Bump hiredis from ccad7eb to 67c88a0

[dependabot]

Bumps hiredis from ccad7eb to 67c88a0.

Commits

• 67c88a0 Merge pull request #1329 from redis/im/bump-version
• 0cdb564 Merge pull request #1325 from memark/bump-cmake
• ecc0013 Bump version to 1.4.0
• 86f5cc0 test: verify sign bit in double edge-magnitude test
• 013a483 read/ffc: fix macOS -Werror build + review feedback
• 6d6d564 Use ffc (pure-C99) as the RESP3 double parser instead of strtod
• 1d18adb fix: add NULL check for c->funcs before dereferencing in redisReconnect
• 74b8781 update gha
• 043acf6 bump required cmake version to 3.15
• e834b57 FetchContent should not include cpack (#1307)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[derekste]

Resolved: the repository now defines the dependencies label requested by .github/dependabot.yml, and this pull request has been labeled accordingly. Future Dependabot updates can apply the configured label automatically.

[bigsamich]

Two things before merging:

1. CMake minimum. hiredis 1.4.0 raises its own cmake_minimum_required to 3.15, while we declare 3.14 (CMakeLists.txt:1, docs/building.md). With CMake 3.14.7, main configures but this branch fails with "CMake 3.15.0 or higher is required". CI uses ubuntu-24.04's CMake 3.28, so it can't catch this.
2. Security releases. hiredis published v1.4.1 and v1.3.1 on 2026-08-06, fixing a nested-reply stack overflow and a map-element overflow. The impact is a client crash if the server is hostile or an attacker is on the path. Both are tagged on release branches, so Dependabot won't offer them. v1.4.1 differs from v1.4.0 only in read.c.

Both 1.4.0 and 1.4.1 pass our suite locally: 14/14 on main, and 18/18 on the #111 stack with all three submodule bumps. redis-plus-plus's generated hiredis_features.h is identical, and hiredis/COPYING is unchanged.

I'd suggest replacing this with a manual bump to v1.4.1 (616f228) and raising the CMake minimum to 3.15 in CMakeLists.txt and docs/building.md. Alternatively, bump to v1.3.1 (bad0c4d) to keep 3.14.

Also, the new vendored ffc.h carries its own MIT notice, which the hiredis row in THIRD_PARTY_NOTICES.md doesn't mention.

[derekste]

@bigsamich Thanks for flagging both requirements. I checked the upstream v1.4.1 release and its CMakeLists.txt: it includes the nested-reply and map-element fixes and requires CMake 3.15.

I propose replacing the 1.4.0 update with a deliberate v1.4.1 pin, updating our declared CMake minimum and build documentation to 3.15, and retaining the additional ffc.h notice. The replacement needs a fresh build against the documented minimum and validation on the corrected adapter stack. If a consumer still requires CMake 3.14, the 1.3.1 route needs a separate compatibility decision before changing that floor.

The fixes above are in progress. I'll post the changed commits and validation before requesting another code review.

[derekste]

@bigsamich replaced this v1.4.0 update with #129, which pins the v1.4.1 security release, raises the documented CMake minimum to 3.15, and adds the ffc.h MIT notice to the dependency inventory. Native Linux builds with CMake 3.15.0, all 14 current-main cases pass, and this pin also passes all 107 standalone tests on the revised #111 stack with C++20/Redis 7.4.2.

Closing this superseded dependency PR; #129 is ready for review. #128 also excludes hiredis and GoogleTest from automatic submodule updates and documents manual upstream release checks.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.