cause EBADPLATFORM errors on Linux runners) (#7179)
• Java: Clear jedis-compat-shared javadoc errors and deprecate substr (#7191)
• Core: A scope pool no longer leaks capacity when connecting to a paused or unreachable shard. A reserved max_total slot is now held by an RAII guard that returns it on every creation outcome — including a creation cancelled mid-handshake, which previously leaked the slot until scopes to healthy shards could no longer be opened — and decrements saturate at zero so a give-back cannot wrap into permanent exhaustion. Concurrent retries of a single acquire are deduped to one in-flight creation, so a retry storm against a slow shard can no longer consume the whole pool, while distinct concurrent acquires each still open their own connection (#6966, #7067)
• Core/All, Node: Fix ClientPool abandon monitor race for blocking commands (#7063)
• Core: A cluster ClientPool no longer leaks a borrow's open transaction to the next borrower, nor discards connections from a pool on a non-zero database. The release-time reset sent DISCARD to a single node (leaving an open MULTI on the other primaries) and SELECT <configured_db> on every release (which a cluster server rejects for a non-zero db, failing the reset so the connection was thrown away); it now routes DISCARD to all cluster nodes and sends SELECT only when the database may have changed during the borrow (#7301)
• Core/All: A ClientPool client dropped by idle-timeout eviction, by a failed state reset on release, or by a release cancelled mid-reset is now reported to the binding, which reclaims the adapter or handle it holds for that client. Previously only the abandon monitor reported discards, so every other drop left the binding's side (in FFI, a tokio runtime and its connection) alive until the pool was destroyed; under low traffic the pool accumulated one dead runtime per eviction for its lifetime (#7168)
• Core: Scoped cluster connections are keyed on the resolved primary's address instead of the requested hash slot, so cluster slot 0 is treated as an ordinary slot rather than a wildcard that matched every idle scoped connection. A scope for a key in slot 0 no longer reuses a connection to a different primary and receives an unfollowable MOVED, while slots that share a primary now share its idle connections. A slot whose primary cannot currently be resolved (topology not yet fetched, or mid-resharding) fails the acquire with the reason logged instead of connecting to a configured seed node, and a full pool whose idle connections all target other primaries evicts its oldest idle connection instead of reporting exhaustion (#6975)
• Core: A cluster scope opened with a routing key now checks its first keyed command against that key's slot, so a command for a different slot fails locally with a cross-slot error before dispatch instead of leaking out as a server MOVED (or silently succeeding when the two slots happen to share a primary). Previously only the second and later commands were constrained, letting a scope's physical connection and its pinned slot disagree; a scope opened without a routing key stays unconstrained (#7057)
• Core: Closing a client or a ClientPool invalidates the scopes its clients own — the scope pool and its outstanding scopes are removed from the registries, so a scope can no longer read or mutate keyspace after its parent is gone (#6889)
• Core: A scope pool configured with max_total = N now permits N concurrent scopes instead of N-1. The pool reserved a slot against max_total and the caller then re-checked capacity after that reservation, so the last acquire was never given a connection and the borrower timed out (#6795)
• Core: Resolve cluster redirect addresses exactly once, preserve canonical MOVED/ASK targets across retries and reconnects that do not supersede the routing decision, drop saved redirects when the slot map is refreshed, match raw IPs by exact IP and port (including IPv6), and prevent stale refresh generations from installing connections or removing current refresh-task state (#6788)
• Core/FFI: Scoped commands resolve their parent client from the scope registry without taking a pool lock, and fail if it cannot be resolved, so a scoped command always gets the parent's request timeout, circuit breaker, inflight limit, compression, IAM re-authentication and latency tracking (#6796)
• Core: Reset CLIENT SETNAME on scope release so a connection name set during a scope does not leak to the next borrower of the same connection (#6898)
• Core: Reused scoped connections keep the parent client's current runtime database. Acquire and release no longer discard the connection's tracked database, and release restores the parent's runtime database (captured per borrow) rather than the pool's original static configuration — so a reused scope reads and writes the same logical database as a newly opened one, and an untouched scope on a non-zero database takes the zero-round-trip clean release path (#7064)
• Core: Scoped connections work against IPv6 targets. The scope connection builder constructed a redis:// URL and re-parsed it, which rejected a bare IPv6 host (redis://::1:7801) and surfaced only an eventual pool-exhaustion timeout; it now builds a redis::ConnectionInfo directly like every other connection path, reusing the cluster path's host/port parse so the two cannot drift (#7124)
• Java: Map the Jedis compatibility layer's database selection onto GLIDE's databaseId instead of logging a warning and discarding it. A JedisPool configured for a non-zero database ran every command against database 0, silently writing to a database the caller did not ask for (#6994)
• Core: Mark PSUBSCRIBE and PUNSUBSCRIBE as readonly commands so cluster routing treats them consistently with SUBSCRIBE/UNSUBSCRIBE (#6756)
• Core/FFI: Scoped connections honor blocking-command timeouts (e.g. BLPOP key 0 blocks instead of timing out at the request timeout), and a scoped connection whose blocking command timed out or was cancelled is discarded on release instead of being reused with a stale server-side waiter (#6780, #6794)
• Core: Scoped connections authenticate as the configured IAM identity, re-authenticate on IAM token rotation, and are discarded rather than reused when re-authentication fails (#7001)
• Core: Stop MONITOR and PubSub streams from dropping buffered handshake bytes (#6979)

... (truncated)

Commits

• 70006cc feat(python): add DELIFEQ command support (#7386)
• dbe8d4e docs: make build/lint/test docs self-sufficient across all clients (#7344)
• fb14e34 fix(core): reset pooled connection state conditionally and route DISCARD to a...
• b360e69 fix(core): require TLS for IAM auth on ordinary and scoped connections (#7397)
• 2c29457 feat(python): add SET IFNE support and fix GETSET and SET IFEQ compression (#...
• 416a003 ci: skip heavy workflows on doc-only pull requests (#7420)
• d83cec7 test(python): Poll for server state instead of sleeping (#7342)
• f6764ef fix(security): update RustSec-vulnerable crates (#7424)
• 3da1ccf fix(node): set unix_socket_path in lazy_client test NodeAddress (#7421)
• 3344a4c feat(core/python): connect to standalone servers over Unix domain sockets (#7...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)