Depends on the regulatory environment you work in. If you are in anything related to the financial industry, when CVEs are filed, you absolutely do have to upgrade to the version that doesn’t have them. The company I was working for at the time of the license change did three things. One, they initially forbid the new version to be used. Two, they recommended no new projects use redis. And then they negotiated a license with them, but still kept the recommendation to not use them. So they got some short term revenue, and long term they will be replaced.