Redis 6.2.2 repairs Pub/Sub permissions across ACL reloads

A permission default can behave differently when a user is created, overwritten or loaded from a file. Redis 6.2.2 repairs that inconsistency in the new Pub/Sub ACL support. The correction matters during upgrades because restoring intended compatibility can grant access that the preceding two releases accidentally denied. Saved ACLs also need to represent their permissions independently of the server default used when they are later loaded.

The 6.2 release notes date 6.2.2 to April 19. The tagged notes classify the upgrade as high urgency for users affected by ACL and Pub/Sub behavior, configuration rewrites or performance regressions. These conditions are specific enough to explain the patch without treating every item as equally relevant to every deployment.

I have used Redis since its early releases, and I care about its operational semantics as much as its concise commands. An ACL that changes meaning after reload is difficult to reason about. This release exposes both the source of that inconsistency and a separate case where observing resource use imposed too much work on the system being observed.

Existing users missed the intended channel default

The default-permission correction explains that Redis 6.2's Pub/Sub channel ACLs were intended to remain permissive by default for compatibility with 6.0. Newly created users received the configured acl-pubsub-default. Overwritten and reset users did not consistently receive that treatment, so permissions depended on the path used to establish the user.

The built-in default user already exists before configuration loads. Loading its ACL settings therefore updates an existing user. Under the defect, a default user loaded without channel-specific rules could lose access to channels, while a newly created user received the permissive default. Reloading users from an included ACL file could cause the same loss.

The patch restores the intended compatibility with 6.0. Its description also warns that this changes behavior relative to 6.2.0 and 6.2.1. The default user can regain Pub/Sub access after the upgrade. That is an important distinction for anyone who mistook the accidental denial for an explicit access policy.

An explicit policy and a missing rule are different inputs. A user configured to deny channels expresses a restriction. A user without channel rules receives behavior based on the applicable default. The repair makes that default apply more consistently, which is why the upgrade can change access without an operator adding a new allow rule.

Saved permissions need an explicit starting state

The ACL save/load correction addresses a related issue. A user restricted to one channel could be saved successfully but fail when loaded. The initial 6.2 behavior could assert, and an intervening change turned the problem into an error without fully resolving it.

The underlying problem is that the server writing an ACL file does not know which acl-pubsub-default the loading server will use. A serialized list of channel patterns therefore needs an explicit initial state. Otherwise a limited pattern can be combined with an inherited all-channels state, or a missing rule can acquire a different interpretation on reload.

The patch description discusses the distinction between resetting to the configured default and explicitly selecting no channels. Its examples show why a channel pattern added after an all-channels rule does not meaningfully narrow the permission. A persisted representation needs to preserve the intended set, not merely replay commands that happen to work under one default.

This is a useful instance of configuration serialization being part of access control. The current in-memory policy can be correct while its saved form is insufficiently explicit. A round trip through saving and loading must retain the intended meaning. The release's two ACL fixes address different parts of that round trip.

Copy-on-write reporting receives a duty-cycle limit

The background-reporting fix concerns the cost of reading copy-on-write information from /proc/<pid>/smaps. The proposal explains that this can be slow for large processes on some platforms. Redis 6.2's child reporting could consequently slow background saves, append-only rewrites and replication work.

The correction measures how long collecting that information takes and limits the duty cycle of subsequent updates to roughly one percent. Expensive sampling therefore reduces the frequency of later sampling. This addresses the work spent observing the child process instead of attributing all delay to the database's data-writing path.

The change also introduces current_cow_size_age, reported in seconds. Since the size sample no longer arrives at a fixed interval, readers need its age to interpret it. A copy-on-write size and the time since collection describe a different observation from a value assumed to be continuously current.

I find that pairing useful. Reducing measurement overhead changes the freshness of the evidence. Supplying an age field lets an operator retain that qualification when reading the metric, instead of silently treating an older sample as an instantaneous measurement.

Configuration and cursor corrections have visible effects

Version 6.2.2 also fixes rewriting an empty save configuration into default save values. This is another case where an accepted in-memory configuration could change meaning after persistence. The intended absence of configured save conditions should survive a rewrite, so the correction affects deployments relying on that explicit choice.

Stream recovery receives two behavioral repairs. XAUTOCLAIM now returns the next available entry ID as its cursor instead of the last ID already scanned. Its JUSTID form also stops increasing the delivery count. These changes affect continuation and delivery metadata, not merely the formatting of a reply.

The release therefore repairs several ways state can acquire the wrong interpretation across an operation boundary. For ACLs, the distinction is between intended defaults and explicit restrictions preserved through reload. In copy-on-write reporting, the new age field records the freshness cost of limiting sampling work. For XAUTOCLAIM, the returned cursor identifies where subsequent scanning should continue.