fix(deps): update module github.com/redis/go-redis/v9 to v9.20.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/redis/go-redis/v9	v9.18.0 → v9.20.1

---

Release Notes

redis/go-redis (github.com/redis/go-redis/v9)

v9.20.1: 9.20.1

Compare Source

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

🚀 Highlights

RESP3 pub/sub message loss fixed

PeekPushNotificationName previously inspected only the bytes already buffered by bufio, so when a push frame header straddled a buffer fill boundary it could return a truncated notification name (e.g. "messa" instead of "message"). The push processor then mis-routed the frame and ReadReply silently dropped it, causing intermittent RESP3 pub/sub message loss. The peek now grows its window (36 bytes → up to 4 KiB) and reads more from the connection until the header is complete, cleanly separating incomplete prefixes from corrupt frames (including overflow-safe bulk-length handling). Fixes #​3839.

(#​3842) by @​ndyakov

🐛 Bug Fixes

• RESP3 push peeking: PeekPushNotificationName no longer returns a truncated notification name when a push frame header spans a buffer boundary, preventing silent RESP3 pub/sub message loss (fixes #​3839) (#​3842) by @​ndyakov
• FT.HYBRID vector params: Vector data is now always sent via PARAMS with auto-generated param names (__vector_param_N, with collision avoidance) when VectorParamName is omitted, since Redis no longer accepts inline vector blobs; the FTHybridOptions.Params map is no longer mutated, so the same options struct can be reused across calls (#​3844) by @​ndyakov
• CLUSTER SHARDS forward compatibility: Unknown shard- and node-level attributes in the CLUSTER SHARDS reply are now skipped via DiscardNext() instead of erroring, so clients keep working when the server introduces new fields (#​3843) by @​madolson
• PubSub double reconnect: PubSub.releaseConn no longer reconnects twice when a connection is both unusable (or pending handoff) and reports a bad-connection error, avoiding a wasted connection establish-then-close cycle (#​3833) by @​cxljs

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@​cxljs, @​madolson, @​ndyakov

---

Full Changelog: redis/go-redis@v9.20.0...v9.20.1

v9.20.0: 9.20.0

Compare Source

🚀 Highlights

Redis 8.8 Support

This release adds support for Redis 8.8. The README's supported-versions list now includes Redis 8.8 alongside 8.0/8.2/8.4, and CI exercises the 8.8 client-libs-test image across the full suite (Makefile, build workflow, doctests, run-tests action, and docker-compose).

Coverage for the new commands that ship in the 8.x line, rounded out in this release:

• AR* array data type (#​3813) — new array data structure, exposed via the ArrayCmdable interface (see the experimental-features highlight below).
• INCREX (#​3816) — atomic increment with expiration in a single round-trip.
• XNACK (#​3790) — explicit negative-acknowledge of pending stream entries.
• XAUTOCLAIM PEL deletes (#​3798) — XAUTOCLAIM/XAUTOCLAIMJUSTID now return the list of deleted message IDs from the pending entries list.
• TS.RANGE multiple aggregators (#​3791) — TS.RANGE/TS.REVRANGE/TS.MRANGE/TS.MREVRANGE accept multiple aggregators in a single call.
• Z(UNION|INTER|DIFF) COUNT aggregator (#​3802) — COUNT reducer for sorted-set set operations.
• JSON.SET FPHA (#​3797) — new FPHA argument that specifies the floating-point type for homogeneous FP arrays.

CI image bump (#​3814) by @​ofekshenawa. Command coverage contributions by @​cxljs, @​elena-kolevska, @​Khukharr, @​ndyakov, and @​ofekshenawa.

Stable RESP3 for RediSearch (UnstableResp3 deprecated)

FT.SEARCH, FT.AGGREGATE, FT.INFO, FT.SPELLCHECK, and FT.SYNDUMP now parse RESP3 (map) responses into the same typed result objects as RESP2 — Val() and Result() work uniformly on both protocols, no flag required. Previously, RESP3 search responses required UnstableResp3: true and were returned as opaque maps accessible only via RawResult() / RawVal().

As a result, the UnstableResp3 option is now a no-op across every options struct (Options, ClusterOptions, UniversalOptions, FailoverOptions, RingOptions) and has been marked // Deprecated:. The field is retained for backwards compatibility — existing code that sets UnstableResp3: true will continue to compile and behave identically — but it will be removed in a future release and new code should not set it. RawResult() / RawVal() continue to work for callers that prefer the raw RESP payload.

(#​3741) by @​ndyakov

Experimental Array Data Structure Commands

Adds an experimental ArrayCmdable interface with the AR* command family (ARSet, ARGet, ARGetRange, ARMSet, ARMGet, ARDel, ARDelRange, ARScan, ARSeek, ARNext, ARLastItems, ARGrep, ARGrepWithValues, ARInfo/ARInfoFull, and typed reducers AROpSum/AROpMin/AROpMax/AROpAnd/AROpOr/AROpXor/AROpMatch/AROpUsed) for working with Redis 8.8's new array data type. API is experimental and may change in a future release.

(#​3813) by @​cxljs

✨ New Features

• RESP3 search parser: First-class RESP3 parsing for FT.SEARCH/FT.AGGREGATE/FT.INFO/FT.SPELLCHECK/FT.SYNDUMP responses with backwards compatibility for RESP2 (#​3741) by @​ndyakov
• INCREX: New INCREX command support — atomic increment with expiration (#​3816) by @​ndyakov
• XNACK: Client support for the XNACK stream command for explicitly negative-acknowledging pending entries (#​3790) by @​elena-kolevska
• TS range multiple aggregators: TS.RANGE/TS.REVRANGE/TS.MRANGE/TS.MREVRANGE now accept multiple aggregators in a single call (#​3791) by @​elena-kolevska
• XAutoClaim deleted IDs: XAUTOCLAIM/XAUTOCLAIMJUSTID now return the list of deleted message IDs from the PEL (#​3798) by @​Khukharr
• JSON.SET FPHA: JSON.SET accepts a new FPHA argument that specifies the floating-point type for homogeneous floating-point arrays (#​3797) by @​ndyakov
• Sorted-set union/intersection COUNT: ZUNION/ZINTER/ZDIFF aggregator now supports COUNT (#​3802) by @​ofekshenawa
• FT.HYBRID vector validation: Validates hybrid-search vector input types and adds proper typed vector parameters (#​3756) by @​DengY11
• Cluster pool wait stats: ClusterClient.PoolStats() now accumulates WaitCount and WaitDurationNs across all node pools (previously always zero) (#​3809) by @​LINKIWI

🐛 Bug Fixes

• TLS-only Cluster PubSub: CLUSTER SLOTS port-0 entries now fall back to the origin endpoint's port, fixing dial tcp <ip>:0: connection refused on TLS-only clusters started with --port 0 --tls-port <port> (fixes #​3726) (#​3828) by @​ndyakov
• Sharded PubSub reconnect routing: PubSub.conn() now passes both regular (c.channels) and sharded (c.schannels) channels into the per-PubSub newConn closure. Previously, ClusterClient.SSubscribe-only PubSubs reconnected to a random node (because the routing closure saw an empty channel list), the SSUBSCRIBE was sent to the wrong shard, and the resulting MOVED reply was silently dropped (#​3829) by @​ndyakov
• ClusterClient Watch retry: User errors returned from a Watch callback are no longer subjected to cluster-retry classification; transient cluster errors still retry, but a callback returning e.g. net.ErrClosed short-circuits immediately (#​3821) by @​obiyang
• Sentinel concurrent-probe leak: MasterAddr's concurrent sentinel probe now closes the non-winning sentinel clients instead of leaking them (#​3827) by @​cxljs
• Sentinel rediscovery loop on master-only setups: replicaAddrs no longer tears down the cached sentinel client when the replica list is empty, eliminating a continuous rediscovery loop on master-only Sentinel deployments that flooded logs and added per-operation latency (#​3795) by @​shahyash2609
• Pool CloseConn hooks: Pool.CloseConn now triggers registered hooks, fixing a memory leak when connections are closed explicitly rather than via the normal removal path (#​3818) by @​ndyakov
• Dial TCP error redirection: Wrapped dial tcp errors are now correctly classified as redirectable so cluster routing can recover from a single unreachable node (#​3810) by @​vladisa88
• Pool Close health checks: ConnPool.Close now only runs health checks against idle connections, avoiding spurious activity on connections still in use (#​3805) by @​ndyakov
• VLinks return type: Fixed the return type of VLINKS/VLINKSWITHSCORES vector-set replies (#​3820) by @​romanpovol

🧪 Testing & Infrastructure

• Flaky tests: Stabilized several flaky tests in the sentinel and pool suites (#​3815) by @​ndyakov
• Sentinel failover metric race: Fixed a data race in the sentinel failover metric test (#​3824) by @​cxljs
• waitForSentinelClusterStable post-conditions: The sentinel test harness now waits for replicas to be fully connected (not just present in the count) and is robust to randomized spec ordering after failover specs, eliminating an intermittent Expected master to equal slave flake (#​3830) by @​ndyakov
• govulncheck workflow: New scheduled GitHub Actions workflow runs govulncheck on every push, PR, and weekly, surfacing newly disclosed Go vulnerabilities even when no code changes (#​3779) by @​solardome
• CI Redis 8.8-rc1: CI now exercises the 8.8-rc1 Redis image (#​3814) by @​ofekshenawa

🧰 Maintenance

• Cmd.Slot() lookup refactor: Caches the per-command CommandInfo and short-circuits keyless commands before the switch dispatch, removing redundant Peek calls (#​3804) by @​retr0-kernel
• stdlib math/rand: Replaced internal/rand with math/rand from the standard library now that the minimum Go version is 1.24 (#​3823) by @​cxljs
• ConnPool queue channel: Removed the unused queue channel from ConnPool, trimming the pool's footprint (#​3826) by @​cxljs
• Extra packages LICENSE: Added a LICENSE file to each extra/* package (#​3817) by @​ndyakov
• README & CI image: Documentation refresh and bumped the default CI image tag (#​3822) by @​ndyakov

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@​cxljs, @​DengY11, @​elena-kolevska, @​Khukharr, @​LINKIWI, @​ndyakov, @​obiyang, @​ofekshenawa, @​retr0-kernel, @​romanpovol, @​shahyash2609, @​solardome, @​vladisa88

---

Full Changelog: redis/go-redis@v9.19.0...v9.20.0

v9.19.0: 9.19.0

Compare Source

🚀 Highlights

FIPS-Compatible Script Helper

Script now supports a FIPS-safe execution mode that avoids client-side SHA-1 computation, which is blocked in strict FIPS environments. A new NewScriptServerSHA constructor uses SCRIPT LOAD to obtain and cache the digest from the server, then runs commands via EVALSHA/EVALSHA_RO. Falls back to EVAL/EVALRO if loading fails, and transparently retries once on NOSCRIPT. The default behavior is unchanged for existing users.

(#​3700) by @​chaitanyabodlapati

FT.AGGREGATE Step-Based Pipeline Builder

Added a new step-based FT.AGGREGATE pipeline API via FTAggregateOptions.Steps, allowing LOAD, APPLY, GROUPBY, and SORTBY (with per-step MAX) to be repeated and interleaved in arbitrary order — matching Redis's native multi-stage aggregation semantics. The legacy Load/Apply/GroupBy/SortBy/SortByMax fields are now deprecated.

(#​3782) by @​ndyakov

Raw RESP Protocol Access

Added DoRaw and DoRawWriteTo methods for executing arbitrary commands and reading the raw RESP response. Useful for proxying, custom protocol inspection, and working with commands not yet wrapped by go-redis.

(#​3713) by @​ofekshenawa

Configurable Dial Retry Backoff

Added DialerRetryBackoff option (plumbed through Options, ClusterOptions, RingOptions, FailoverOptions) to let callers customize the delay between failed dial attempts. Helpers DialRetryBackoffConstant and DialRetryBackoffExponential (with jitter and cap) are provided out of the box. Dial timeout is now also applied per attempt rather than across all retries.

(#​3706, #​3705) by @​mwhooker

✨ New Features

• FT.AGGREGATE Steps: Step-based pipeline builder for FT.AGGREGATE with support for repeated/interleaved LOAD, APPLY, GROUPBY, and SORTBY stages (#​3782) by @​ndyakov
• VectorSet commands: Added VISMEMBER and WITHATTRIBS support (#​3753) by @​romanpovol
• FIPS-safe Script: NewScriptServerSHA uses SCRIPT LOAD to obtain the digest from the server, avoiding client-side SHA-1 (#​3700) by @​chaitanyabodlapati
• Raw RESP access: DoRaw and DoRawWriteTo for raw RESP protocol access (#​3713) by @​ofekshenawa
• Dial retry backoff: DialerRetryBackoff function option with constant and exponential helpers (#​3706) by @​mwhooker
• Typed NOSCRIPT error: Redis NOSCRIPT replies are now surfaced as a typed error for easier handling (#​3738) by @​LINKIWI
• PubSub ClientSetName: Added ClientSetName method to PubSub (#​3727) by @​Flack74
• ReplicaOf: New ReplicaOf method replaces the deprecated SlaveOf (#​3720) by @​Copilot
• HSCAN BinaryUnmarshaler: HScan now supports types implementing encoding.BinaryUnmarshaler (#​3768) by @​Aaditya-dubey1

🐛 Bug Fixes

• Auto hostname type detection: Improved endpoint type detection for maintenance notifications using DNS-based classification; handles empty hosts and expanded private-IP ranges (#​3789) by @​ndyakov
• HELLO fallback: Don't send CLIENT MAINT_NOTIFICATIONS handshake when HELLO fails and connection falls back to RESP2; fail fast when explicitly enabled with RESP3 (#​3788) by @​ndyakov
• Dial TCP retry: ShouldRetry now treats net.OpError with Op == "dial" timeout errors as safe to retry since no command was sent (#​3787) by @​vladisa88
• wrappedOnClose leak: Fixed resource leak caused by repeatedly wrapping baseClient close logic; replaced with a bounded, concurrency-safe named-hook registry (#​3785) by @​ndyakov
• Pool Close() on stale connections: Suppress close errors (e.g., TLS closeNotify timeouts) for connections already dropped by the server due to idle timeout (#​3778) by @​ofekshenawa
• FIFO waiter ordering: Fixed race in ConnStateMachine.notifyWaiters that could wake multiple waiters under a single mutex hold and violate FIFO ordering (#​3777) by @​0x48core
• Lua READONLY detection: Detect READONLY errors embedded in Lua script error messages on read-only replicas so commands are correctly retried (#​3769) by @​zhengjilei
• VectorScoreSliceCmd RESP2: Fixed VSimWithScores, VSimWithArgsWithScores, and VLinksWithScores which were broken on RESP2 connections returning flat arrays instead of maps (#​3767) by @​Copilot
• Closed connection handling: Two fixes for closed connection handling in the pool (#​3764) by @​cxljs
• ZRangeArgs Rev: Fixed ZRangeArgs with Rev + ByScore/ByLex incorrectly swapping Start/Stop, breaking ZRANGESTORE (#​3751) by @​Copilot
• OTel metric instrument types: Fixed metric instrument types in redisotel-native (#​3743) by @​ofekshenawa
• Options.clone() data race: Fixed data race when cloning Options (#​3739) by @​rubensayshi
• Connection closure metrics: Fixed connection closure metrics and enabled all metric groups by default in redisotel-native (#​3735) by @​ofekshenawa
• OTel semconv v1.38.0: Use metric definition from otel/semconv/v1.38.0 in redisotel-native (#​3731) by @​wzy9607
• SETNX semantics: Use SET ... NX instead of the deprecated SETNX command (#​3723) by @​ndyakov
• TIME keyless routing: Mark TIME as a keyless command for correct cluster routing (#​3722) by @​fatal10110
• Dial timeout per retry: Dial timeout now applies per attempt instead of across all retry attempts combined (#​3705) by @​mwhooker
• Cluster metrics attributes: Fixed pool.name being appended per node, which corrupted and dropped user-provided custom attributes (#​3699) by @​Jesse-Bonfire
• initConn nil dereference: Fixed nil pointer dereference and potential deadlock in *baseClient.initConn(); added explicit nil option guards to client constructors (#​3676) by @​olde-ducke

⚡ Performance

• RESP reader: Optimized RESP reader by eliminating intermediate string allocations (#​3774) by @​Aaditya-dubey1
• Inline rendezvous hashing: Replaced github.com/dgryski/go-rendezvous dependency with an in-repo implementation in internal/hashtag, reducing the dependency graph while preserving algorithm parity (#​3762) by @​bigsk05

🧪 Testing & Infrastructure

• Release automation: Added repository, ref, and client-libs-test-image-tag inputs to the run-tests composite action; redis-version is now optional so unstable builds use REDIS_VERSION from the Makefile (#​3749) by @​dariaguy
• Go 1.24: Updated minimum Go version to 1.24 and use -compat=1.24 in release scripts (#​3714, #​3754) by @​ndyakov, @​cxljs

🧰 Maintenance

• Pool state machine: Removed redundant Conn.closed atomic field in favor of the state machine's StateClosed (#​3783) by @​cxljs
• OTel SDK: Updated OpenTelemetry SDK dependencies in redisotel/redisotel-native (#​3770) by @​ndyakov
• Go 1.21+ built-ins: Use maps.Keys, slices.Collect, slices.Contains, clear(), and slices.SortFunc instead of custom helpers (#​3758, #​3746) by @​cxljs
• HGetAll docs: Added Go doc comment to HGetAll describing behavior and complexity (#​3776) by @​0x48core
• Docs links: Fixed irrelevant docs links (#​3724) by @​olzhas-sabiyev
• Examples cleanup: Removed throughput binary from examples (#​3733) by @​ndyakov

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@​0x48core, @​Aaditya-dubey1, @​Copilot, @​Flack74, @​Jesse-Bonfire, @​LINKIWI, @​bigsk05, @​chaitanyabodlapati, @​cxljs, @​dariaguy, @​fatal10110, @​mwhooker, @​ndyakov, @​ofekshenawa, @​olde-ducke, @​olzhas-sabiyev, @​romanpovol, @​rubensayshi, @​vladisa88, @​wzy9607, @​zhengjilei

---

Full Changelog: redis/go-redis@v9.18.0...v9.19.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​redis/​go-redis/​v9@​v9.18.0 ⏵ v9.20.1	+1

View full report