v0.53.0

v0.53.0

This release adds an ElastiCache Serverless readiness check to migration analysis. It can run against a source alone, with no target connection, and reports what would block or complicate a move to Serverless. Validation now spot-checks keys on every cluster master, SSH-tunneled connections are refused before anything touches the target, and BetterDB stops a running migration and removes its credential files when it shuts down. Prometheus and OTLP gain seven INFO stats counters, including rejected connections and full resyncs. Session Explorer gets search, paging and pending-interrupt cards. KV Cache runs its first scan right after startup, and the Cache Size Simulator warns when sampling likely missed large keys. The release also clears every critical and high finding from pnpm audit and Docker Scout.

Upgrades are drop-in. Existing installs need no manual steps: the Better Auth upgrade includes a schema fix that runs on startup (see Security). A few behaviour changes to know about:

• Migrations stop when BetterDB shuts down and don't resume after a restart.
• SSH-tunneled connections can't be used for migration yet.
• Session Explorer returns 503 when it can't open its own read connection, instead of reading on the monitoring connection.

Highlights

ElastiCache Serverless readiness checks (#613)

Migration analysis gains a serverless_readiness category. It runs when the target is ElastiCache Serverless, detected from a *.serverless.<region>.cache.amazonaws.com endpoint or from an agent that reports a Serverless target.

• Blocking issues:
  • sampled key names over 4 KiB;
  • a master over 32 GB, or total memory over 5,000 GiB;
  • more than 166 masters;
  • PSYNC / REPLCONF unavailable;
  • slot gaps, overlaps or slots mid-migration.
• Warnings: cached scripts, pub/sub subscribers, and Serverless-restricted commands seen in COMMANDLOG / SLOWLOG.
• AWS-only blockers: a standalone source or an unsupported engine version blocks AWS's own migration tool but not BetterDB's. These issues are shown as warnings with a Blocks AWS migration badge.
• Standalone check: Check against ElastiCache Serverless runs without a target connection. It doesn't save a verdict, so it can't unlock migration execution. Over the API, pass targetProfile: 'elasticache_serverless' instead of targetConnectionId. Exactly one of the two is required.
• Agent: @betterdb/agent 1.8.0 reports Serverless targets in its hello, from AWS_SERVERLESS or the endpoint hostname. Older agents still work, but their Serverless targets are only detected from the endpoint.
• Available in the Community tier.

Migration

• Validation spot-checks keys on every cluster master (#575): the sample check used to scan only the seed node, so on a 3-master source two thirds of the keys were never checked. A shard that never reached the target could pass with 0 missing keys.
  • The roughly 500-key budget is now split across masters by DBSIZE, with at least one key per non-empty master while the budget allows.
  • Value reads go through the cluster client, so a MOVED or ASK during a slot migration or failover is followed instead of being reported as a missing key.
  • A failed source TYPE now fails the validation, instead of producing a clean empty sample.
• SSH-tunneled connections are rejected up front (#574): execution, validation and RedisShake connect to the stored host and port directly, not through the tunnel. Analysis used to succeed, and execution then timed out partway through. With redis_shake and emptyDbBeforeSync, the target was flushed and then nothing was migrated. Analysis, execution and validation now return 400 for a connection with an enabled tunnel, and the picker shows "SSH tunnel — not supported yet". A saved but disabled tunnel is allowed. docs/migration.md describes the workaround.
• Running migrations are stopped on shutdown (#567):
  • What happened before: under the CLI, RedisShake outlived the API, so a redis_shake_sync job kept replicating with nothing left to stop it. In Docker it was killed mid-write. In both cases, the job's TOML, which holds source and target credentials, was left in the temp directory.
  • Shutdown: BetterDB now cancels pending and running jobs, sends SIGTERM to RedisShake, and sends SIGKILL to anything still running after 3 s. It then removes leftover config and PID files. New migration requests return 503 while shutdown is in progress.
  • Startup: files left by a crash, OOM kill or SIGKILL are swept, but only when their process is gone. A live process is logged and left alone.
  • Config files: RedisShake configs are now written with owner-only permissions.
  • Migrations don't resume after a restart.

Monitoring & metrics

• New INFO stats counters for Prometheus and OTLP (#566): seven per-connection series in the full profile:

  • betterdb_rejected_connections_total
  • betterdb_sync_full_total
  • betterdb_sync_partial_ok_total
  • betterdb_sync_partial_err_total
  • betterdb_net_input_bytes_total
  • betterdb_net_output_bytes_total
  • betterdb_error_replies_total (omitted on servers before Redis 6.2)

  They are also mapped in semconv mode, and OTLP-push connections now export the rejected-connection and network counters they already ingested. alertmanager-rules.yml gains BetterDBConnectionsRejected and BetterDBRepeatedFullResyncs. The vitals profile is unchanged.

Session Explorer

• No fallback to the monitoring connection (#590): when the dedicated reader can't connect (for example when maxclients is reached), Session Explorer no longer reads on the monitoring connection, which has no command timeout. A standalone server returns 503. In a cluster, the unreachable node is reported as failed and the other nodes still return results. A new docs page covers read limits, cluster behaviour and CLIENT NO-TOUCH.
• Totals match the list, and pending interrupts are shown (#606): for LangGraph / @betterdb/agent-cache sessions, the detail header now shows the whole session's key count and memory, matching the list row. It also notes showing latest checkpoint (N keys · X) when only part of the session is loaded. Pending __interrupt__ writes appear as a Waiting for input card at the end of the timeline. Keys that couldn't be read are now told apart from keys that expired.
• Search, paging and a wider layout (#605): a filter box matches session ids, the list pages at 50 rows, and the namespace prefix is stripped from displayed ids (the full key is in a tooltip). On very wide screens, the list and detail sit side by side and the detail stays in view.
• Long messages collapse (#601): message bodies and tool-call arguments over 2,000 characters are cut, with a Show more (size) toggle. Vector Search uses the same component for long field values.

KV Cache

• The first scan runs as soon as the license is validated (#604): the first footprint scan used to start before license validation finished and was skipped, so the page said "No LMCache KV cache detected" for up to 5 minutes. The scan now runs as soon as validation settles, and the page shows Scanning for LMCache keys until it finishes. Failed scans and the next retry time are now shown on the page. Fixes the known issue from v0.52.0 (#591).
• Per-model key layout (#603): the Models table shows each model's own layout (single_key, two_key or mixed) instead of repeating the connection-wide one. Previously one model's keys could cause another model's keys to be classified wrongly. Snapshots stored before this release show —.

Cache Size Simulator

• Better estimates when a few large keys are missed (#608): when random sampling falls well short of used_memory_dataset, sampling keeps going toward its hard cap to find the large keys. If the gap remains, the Current state card warns: "Some large keys were likely missed; the estimate may be low."
• Sizing wording and chart axes (#602): node picks now say they keep the projection's upper bound under 80% of usable memory. The maxmemory and 80% labels no longer overlap, and chart axes use round, evenly spaced ticks.

UI

• The selected connection survives reloads (#607): the current connection is kept in a ?connection= URL parameter, which also makes links shareable, and remembered across reloads. Set as default now also switches the current tab to that connection.

Security

• Critical and high vulnerabilities patched (#617): pnpm audit and Docker Scout now report no critical, high or medium findings. The one remaining low finding (deepmerge) has no upstream fix.

  • better-auth 1.7.2 → 1.7.14 (critical GHSA-965c-763c-88jm, high GHSA-r4xp-prcw-77qf)
  • @fastify/middie ≥ 9.3.2 (critical GHSA-72c6-fx6q-fr5w and two high middleware bypasses)
  • handlebars, shell-quote, dompurify, @modelcontextprotocol/sdk, body-parser and the zod 3 copy pulled in by shadcn
  • RedisShake build stage: golang.org/x/text 0.39.0 → 0.43.0 (high CVE-2026-56851)

• Better Auth schema fix for existing installs (#617): every release since v0.44.0 shipped Better Auth 1.7.2. That version added a required account.issuer column, which 1.7.3 and later no longer write. Without a fix, existing installs would reject sign-ups, invite acceptance and account links after upgrading. On startup, the column is relaxed before Better Auth's own migrations run, following the upstream 1.7 upgrade guide.

• ReDoS fixes (#617):

  • The monitor session export key filter compiled user globs into a backtracking regex, so a crafted pattern could stall the event loop.
  • The client-snapshot addr filter built a RegExp from raw input.

  Both now use linear-time glob matching, with the same wildcards as before.

• CLI config is owner-only (#578): ~/.betterdb/config.json holds connection settings and the license key, and the password is in plaintext unless ENCRYPTION_KEY is set. It was readable by other local users. The file is now 0600 and the ~/.betterdb and ~/.betterdb/data directories 0700. Existing installs are tightened on the next start.

Dependencies

• See Security for the npm and image updates in #617.
• Python packages in packages/cache-benchmark: filelock 3.29.0 → 4.2.1 (#612), certifi 2026.5.20 → 2026.10.18 (#586)
• Example apps: undici 6.28.1 → 6.29.1 in packages/agent-cache/examples/vercel-ai-sdk (#599). Example apps and scripts/kv-cache-validate also get the Dependabot fixes from #617.

What's Changed

• Check sources against ElastiCache Serverless migration limits by @jamby77 in #613
• feat(migration): spot-check keys on every cluster master during validation by @amitkojha05 in #575
• fix(migration): reject SSH-tunneled connections before analysis, execution and validation by @amitkojha05 in #574
• fix(migration): stop running migrations and remove RedisShake configs on shutdown by @amitkojha05 in #567
• feat(prometheus): export rejected connections, replication resyncs, network bytes and error replies by @amitkojha05 in #566
• Fail session reads instead of falling back to the monitoring client by @jamby77 in #590
• Match LangGraph session totals and show pending interrupts by @jamby77 in #606
• Widen the session list, keep detail in view, add search by @jamby77 in #605
• Collapse long Session Explorer messages behind Show more by @jamby77 in #601
• Scan KV cache as soon as the license allows it by @jamby77 in #604
• Show each model's own KV cache layout by @jamby77 in #603
• Escalate sampling when large keys are missed by @jamby77 in #608
• Label node sizing as the upper bound and tidy simulator axes by @jamby77 in #602
• Keep the selected connection across reloads by @jamby77 in #607
• security: patch critical/high npm & Docker Scout vulnerabilities by @KIvanow in #617
• fix(cli): write ~/.betterdb config with owner-only permissions by @amitkojha05 in #578
• fix(semantic-cache): glob-escape the cache name in flush() SCAN patterns (TS + Python) by @amitkojha05 in #577
• chore(deps): bump filelock from 3.29.0 to 4.2.1 in /packages/cache-benchmark by @dependabot[bot] in #612
• chore(deps): bump certifi from 2026.5.20 to 2026.10.18 in /packages/cache-benchmark by @dependabot[bot] in #586
• chore(deps): bump undici from 6.28.1 to 6.29.1 in /packages/agent-cache/examples/vercel-ai-sdk by @dependabot[bot] in #599

Full Changelog: v0.52.0...v0.53.0

What's Changed

• fix(semantic-cache): glob-escape the cache name in flush() SCAN patterns (TS + Python) by @amitkojha05 in #577
• fix(cli): write ~/.betterdb config with owner-only permissions by @amitkojha05 in #578
• chore(deps): bump undici from 6.28.1 to 6.29.1 in /packages/agent-cache/examples/vercel-ai-sdk by @dependabot[bot] in #599
• chore(deps): bump certifi from 2026.5.20 to 2026.10.18 in /packages/cache-benchmark by @dependabot[bot] in #586
• feat(prometheus): export rejected connections, replication resyncs, network bytes and error replies by @amitkojha05 in #566
• feat(migration): spot-check keys on every cluster master during validation by @amitkojha05 in #575
• fix(migration): reject SSH-tunneled connections before analysis, execution and validation by @amitkojha05 in #574
• fix(migration): stop running migrations and remove RedisShake configs on shutdown by @amitkojha05 in #567
• chore(deps): bump filelock from 3.29.0 to 4.2.1 in /packages/cache-benchmark by @dependabot[bot] in #612
• Fail session reads instead of falling back to the monitoring client by @jamby77 in #590
• Collapse long Session Explorer messages behind Show more by @jamby77 in #601
• Label node sizing as the upper bound and tidy simulator axes by @jamby77 in #602
• Show each model's own KV cache layout by @jamby77 in #603
• Widen the session list, keep detail in view, add search by @jamby77 in #605
• Keep the selected connection across reloads by @jamby77 in #607
• Escalate sampling when large keys are missed by @jamby77 in #608
• Check sources against ElastiCache Serverless migration limits by @jamby77 in #613
• Scan KV cache as soon as the license allows it by @jamby77 in #604
• Match LangGraph session totals and show pending interrupts by @jamby77 in #606
• security: patch critical/high npm & Docker Scout vulnerabilities by @KIvanow in #617

Full Changelog: v0.52.0...v0.53.0