v1.1.0

KiviDB v1.1.0

What's in 1.1.0

KiviDB is now open source, under the GNU Affero General Public License,
version 3 (AGPL-3.0-only). The KiviDB End User License Agreement no longer
applies to this or later releases. Using KiviDB as the database of your
application does not put your application under the AGPL; only a modified
KiviDB offered to others over a network must have its source offered too.
A commercial license is also available. The entitlement check that builds for cloud
marketplaces made at startup is removed, with the marketplace machine images.

1.1.0 supersedes 1.0.6, which was published only as release candidates
(1.0.6-rc1 to 1.0.6-rc4) and never as a final release. Everything in those
candidates is in 1.1.0. Coming from 1.0.5, it brings:

• security fixes: Lua scripts are kept in their sandbox, a command a script
  calls is checked against the user's ACL, protected mode is enforced, and
  malformed input from a client can no longer crash or stall the server;
• a server log you can act on, and a page explaining every warning and
  error;
• a startup update check;
• cluster work: min-replicas-to-write, hostnames, a bus secret, TLS
  between nodes, and search indexes and queries across every master;
• lower memory per key, scripts that run several times faster, and vector
  ingest about six times faster;
• images on Docker Hub as well as GHCR.

CHANGELOG.md
has the full list.

Before you upgrade

• Protected mode is now enforced (protected-mode yes, the default, as
  in Redis). With no bind address given and no password on the default
  user, only clients on the same machine may connect; others are told
  -DENIED and disconnected. It used to be ignored. A server reached over
  the network with a passwordless default user needs a password, a bind
  address, or protected-mode no. Replicas and cluster nodes connect as
  clients too. The Docker image turns protected mode off unless you pass
  arguments of your own.
• Scripts are checked against the caller's ACL. A command a script runs
  through redis.call is now held to the same ACL rules as one the user
  sends directly. A user allowed EVAL could previously run any command on
  any key from a script.
• Scripts lose package, require, loadfile, dofile, debug and
  string.dump, and load takes source text only, not bytecode. A script
  that used any of these fails.
• Scripts on one hash tag may not touch keys outside it. A script whose
  KEYS all carry one hash tag ({orders}:waiting) now runs beside scripts
  on other tags, and a redis.call on a key outside its tag fails.
  lua-parallel-scripts no restores the old behaviour. See
  docs/SCRIPTS.md.
• tls-ca-cert-file now verifies client certificates. It was read and
  then ignored, so any client that trusted the server could connect. With a
  CA file set, a client must now present a certificate that CA signed, as on
  Redis. If you set tls-ca-cert-file and your clients send no certificate,
  they will be refused after upgrading: give them certificates, or set the
  new tls-auth-clients to no (not asked) or optional (checked only when
  presented). Without a CA file nothing changes.
• The server now makes one outbound HTTPS request at startup to
  https://github.com/kividbio/kividb/releases/latest, unless you turn it off. If your
  hosts may not reach the internet, or you do not want the request made,
  add update-check no to the config file (or pass --update-check no, or
  set KIVIDB_NO_UPDATE_CHECK=1). A host without internet access still
  starts; it waits at most 1.5 seconds for the reply, and the failure is
  logged at debug level only.
• loglevel now works. It was accepted and ignored: every message was
  printed, whatever it was set to. If you start KiviDB with --loglevel warning or error, the informational lines (loading, saving, role
  changes) are no longer printed. The default, notice, shows them.
• Log lines changed shape. Each now starts with a UTC timestamp and the
  process id: 2026-10-09T07:21:30.114Z 4242 [INFO] …. Lines that were
  tagged [AOF], [REPL] or [CLUSTER] are now [INFO], [WARN] or
  [ERROR] lines that begin AOF:, Replication: or Cluster:. If you
  parse the log, check your patterns; or switch to log-format json.
• The arm64 Linux binary, packages and image need an ARMv8.1 CPU
  (Graviton2 and later, Ampere, and other current arm64 servers). A
  Raspberry Pi 4 and a first-generation Graviton can no longer run them.

Added

• Logging you can act on. See
  docs/LOGGING.md
  and docs/ERRORS.md.

  • Redis's levels: debug, verbose, notice (the default), warning
    and nothing. CONFIG SET loglevel changes it at runtime. CONFIG SET loglevel verbose and notice used to be refused, though the error
    message listed them.
  • logfile writes the log to a file. It used to be accepted and ignored.
  • log-format json: one JSON object per line, for log pipelines.
  • New lines: Ready to accept connections on … once the server is
    listening; the version, pid and config file at startup; every
    CONFIG SET (secrets hidden); memory full and writes refused with
    OOM; a script past lua-time-limit making other clients wait. At
    verbose: every client connection and disconnection, failed
    authentication, and protocol errors.
  • Warnings and errors say what to do. Some that did not now do: a port in
    use, a failed background save (which used to print a Rust debug dump), a
    failed save at shutdown, an unreadable ACL file, io_uring blocked by a
    seccomp profile, a full disk or failing fsync under the AOF, and running
    out of file descriptors.
  • Errors that can repeat as fast as the work behind them (every AOF write
    on a full disk, every accept at the file-descriptor limit) are logged at
    most every 10 seconds.
  • docs/ERRORS.md
    explains every [FATAL], [ERROR] and [WARN] line, and every error
    reply a client can get (OOM, BUSY, NOSCRIPT, CROSSSLOT, …): what
    it means, how urgent it is, and what to do.

• Startup update check. Once per start, KiviDB asks this repository's
  GitHub releases page whether a newer release is out. If one is, the first
  thing it prints, above the banner, is a notice with the link to it.

  • It requests https://github.com/kividbio/kividb/releases/latest and
    reads the newest release's tag from GitHub's redirect. No API, no
    token, no rate limit. Nothing is sent but the request itself: no host
    name, configuration, key or dataset information, and no identifier.
  • Startup waits for the reply at most 1.5 seconds; a slower reply is
    dropped. It never touches client connections.
  • Only a version-shaped tag (v1.2.3, v1.2.3-rc1) is accepted, and
    nothing else from the reply is printed.
  • It is never made by debug builds, or when CI is set.
  • update-check-url points it at another HTTPS address, such as a mirror
    in a closed network.

  See docs/UPDATE_CHECK.md.

• Cluster: min-replicas-to-write and min-replicas-max-lag, as in
  Redis; INFO cluster; cluster-announce-hostname and
  cluster-preferred-endpoint-type; cluster-bus-secret, which a node must
  prove it knows before anything it sends on the cluster bus is read; and
  TLS between nodes with tls-cluster and tls-replication (builds with
  TLS).

• Cluster: search across every master. FT.CREATE, FT.ALTER,
  FT.DROPINDEX and the other index-definition commands reach every
  master, and FT.SEARCH, FT.AGGREGATE, FT.INFO and FT.TAGVALS sent to
  any node are answered from the whole cluster. If a master cannot answer,
  the search fails rather than answer from part of the data.

• A restarted master continues its replicas instead of sending them the
  whole dataset again: after a clean SHUTDOWN with the AOF on, and after
  kill -9 or a crash when a replica holds the same data.

Fixed

• REPLICAOF NO ONE during a full sync lost the promoted node's data.
  A replica promoted while a full-sync payload was still arriving read the
  rest of it, dropped its own dataset and loaded the old master's, and only
  then stopped replicating. The sync now stops at once and the node keeps
  its dataset; a promotion that arrives while the dataset is being replaced
  waits for that to finish, as on Redis. Found in a failover test of
  1.1.0-rc1.
• A transaction or a script could wait for ever. A thread that ran its
  first command while a transaction or script was starting did not queue
  behind it. A few such threads running command after command could keep it
  waiting indefinitely, and every transaction and script after it queued
  behind it. It now makes those threads wait too once it has waited 2 ms.
• Lua scripts could leave the sandbox, load native code and run
  commands on the host (see Before you upgrade).
• Malformed input could crash or stall the server. Counts that overflow,
  RESTORE payloads that ask for more memory than they hold, BITFIELD
  offsets past 2^32, and deeply nested input to cmsgpack.unpack, search
  queries and JSONPath filters are now refused. A client that has not
  authenticated is held to Redis's request limits.
• TLS client certificates were never verified (see Before you
  upgrade). New tls-auth-clients: yes (the default, as on Redis),
  optional or no.
• Lua: every status reply reaches a script as an {ok = ...} table, as
  in Redis, not only +OK. PING's `+...

v1.1.0-rc2

KiviDB v1.1.0-rc2

No release notes were written for v1.1.0-rc2 (docs/releases/v1.1.0-rc2.md); see the changelog below.

Binary variants

Each OS/architecture ships four binaries — pick the one that matches your needs:

Tarball suffix	Features included	When to use
(none)	—	Minimal / constrained environments
-lua	Lua scripting	EVAL / EVALSHA
-tls	TLS termination	Encrypted client connections
-full	Lua + TLS	Recommended general-purpose build

Full changelog: CHANGELOG.md

License: GNU Affero General Public License v3 (AGPL-3.0-only)

Code of conduct: CODE_OF_CONDUCT.md

---

What's Changed

• Replication: a promotion during a full sync keeps the promoted node's data by @murtazayusuf in #13
• Version 1.1.0-rc2 by @murtazayusuf in #14

Full Changelog: v1.1.0-rc1...v1.1.0-rc2

v1.1.0-rc1

KiviDB v1.1.0-rc1

No release notes were written for v1.1.0-rc1 (docs/releases/v1.1.0-rc1.md); see the changelog below.

Binary variants

Each OS/architecture ships four binaries — pick the one that matches your needs:

Tarball suffix	Features included	When to use
(none)	—	Minimal / constrained environments
-lua	Lua scripting	EVAL / EVALSHA
-tls	TLS termination	Encrypted client connections
-full	Lua + TLS	Recommended general-purpose build

Full changelog: CHANGELOG.md

License: GNU Affero General Public License v3 (AGPL-3.0-only)

Code of conduct: CODE_OF_CONDUCT.md

---

What's Changed

• Benchmarks run on Azure, not AWS by @murtazayusuf in #1
• Benchmark scripts retry an Azure CLI call that crashes by @murtazayusuf in #2
• Release images also go to Docker Hub as kividb/kividb by @murtazayusuf in #3
• CI can be run by hand on any branch by @murtazayusuf in #4
• Command gate: late threads can no longer keep a transaction out for ever by @murtazayusuf in #7
• Linux verification and smoke test say how they are run by hand by @murtazayusuf in #6
• Benchmarks: Dragonfly 2.0.2, one datacenter, threads that fit the machine by @murtazayusuf in #5
• Update check asks the GitHub repository, and shows nothing else by @murtazayusuf in #8
• Benchmark placement group names each machine size once by @murtazayusuf in #9
• Benchmarks build KiviDB the way arm64 releases are built (+lse) by @murtazayusuf in #11
• Version 1.1.0-rc1 by @murtazayusuf in #12

New Contributors

• @murtazayusuf made their first contribution in #1

Full Changelog: https://github.com/kividbio/kividb/commits/v1.1.0-rc1