Depends on the regulatory environment you work in. If you are in anything related to the financial industry, when CVEs are filed, you absolutely do have to upgrade to the version that doesn’t have them. The company I was working for at the time of the license change did three things. One, they initially forbid the new version to be used. Two, they recommended no new projects use redis. And then they negotiated a license with them, but still kept the recommendation to not use them. So they got some short term revenue, and long term they will be replaced.

sounds like a problem for the financial industry, thank God they have money to pay for it! they certainly don't use any of it to actually support anything of course.

An ever-increasing list of CVEs represents erosion of value over time.

Software is a shark - if it stops moving, it dies.

(I heard that saying somewhere, and I think it is untrue of actual sharks but it is definitely true of software)