[25.05] redis: 7.2.9 -> 7.2.10

[Moraxyc]

Fixes CVE-2025-32023 and CVE-2025-48367
Ref: redis/redis@5018874

https://github.com/redis/redis/releases/tag/7.2.10

Not sure if it’s a good idea to update to 7.4.* since 7.2.* is still maintained.
Cause #399462

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• Nixpkgs 25.11 Release Notes (or backporting 25.05 Nixpkgs Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
• NixOS 25.11 Release Notes (or backporting 25.05 NixOS Release notes)
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other contributing documentation in corresponding paths.

---

Add a 👍 reaction to pull requests you find important.

[github-actions]

This report is automatically generated by the check-cherry-picks CI workflow.

Some of the commits in this PR have not been cherry-picked exactly and require the author's and reviewer's attention.

Please make sure to follow the backporting guidelines and cherry-pick with the -x flag. This requires changes to go to the unstable branches (master / staging) first, before backporting them.

Occasionally, it is not possible to cherry-pick exactly the same patch. This most frequently happens when resolving merge conflicts while cherry-picking or when updating minor versions of packages which have already advanced to the next major on unstable. If you need to merge this PR despite the warnings, please dismiss this review.

Warning

Couldn't locate original commit hash in message of e2c961d.

Hint: The full diffs are also available in the runner logs with slightly better highlighting.

[ghost]

Not sure if it’s a good idea to update to 7.4.* since 7.2.* is still maintained.

Probably not since that is the version with the license changes that are not available in nixpkgs.
#399462

[Moraxyc]

Not sure if it’s a good idea to update to 7.4.* since 7.2.* is still maintained.

Probably not since that is the version with the license changes that are not available in nixpkgs. #399462

Alright, I’ll target 7.2.10 soon (I’ll step away for a bit).

[Moraxyc]

Have no idea why CI failed.
https://github.com/NixOS/nixpkgs/actions/runs/16145829558/job/45564319296?pr=423450

Error: Unable to download artifact(s): Server Error

[mdaniels5757]

No clue, I'll try rerunning

[Moraxyc]

@wolfgangwalther Could you please take a look at the CI failure when you have time?

https://github.com/NixOS/nixpkgs/actions/runs/16145829558/job/45564319296?pr=423450
https://github.com/NixOS/nixpkgs/actions/runs/16146136382/job/45565387156?pr=423450

[wolfgangwalther]

That looks like GitHub networking errors. Since the failure moved to other jobs randomly, let me restart only the failing job and we keep the ones which already passed.

unstable is on redis 8.0 already.

[Moraxyc]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 423450

Logs: https://github.com/Moraxyc/nixpkgs-review-gha/actions/runs/16146743067

---

x86_64-linux

✅ 3 packages built:

• discourse
• discourseAllPlugins
• redis

---

aarch64-linux

❌ 3 packages failed to build:

• discourse
• discourseAllPlugins
• redis

---

Error logs: `aarch64-linux`

redis

    while executing
"{*}$r type $k"
    (procedure "createComplexDataset" line 49)
    invoked from within
"createComplexDataset $r $ops"
    (procedure "bg_complex_data" line 5)
    invoked from within
"bg_complex_data [lindex $argv 0] [lindex $argv 1] [lindex $argv 2] [lindex $argv 3] [lindex $argv 4]"
    (file "tests/helpers/bg_complex_data.tcl" line 13)
I/O error reading reply
    while executing
"{*}$r type $k"
    (procedure "createComplexDataset" line 49)
    invoked from within
"createComplexDataset $r $ops"
    (procedure "bg_complex_data" line 5)
    invoked from within
"bg_complex_data [lindex $argv 0] [lindex $argv 1] [lindex $argv 2] [lindex $argv 3] [lindex $argv 4]"
    (file "tests/helpers/bg_complex_data.tcl" line 13)
Killing still running Redis server 22070

---

x86_64-darwin (sandbox = true)

✅ 1 package built:

• redis

---

aarch64-darwin (sandbox = true)

✅ 1 package built:

• redis

[wolfgangwalther]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 423450
Commit: e2c961d11d0766751b15186859d279692e452e64

---

x86_64-linux

✅ 3 packages built:

• discourse
• discourseAllPlugins
• redis

---

aarch64-linux

✅ 3 packages built:

• discourse
• discourseAllPlugins
• redis

---

x86_64-darwin

✅ 1 package built:

• redis

---

aarch64-darwin

✅ 1 package built:

• redis

---

aarch64-linux passed for me!

[Moraxyc]

aarch64-linux passed for me!

It seems like there’s something random in the checkPhase that’s affecting the build, but I couldn’t find any clues about it. I tried rebuilding it and didn’t encounter any issues.

Given that the previous version has an RCE vulnerability, I suggest we merge this for now and monitor it further.

[wolfgangwalther]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 423450 --package redis.tests
Commit: e2c961d11d0766751b15186859d279692e452e64

---

x86_64-linux

✅ 2 packages built:

• redis.tests.redis.keydb
• redis.tests.redis.redis

---

aarch64-linux

❌ 1 package failed to build:

• redis.tests.redis.keydb

✅ 1 package built:

• redis.tests.redis.redis

---

keydb seems to fail to build on aarch64-linux, thus the test can't pass. Not sure whether that's already the case on release-25.05, we should double-check.

[mdaniels5757]

keydb fails on aarch64-linux on Hydra: https://hydra.nixos.org/build/302029868

[wolfgangwalther]

Thanks for looking!