chore(deps): bump the production-dependencies group with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates: valkey-glide-sync and valkey-glide.

Updates valkey-glide-sync from 2.4.2 to 2.5.0

Updates valkey-glide from 2.4.2 to 2.5.0

Release notes

Sourced from valkey-glide's releases.

v2.5.0

Key Features

Client-Wide Circuit Breaker: Introduced a comprehensive per-client circuit breaker system that detects when the GLIDE core is unhealthy and proactively rejects requests synchronously at the FFI boundary. Enhanced with structured timeout diagnostics and watchdog-informed recovery mechanisms to prevent thread parking and improve overall client resilience.

Python Async Performance Enhancement: Completely overhauled the Python async client architecture by replacing UDS (Unix Domain Socket) and protobuf transport with direct FFI requests and unnamed pipes for responses, delivering significant performance improvements and reduced latency.

Custom Socket Address Resolution: Added comprehensive support for custom socket address resolution when connecting to Valkey across all client languages, providing greater flexibility for complex network configurations and deployment scenarios.

Comprehensive New Command Support: Added new commands with full multi-language implementation:

• Migration: MIGRATE single-key and multi-key variants
• Connection Management: RESET, CLIENT PAUSE, CLIENT UNPAUSE
• Client-Side Caching: CLIENT CACHING, CLIENT TRACKING, CLIENT TRACKINGINFO
• Monitoring: MONITOR with dedicated MonitorClient
• Database Operations: SAVE, BGSAVE, BGREWRITEAOF
• Replication: REPLICAOF, FAILOVER
• Performance Monitoring: LATENCY HISTORY, LATENCY LATEST, LATENCY RESET
• Memory Management: MEMORY DOCTOR, MEMORY MALLOC-STATS, MEMORY PURGE, MEMORY STATS

Enhanced TLS Performance: Fixed critical TLS connection performance regression by optimizing initial connection handling and implementing per-process certificate caching, eliminating timeouts in multi-client and multi-process deployments.

Advanced Client-Side Caching: Implemented Phase 2 server-assisted invalidation via CLIENT TRACKING with comprehensive support across all client languages, enabling efficient cache invalidation strategies.

Improved Core Reliability: Enhanced connection management with circular MOVED handling, TCP deadlock fixes for large payloads, topology refresh improvements, and liveness-aware pipeline send-timeout mechanisms.

Enterprise-Grade Observability: Added structured timeout diagnostics that classify timeout causes and provide actionable corrective recommendations, along with dedicated timeout watchdog threads independent of Tokio runtime for improved debugging and monitoring capabilities.

Go OpenTelemetry Enhancement: Added support for connecting GLIDE command and batch spans to an application's existing OpenTelemetry trace context through OpenTelemetry.SetSpanContextExtractor, letting applications propagate active trace context from context.Context without adding a direct go.opentelemetry.io/otel dependency to the Go SDK.

Go Valkey Search Server Module Package: Refactored Valkey Search (FT) commands into a standalone glideft server module package, decoupling search functionality from client internals and establishing a scalable pattern for future server module support.

What's Changed

• Enable PeriodicCheck parameter for Go Client in AdvancedClusterClient Configuration by @​xShinnRyuu in valkey-io/valkey-glide#5839
• Java: Make jedis-compatibility a pure-Java JAR with no-classifier support by @​affonsov in valkey-io/valkey-glide#5649
• Support custom socket address resolution by @​tavomaciel in valkey-io/valkey-glide#5328
• fix(glide-core): fall back to existing connections when initial nodes are unavailable during toplogy refresh by @​jduo in valkey-io/valkey-glide#5857
• Go: Refactor ft commands into a glideft package by @​edlng in valkey-io/valkey-glide#5855
• Go: Create common client interfaces by @​prateek-kumar-improving in valkey-io/valkey-glide#5862
• fix(node): accept pointer as single i64 to prevent 64-bit truncation by @​jduo in valkey-io/valkey-glide#5874
• Isolate flaky workflows and tests by @​Aryex in valkey-io/valkey-glide#5808
• fix(go): Update docs after FT module refactor by @​edlng in valkey-io/valkey-glide#5881
• Python: Optimize cache metrics retrieval to be synchronous (#5772) by @​shohamazon in valkey-io/valkey-glide#5856
• fix: java workflow correctly skips container tests on windows only and moved start time by @​Aryex in valkey-io/valkey-glide#5882
• Python: Support custom socket address resolution by @​affonsov in valkey-io/valkey-glide#5876
• Fix TCP deadlock in MultiplexedConnection with large payloads by @​ranshid in valkey-io/valkey-glide#5892
• fix(node): allow protobufjs build scripts in pnpm test by @​affonsov in valkey-io/valkey-glide#5899
• Compression Bugfixes by @​alexr-bq in valkey-io/valkey-glide#5895
• Update README with up-to-date information by @​Aryex in valkey-io/valkey-glide#5941
• Core: Propagate per-command response timeout to multiplexed connection by @​jeremyprime in valkey-io/valkey-glide#5916
• Cherry pick #5952 to main: Java: Add a synchronous check on inflight request limits before submitting tasks by @​jduo in valkey-io/valkey-glide#5976

... (truncated)

Changelog

Sourced from valkey-glide's changelog.

Changelog

Pending 2.6

Fixes

• Core/FFI: fix(ffi): forward Disconnection push notifications past the malformed-frame guard. PR #6530 inadvertently chained PushKind::Disconnection (which carries an empty payload) through extract_pubsub_data, causing all disconnect notifications to be silently dropped on the async pipe path. (#6543)
• CI: Run test-release in pypi-cd.yml when only one package is published manually, so a skipped sibling publish job no longer causes post-publish validation to be skipped entirely (#6542)
• Core/FFI: fix(ffi): prevent pub/sub DoS from malformed server push frames (#6530)
• Python: Restore BaseClient.__aenter__ return type to Self (from the widened "BaseClient" introduced in 2.5.0). Entering the async context manager (async with await GlideClusterClient.create(...) as client) now preserves the concrete subclass for static type checkers, matching create(). (#6531)
• Core: Enforce the RESP3 parser recursion-depth limit for all aggregate types (map, set, push, attribute), not just arrays. A malicious or compromised server could previously send deeply nested %/~/>/| payloads that consumed one native stack frame per level and crashed the host application via stack exhaustion (DoS); such payloads now surface a graceful parse error. (#6477)
• Core: Update anyhow to 1.0.103 to fix RUSTSEC-2026-0190, an unsoundness advisory in anyhow::Error::downcast_mut() that can trigger undefined behavior (#6364)
• Go: Remove .gitignore from the released module so consumers who commit vendor/ keep the generated artifacts (internal/protobuf/*.pb.go, rustbin/**, lib.h) (#6441)

Changes

• Core/FFI: Add command_with_route_info FFI entrypoint, accepting routing as a RouteInfo C-struct pointer instead of protobuf-encoded bytes — the same mechanism batch() already uses. Existing command, command_with_buffer, command_with_buffers, and invoke_script are unchanged. (#6494)
• CI: Publish the Python valkey-glide and valkey-glide-sync packages to PyPI via Trusted Publishing (OIDC) with PEP 740 attestations, replacing API-token uploads (#6478)
• Node: Replace socket IPC with direct NAPI layer (#5325)
• feat(python-sync): add zero-copy buffers to mget (#6367)
• Python: Add configurable lib_name and client_info_tag to client configuration (async and sync). (#6378)

2.5

Fixes

• Python: Correct the set return type hint from Optional[bytes] to Optional[Union[TOK, bytes]]. The SET success reply is a RESP simple string (+OK), which GLIDE decodes to str (not bytes), so byte-only code that trusted the hint (e.g. result.decode()) type-checked but failed at runtime. Applies to the async client, sync client, and batch. (#6347)
• Core/FFI: Fix heap corruption in convert_vec_to_pointer where shrink_to_fit() (a non-binding hint) was followed by Vec::from_raw_parts with capacity = len. When the allocator kept extra capacity, deallocation passed the wrong size, corrupting heap metadata and causing delayed SIGABRT crashes after many pubsub messages or response frees. (#5637)
• Python: Fix get(key, buffer=...) under-reporting capacity for non-byte-format memoryviews. The sync client passed len(response_buffer) (element count) to the FFI instead of response_buffer.nbytes, so a memoryview with itemsize > 1 (e.g. array("I", ...)) was treated as itemsize× smaller than its real capacity, spuriously failing valid GETs with "Value size exceeds buffer capacity". Byte-format ("B") buffers were unaffected. (#6310)
• Core: Honor AWS_ENDPOINT_URL_STS in the IAM credentials-provider loader so ElastiCache/MemoryDB IAM auth works in AWS partitions that do not publish a separate FIPS STS hostname (e.g. us-gov-west-1). Previously, setting AWS_USE_FIPS_ENDPOINT=true made the SDK construct a non-existent sts-fips.<region>.amazonaws.com, causing credential acquisition to hang. Matches boto3 behavior. (#5967)
• Core: Make the pipeline send-timeout liveness-aware so sustained backpressure on a live-but-slow connection waits for channel capacity instead of failing commands with FatalSendError, while a genuinely dead connection still fails fast (#5446)

Changes

• Go: Add multi-key MIGRATE support (#6293)
• Core, Java, Go, Node, Python: Support server-assisted invalidation and add CLIENT TRACKINGINFO command (#5961)
• Core, Java, Python, Node, Go: Add MEMORY DOCTOR, MEMORY MALLOC-STATS, MEMORY PURGE, and MEMORY STATS commands (#6286)
• Java: implement MONITOR command (#6187)
• Node: Add GlideMonitorClient for MONITOR command (#6212)
• Python: implement MONITOR command for sync and async clients (#6132)
• Go: Add MonitorClient for MONITOR command (#6211)
• Java: Add MIGRATE KEYS (multi-key) variant (#6063)
• Node: Add MIGRATE KEYS (multi-key) variant (#6064)
• Core, Java, Python, Node, Go: Add LATENCY HISTORY, LATENCY LATEST, and LATENCY RESET command support (#6206)
• Node, Python, Go: Add FAILOVER and REPLICAOF command support (#6222)
• Python Async: Replace UDS+protobuf transport with FFI+pipe architecture. Commands go directly through CFFI to Rust; responses return via anonymous pipe with Rust-native parsing. Adds trio/anyio support, address resolver, cache metrics. +19-21% throughput for simple commands, +11-16% for collections vs v2.4.1. (#5637)
• Core: Extend timeout watchdog with structured diagnostics. Timeouts now report classified root cause (ServerUnresponsive, ClientBackpressure, SystemOverload), command phase (Queued vs Sent), inflight trend, per-client p99 latency, and suggested timeout. (#6044)
• Core, Python, Java, Node, Go: Add SAVE, BGSAVE and BGREWRITEAOF command support (#6095)
• Java: Add FAILOVER and REPLICAOF command support (#6170)
• Core, Java, Python, Node, Go: Add client-wide circuit breaker that detects sustained error rates and rejects requests at the FFI boundary before threads park. Opt-in via ClientCircuitBreakerConfiguration. Tracks error rate in a sliding window, trips when threshold is exceeded, and recovers automatically via optimistic HalfOpen with consecutive success validation. Java additionally performs a synchronous pre-check to prevent thread explosion under managedBlock(). (#5996)

... (truncated)

Commits

• 74a6c9a Update README with up-to-date information (#5941)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions