Six new dalli advisories

[petergoldstein]

Adds six dalli advisories, submitted by the dalli maintainer. Five were fixed in one coordinated release (5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12); a follow-up release (5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13) fixed a sixth and completed two of the earlier fixes.

Advisory	GitHub severity	Summary
GHSA-p6pm-ch9v-44vx	high	Pipelined get_multi can return another key's value after an error reply
GHSA-4qp6-2jcr-596v	medium	Routing tokens can inject meta protocol flags, and failed requests can retry forever
GHSA-3553-vcg5-72jw	medium	Unbounded decompression and reply sizes allow memory exhaustion
GHSA-wr87-m4jw-29x5	low	Per-request raw and the JSON serializer don't prevent unsafe deserialization
GHSA-w39f-xq2m-4g8x	medium	Forking can resend buffered memcached requests and desynchronize the parent's connection
GHSA-m252-9cgf-vx2w	high	With a namespace, a retried request reads or writes a different key

Versions

• Each advisory affects every supported release line, from version ranges that differ per advisory (described in each entry), so none has unaffected_versions.
• Patched: ~> 3.2.12, ~> 4.3.6, ~> 5.0.9, ~> 5.1.3 and >= 5.2.1 for most; GHSA-wr87-m4jw-29x5 is patched in ~> 3.2.13, ~> 4.3.7, ~> 5.0.10, ~> 5.1.4 and >= 5.2.2, GHSA-w39f-xq2m-4g8x in ~> 3.2.13 and ~> 4.3.7 on those lines, and GHSA-m252-9cgf-vx2w (unaffected before 4.1.0) in ~> 4.3.7, ~> 5.0.10, ~> 5.1.4 and >= 5.2.2.

Notes

• CVEs have been requested through GitHub but not yet assigned, so the entries have no cve: field. I'll follow up once they're assigned (along with the CVE for GHSA-6wmv-xq9m-fmp7 from One new dalli advisory (GHSA-6wmv-xq9m-fmp7) #1247).
• The GitHub advisories have a severity but no CVSS score, so the entries have no cvss_v3.
• bundle exec rspec spec/advisories_spec.rb spec/schema_validation_spec.rb passes locally.

🤖 Generated with Claude Code

[jasnow]

• Copied the PR locally/compare 1 advisory vs my template/done/LGTM
• Scan all 5 release URLs for reference to GHSA/done.

[jasnow]

Copied the PR locally/compare 1 advisory vs my template/done/LGTM
Review new (6th) advisory/LGTM plus changes/GLTM.