fix(container): update image docker.io/valkey/valkey ( 7.2.5 → 7.2.14 )

[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/valkey/valkey	patch	7.2.5 → 7.2.14

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

valkey-io/valkey (docker.io/valkey/valkey)

v7.2.14

Compare Source

Valkey 7.2.14 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#​4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @​z0v3r1n and @​lifip. (#​4073)

Bug Fixes

• Strictly check CRLF when parsing requests and reject malformed input as a protocol error instead of misparsing it by @​enjoy-binbin (#​2872)
• Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty during computation by @​sarthakaggarwal97 (#​3342)
• Fix a double free when loading a stream consumer group from a corrupted RDB or RESTORE payload by @​enjoy-binbin (#​3498)
• Fix a potential crash from a NULL pointer dereference when updating the TLS pending-data flag by @​zuiderkwast (#​3641)
• Fix a Lua VM crash when loading functions after FUNCTION FLUSH ASYNC and ensure flushed scripts' memory is released by @​enjoy-binbin (#​1826)
• Fix a use-after-free when a module unregisters and re-registers a cluster message receiver by @​eifrah-aws (#​3846)
• Fix a file descriptor leak when a blocking connection attempt times out, e.g. during MIGRATE to an unreachable host by @​madolson (#​3541)
• Fix a crash in the module API when VM_GetLRU, VM_SetLRU, VM_GetLFU, or VM_SetLFU is called with a NULL key by @​yaronsananes (#​3610)
• Fix invalid memory access when loading a malformed zipmap payload via RESTORE (CVE-2026-25243) by @​ranshid (#​3619)
• Reject zipmap payloads whose length fields overflow, which could cause out-of-bounds access on 32-bit platforms via RESTORE by @​madolson (#​3920)
• Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a later server crash by @​madolson (#​3921)
• Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit, such as Alpine 3.23 by @​chenshi5012 (#​3787)
• Fix use of uninitialized memory when registering Lua functions with FUNCTION LOAD by @​enjoy-binbin (#​2750)
• Fix listpack corruption and server crash when XTRIM marks the last entry in a stream listpack node as deleted by @​smkher (#​3591)
• Fix COMMAND INFO returning the subcommands field as a RESP3 Set instead of an Array for commands without subcommands by @​rickrams (#​3939)
• Reject control characters in SENTINEL SET values and escape them on config rewrite to prevent config-file injection by @​eifrah-aws (#​3847)
• Reject control characters and unsafe delimiters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf injection by @​eifrah-aws (#​3848)
• Fix lua-enable-insecure-api having no effect when enabled at startup via the config file or command line by @​enjoy-binbin (#​3548)
• Log the real error (e.g. Connection reset by peer) instead of the misleading Success on replication sync I/O errors by @​abmathur-ie (#​3580)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @​pkhartsk (#​3843)
• Fix valkey-cli --cluster del-node failing with No such node ID when removing unreachable or failed nodes by @​yang-z-o (#​3209)
• Fix valkey-cli --cluster fix assigning all uncovered slots to the same primary instead of spreading them randomly by @​abmathur-ie (#​3586)

Full Changelog: valkey-io/valkey@7.2.13...7.2.14

v7.2.13

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

• (CVE-2026-23479) Use-After-Free in unblock client flow
• (CVE-2026-25243) Invalid Memory Access in RESTORE command
• (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

v7.2.12

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

• (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message (#​3249)
• (CVE-2025-67733) RESP Protocol Injection via Lua error_reply (#​3249)

Bug fixes

• Fix ltrim should not call signalModifiedKey when no elements are removed (#​2787)
• Fix potential infinite loop in clusterNodeGetMaster (#​2830)
• Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#​3160)

Full changelog: valkey-io/valkey@7.2.11...7.2.12

v7.2.11

Compare Source

Valkey 7.2.11

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

• (CVE-2025-49844) A Lua script may lead to remote code execution
• (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
• (CVE-2025-46818) A Lua script can be executed in the context of another user
• (CVE-2025-46819) LUA out-of-bound read

Bug fixes

• Ensure empty error tables in Lua scripts don't crash Valkey (#​2229)
• Fix client tracking memory overhead calculation (#​2360)

Full Changelog: valkey-io/valkey@7.2.10...7.2.11

v7.2.10: Valkey patch release 7.2.10

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Bug fixes

• Fix a bug that allowed clients to process commands when the server has paused command processing (#​2231)
• Fix a crash when a module attempts to write auxiliary data with AOF enabled (#​2132)
• Fix a bug where the engine may crash when establishing new outbound TLS connections (#​2140)
• Fix a bug where a cluster bus packet may be incorrectly marked as invalid (#​2144)
• Fix a bug where CLUSTER SLOTS/NODES information can be stale after updating node port/tls-port (#​2186)
• Fix a bug where replica in cluster mode can't finish failover when config epoch is outdated (#​2232)
• Fix a bug to avoid CLIENT UNBLOCK command to unblock paused clients (#​2117)

Security fixes

• CVE-2025-27151 Check length of AOF file name in valkey-check-aof (#​2146)
• CVE-2025-32023 prevent out-of-bounds write during hyperloglog operations (#​2314)
• CVE-2025-48367 retry accept on transient errors (#​2315)

v7.2.9

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security fixes

• (CVE-2025-21605) Limit output buffer for unauthenticated clients (#​1992)

Bug fixes

• Fix defrag crash when using FLUSHDB ASYNC in cluster mode (#​1873)
• Fix memory leak in forgotten node ping ext code path (#​1576)
• Fix module LatencyAddSample still work when latency-monitor-threshold is 0 (#​1541)
• Fix potential crash in radix tree recompression of huge keys (#​1722)
• Fix error "SSL routines::bad length" when connTLSWrite is called second time with smaller buffer (#​1737)
• Fix RANDOMKEY infinite loop during CLIENT PAUSE (#​1850)
• fix: add samples to stream object consumer trees (#​1825)
• Fix panic in primary when blocking shutdown after previous block with timeout (#​1948)
• Fix incorrect lag reported in XINFO GROUPS (#​1952)

Full Changelog: valkey-io/valkey@7.2.8...7.2.9

v7.2.8

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

• (CVE-2024-46981) Lua script commands may lead to remote code execution. (#​1513)
• (CVE-2024-51741) Denial-of-service due to malformed ACL selectors. (#​1514)

Bug fixes

• Fix a bug where extra memory would be used when storing strings in the
  inline protocol. (#​1213)
• Send the correct error message when FUNCTION KILL is used to kill an
  ongoing script. (#​1171)
• Make sure the last accessed time is correctly updated when using the TOUCH
  command with the CLIENT NO-TOUCH option. (#​1499)

v7.2.7

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Bug fixes

• Prevented AOF from being incorrectly disabled after loading RDB data, ensuring
  proper re-enabling of AOF. (#​1001)
• Resolved issues in replicationSetPrimary where the primary node's IP/port
  updates were not correctly handled in the cluster gossip section. (#​965)

Packaging Improvements

• Build binary releases with systemd support. (#​1107)
• Avoid .c, .d and .o files from being copied to the binary tar.gz releases. (#​1106)

Security fixes

• (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
• (CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors.
• (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.

v7.2.6

Compare Source

Upgrade urgency MODERATE: This release fixes an incompatibility issue with modules
compiled for Redis. For other users, it primarily fixes uncommon bugs.

Bug Fixes - Core

• Fix typo in REGISTER_API macro to prevent segfaults when loading Redis
  modules (#​608)
• Fix the command duration reset issue when clients are blocked and commands
  are reprocessed (#​526)
• Fix the data type conversion error in zrangeResultBeginStore (Redis#13148)
• Fix a crash caused by quicklist node merges (Redis#13040)
• Fix crashes in module blocking client timeout cases (Redis#13011)
• Fix conversion of numbers in Lua args to Redis args
  (Redis#13115, Fixes Redis#13113)
• Fix crash in LSET command when replacing small list items with larger ones,
  creating listpacks larger than 4GB (Redis#12955, Fixes Redis#12864)
• Fix blocking command timeout reset issue during reprocessing (Redis#13004)

Bug Fixes - Cluster

• Fix the CLUSTER SHARDS command to display accurate slot information even
  if a primary node fails (#​790, Fixes #​784)
• Fix an issue where module authentication failed when the cluster was down
  (#​693, Fixes #​619)
• Ensure only primary nodes with slots can mark another node as failed (#​634)
• Improve MEET command reliability under link failures to maintain cluster
  membership symmetry (#​461)
• Allow single primary node to mark potentially failed replica as FAIL in
  single-shard cluster (Redis#12824)

Bug Fixes - Sentinel

• Accept redis-sentinel to start Valkey in sentinel mode (#​731, Fixes #​719)

Bug Fixes - CLI

• Ensure the --count option in redis-cli works correctly even without
  --pattern (Redis#13092)
• Fix redis-check-aof misidentifying data in manifest format as MP-AOF
  (Redis#12951)
• Update redis-check-rdb types to replace stream-v2 with stream-v3
  (Redis#12969)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[carpenike-bot]

--- kubernetes/cluster-0/apps/selfhosted/paperless/app Kustomization: flux-system/paperless HelmRelease: selfhosted/paperless

+++ kubernetes/cluster-0/apps/selfhosted/paperless/app Kustomization: flux-system/paperless HelmRelease: selfhosted/paperless

@@ -84,13 +84,13 @@

             - 65542
       redis:
         containers:
           redis:
             image:
               repository: docker.io/valkey/valkey
-              tag: 7.2.5
+              tag: 7.2.8
             resources:
               limits:
                 memory: 128Mi
               requests:
                 cpu: 5m
                 memory: 32Mi

[carpenike-bot]

--- HelmRelease: selfhosted/paperless Deployment: selfhosted/paperless-redis

+++ HelmRelease: selfhosted/paperless Deployment: selfhosted/paperless-redis

@@ -30,13 +30,13 @@

       automountServiceAccountToken: true
       hostIPC: false
       hostNetwork: false
       hostPID: false
       dnsPolicy: ClusterFirst
       containers:
-      - image: docker.io/valkey/valkey:7.2.5
+      - image: docker.io/valkey/valkey:7.2.8
         name: redis
         resources:
           limits:
             memory: 128Mi
           requests:
             cpu: 5m

[carpenike-bot]

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
❌ COPYPASTE	jscpd	yes		2	no	1.52s
✅ REPOSITORY	git_diff	yes		no	no	0.05s
✅ REPOSITORY	secretlint	yes		no	no	3.92s
✅ YAML	prettier	1		0	0	0.58s
✅ YAML	yamllint	1		0	0	0.68s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff