[petergoldstein]

Adds a dalli advisory, submitted by the dalli maintainer, fixed in a coordinated release (5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14).

Advisory	GitHub severity	Summary
GHSA-r47x-6p6r-mvcp	high	Keys created by incr or decr can forge get_multi replies

Versions

• Affects the meta protocol only, which was added in 3.2.0, so unaffected_versions is < 3.2.0.
• Patched: ~> 3.2.14, ~> 4.3.8, ~> 5.0.11, ~> 5.1.5 and >= 5.2.3.

Notes

• A CVE has been requested through GitHub but not yet assigned, so the entry has no cve: field. I'll follow up once it's assigned, along with the other dalli entries still waiting on theirs.
• The GitHub advisory has a severity but no CVSS score, so the entry has no cvss_v3.
• bundle exec rspec spec/advisories_spec.rb spec/schema_validation_spec.rb passes locally.

🤖 Generated with Claude Code

[jasnow]

LGTM

[jasnow]

Thanks