Dragonfly vs Grype

Releases land every few days as incremental i1.39.x tags, and the work splits three ways. First, resyncing forked Redis code with upstream Valkey — the hyperloglog resync pulled in a CVE fix for run-length overflow in sparse opcodes plus AVX2 and ARM NEON merge kernels, and exposed three Dragonfly-local bugs in the process. Second, correctness in the v1 and v2 IO loops: a pub/sub ordering defect where anti-starvation quota logic could run a pipelined UNSUBSCRIBE ahead of queued messages and silently drop them. Third, ongoing internal migration of command handlers to a new argument parser.

The fork-maintenance thread is the structural one — Dragonfly carries Valkey-derived code that drifts, and resyncing is how it inherits both security fixes and SIMD performance work it did not write. Running two IO loop generations at once is the current source of risk, visible in tests that had to be skipped on the v1 leg and in an ordering bug that only appeared after v1.38 changed the dispatch quota. Neither thread is adding user-facing capability; this is a window of consolidation.

Expect the v2 IO loop to move toward default as the ordering and pause-semantics gaps close, and further upstream resyncs of forked Redis files now that the hyperloglog sync established a formatting convention to keep them cheap.