chore(deps): Bump redis from 1.3.0 to 1.5.0

[dependabot]

Bumps redis from 1.3.0 to 1.5.0.

Release notes

Sourced from redis's releases.

redis-1.4.1

Changes & Bug fixes

• Remove unnecessary sleep from cluster readonly error handling (#2223 by @​nihohit)

CI & operational improvements

• ci: Allow semicolon_in_expressions_from_macros to make nightly pass (#2218 by @​somechris)
• tests/acl: Add the missing requirements for token based authentication (#2214 by @​somechris)
• Makefile: Switch to --locked for module tests on RESP3 (#2222 by @​somechris)

Full Changelog: redis-rs/redis-rs@redis-1.4.0...redis-1.4.1

redis-1.4.0

Changes & Bug fixes

• Add support for Valkey's bloom module (#2168 by @​somechris)
• perf(pipeline): skip result-filter rebuild when nothing is ignored (#2186 by @​fcostaoliveira)
• perf(cmd): encode into the Vec buffer instead of via io::Write (#2187 by @​fcostaoliveira)
• Make backpressure boundary configurable (#2188 by @​kushudai)
• perf(cmd): encode expiry options via itoa instead of format!/to_string (#2194 by @​fcostaoliveira)
• Keep dispatching requests when repairing a connection to a replica (#2120 by @​virratanasangpunth)

CI & operational improvements

• tests: Avoid relying on Redis bug in test_object_freq_command (#2164 by @​somechris)
• Makefile: Select module tests directly to reduce output (#2167 by @​somechris)
• test: Switch to selecting tests through profiles (#2210 by @​somechris)
• Stabilize github actions dependencies (#2198 by @​nihohit)
• tests: Switch direct use of RedisServer to better suited TestContext (#2202 by @​somechris)
• ci: Document status of KeyDB, Valkey, and Kvrocks support (#2206 by @​somechris)
• tests: Stop running sentinel tests when testing on unix sockets (#2208 by @​somechris)
• Make test names greppable (#2211 by @​nihohit)

New Contributors

• @​kushudai made their first contribution in redis-rs/redis-rs#2188

Full Changelog: redis-rs/redis-rs@redis-1.3.0...redis-1.4.0

Commits

• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​redis@​1.3.0 ⏵ 1.5.0

View full report

[msalvatti]

@dependabot rebase

[msalvatti]

Status: blocked on the supply-chain policy, not on anything wrong with this bump.

cargo deny and cargo audit pass here — no known advisory, no license or ban issue. The only failing step is cargo vet, and it is failing because the new version has no audit yet from any source this repository imports.

#117 has landed and separates the two causes that were tangled together. It refreshed supply-chain/imports.lock, which was five dependencies behind and was making every PR fail for reasons that had nothing to do with the PR, and it pinned CI to cargo vet --locked so the gate answers from what the repository recorded rather than from whatever upstream published that minute. What is left here is genuinely this bump:

$ cargo vet          # with the imports refreshed
Vetting Failed!

(the exact crate is listed in the job log)

Three ways forward, and the right one is a call for the maintainer rather than something to route around:

1. Wait. This is what just happened for anyhow, serde_json, syn and thiserror: Mozilla, Bytecode Alliance and Google published audits between 18 and 22 July, and the versions became vetted with no decision from us. There is no advisory here, so waiting costs nothing.
2. Audit the diff with cargo vet diff, and record it with cargo vet certify. Honest, and real work — the redis 1.3 → 1.5 diff alone is 2377 insertions.
3. Exempt it — record that we accept the version without auditing it. Fastest, and the only one that puts a trust claim in the repository that nobody earned.

Leaving this open rather than forcing it through: a gate that gets bypassed whenever it is inconvenient is not a gate.