[kaitlynmichael]

Note

Low Risk
Documentation-only changes with no runtime or API behavior modifications in this diff.

Overview
Documents that custom user-defined module uploads are disabled by default and must be temporarily enabled via the cluster setting allow_modules_upload (using PUT /v1/cluster) before either upload POST endpoint will succeed.

The user-defined modules REST API page now includes a prominent note with links to the cluster object and update request, states that uploads return 403 with modules_upload_disabled while disabled, and lists 403 Forbidden in the status tables for POST /v2/modules/user-defined and POST /v2/local/modules/user-defined/artifacts. Recommended security practices adds a cluster-security bullet to enable uploads only during maintenance and turn the flag off again afterward, because custom modules run as native code on nodes.

^{Reviewed by Cursor Bugbot for commit 9772ca7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[github-actions]

DOC-7075

[github-actions]

🧠 Redis Memory

Found 10 related items from repository history (5 new this commit):

• PR — RS: Add user-defined modules during bootstrapping
• PR — RS: Clarified that upload custom module artifact REST API requests require the module .zip file
• PR — RS: Module management updates for RS 8
• PR — RS: 7.4.6-293
• PR — RS: Deprecate modules_args & document replacement module fields for REST API
• PR — RS: Added links to module upgrade from RS DB upgrade 🆕

• PR — RS: update-db-config-modules warning 🆕

• PR — RS: Removed search/export logs CM UI limitation from RS 8.0.20 release notes 🆕

• PR — RS: Added module commands limitation during A-A DB upgrades to Redis 8.0 to additional docs 🆕

• PR — RS: Added CM UI instructions to upgrade DB version 🆕

Memory updated at 9772ca7

[github-actions]

Staging links:
https://redis.io/docs/staging/DOC-7075/operate/rs/references/rest-api/requests/modules/user-defined/
https://redis.io/docs/staging/DOC-7075/operate/rs/security/recommended-security-practices/

[dwdougherty]

Just the one comment. LGTM otherwise.