Repository navigation
Scripts: run on Lua 5.1 as Redis does (after #747) #756
Description
Follow-up to #747. For 1.3.0, string.format was made to truncate like Lua 5.1 and the Lua 5.4 differences are documented. This issue tracks running scripts on Lua 5.1 as Redis does.
A prototype is on branch exp/lua51-747: mlua lua51 + vendored, Redis's bit and struct libraries in Rust, Redis's sandbox allow list, and number formatting matched to Redis. Measured on a D4s_v5:
- Differential test, 197 scripts vs Redis 8.10.2: master (5.4) 100 identical, Lua 5.1 prototype 183 (13 of the remaining 14 are error-message wording).
- Redis suite
unit/scripting+unit/functions: 311/1 on both (the known GC test fails on both; worse on 5.1, 18.86 MB vs 14.77 MB). - Throughput: pure Lua arithmetic +36%, number/string building -11%, BullMQ -3% to -8% (noisy).
Before it can ship:
- Security. Stock Lua 5.1.5 lacks fixes Redis carries in its
deps/lua: the lexer out-of-bounds read on long-string delimiters (CVE-2025-46819) and the full-length string hash (anti hash-flooding). These are in the C sources, so we would vendor and patch Lua 5.1 in the repo ([patch.crates-io]on lua-src), taking the fixes from upstream Lua's MIT code, and maintain it for good since 5.1 gets no upstream fixes. Theunpackoverflow (as CVE-2025-46817) and the parser chunk-name use-after-free (CVE-2025-49844) are handled in the prototype outside the C sources. - The GC test regression (
used_memory_vm_functions). - Lua 5.1's ~8,000-value C stack limit: a Rust function holding many Lua values panics the VM thread. The prototype fixed
cmsgpack; audit every Rust path that builds large tables. - BullMQ cost.
Activity