feat(container)!: Update image docker.io/valkey/valkey to v9.1.1 by renovate[bot] · Pull Request #5575 · carpenike/k8s-gitops

renovate · 2025-10-22T02:04:48Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
docker.io/valkey/valkey	major	`8.0.1` → `9.1.1`
docker.io/valkey/valkey	major	`7.2.5` → `9.1.1`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

valkey-io/valkey (docker.io/valkey/valkey)

`v9.1.1`

Compare Source

Valkey 9.1.1 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

Omit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output by @dvkashapov (#3964)
Improve throughput when IO threads are enabled by offloading object deallocation from the main thread by @roshkhatri (#3938)
Fix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred by @ranshid (#3800)
Enforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens by @enjoy-binbin (#3801)
Enforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases by @enjoy-binbin (#3806)
Fix use-after-free in the module API when unregistering the first registered cluster message receiver by @eifrah-aws (#3846)
Fix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count by @cjx-zar (#4047)
Fix clients left on the wrong database after module keyspace notifications for MOVE and COPY by @enjoy-binbin (#4024)
Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @lukepalmer (#4068)
Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @ranshid (#3950)
Fix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback by @enjoy-binbin (#3743)
Fix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds by @enjoy-binbin (#3941)
Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @madolson (#3921)
Fix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @nanyan0312 (#4060)
Fix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating INFO output by @chenshi5012 (#3787)
HGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced by @lcxn123 (#4049)
COMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @rickrams (#3939)
Send the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @hpatro (#4105)
Fix duplicate failure handling and an invalid reply sequence in cluster slot migration by @chx9 (#3723)
Reject control characters in SENTINEL SET values to prevent config-file injection via Sentinel config rewrite by @eifrah-aws (#3847)
Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)
Redact key names and user data from more server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
ACL LOG now reports the denied database ID for COPY instead of the command name when db= access is denied by @enjoy-binbin (#3888)
Fix garbled shard IDs in the cluster UPDATE message log line by @enjoy-binbin (#3942)
Fix negative master_sync_total_bytes in INFO replication during disk-based sync when the RDB exceeds 2GB by @chx9 (#3811)
Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)

Full Changelog: valkey-io/valkey@9.1.0...9.1.1

`v9.1.0`

Compare Source

Upgrade urgency LOW: This is the first stable release of Valkey 9.1.

Security fixes

(CVE-2026-23479) Use-After-Free in unblock client flow
(CVE-2026-25243) Invalid Memory Access in RESTORE command
(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

New Features and enhanced behavior

Add cluster bus network traffic usage metric in bytes by @hpatro (#3396)
Reduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)

Bug Fixes

Fix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)
Fix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)
Handle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)
Fixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)
Fix the memory leak in valkey-benchmark by @nmvk (#3643)

See also the release notes for 9.1.0-rc1 and 9.1.0-rc2.

`v9.0.5`

Compare Source

Valkey 9.0.5 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @enjoy-binbin (#2872)
Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster (#3283)
Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @sarthakaggarwal97 (#3342)
Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @madolson (#3516)
Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-binbin (#3498)
Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @smkher (#3591)
Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @eifrah-aws (#3578)
Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid (#3800)
Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @eifrah-aws (#3846)
Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @cjx-zar (#4047)
Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @enjoy-binbin (#4024)
Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @lukepalmer (#4068)
Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @dvkashapov (#3306)
Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte (#3878)
Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @ranshid (#3950)
Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @madolson (#3541)
Fix a potential crash from a dangling slot migration job reference when the migration client is reset by @murphyjacob4 (#3554)
Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @eifrah-aws (#3503)
Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @bandalgomsu (#3568)
Fix a crash when a slot migration target node is removed from the cluster before the migration connects by @chenshi5012 (#3596)
Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes (#3610)
Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @enjoy-binbin (#3743)
Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin (#3942)
Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 milliseconds by @enjoy-binbin (#3941)
Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
Reject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later crash on skiplist conversion by @madolson (#3921)
Fix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value formatting mismatches by @chenshi5012 (#3787)
Fix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and reply buffer reuse by @nanyan0312 (#4060)
COMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands without subcommands by @rickrams (#3939)
The dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding stale replica entries behind NAT by @jdheyburn (#2846)
Prevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty primary within a shard by @zhijun42 (#2811)
Send the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs no longer fail by @hpatro (#4105)
Fix slot migration failure handling running twice on ownership changes and an out-of-order error reply in the internal SYNCSLOTS FINISH command by @chx9 (#3723)
Allow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by @enjoy-binbin (#3443)
Fix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large values by @enjoy-binbin (#3440)
Reject SENTINEL SET values containing control characters and safely quote Sentinel config values to prevent config file injection by @eifrah-aws (#3847)
Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf corruption or injection by @eifrah-aws (#3848)
Fix changes to lua-enable-insecure-api via CONFIG SET not taking effect when the option was set at startup by @enjoy-binbin (#4182)
Fix incorrect memory overhead reported for watched keys in client memory usage tracking by @enjoy-binbin (#3359)
Replica logs now report 'Connection reset by peer' instead of the misleading 'Success' when the primary closes the connection by @abmathur-ie (#3580)
Redact key names and user data from more log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
Fix INFO replication reporting negative sync transfer sizes when the RDB exceeds 2GB during disk-based sync by @chx9 (#3811)
Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)
valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
Fix valkey-cli crashing after --eval script execution on jemalloc/tcmalloc builds by @bandalgomsu (#3281)
valkey-cli --cluster fix now spreads uncovered slots randomly across primaries instead of assigning them all to one node by @abmathur-ie (#3586)

Full Changelog: valkey-io/valkey@9.0.4...9.0.5

`v9.0.4`

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2026-23479) Use-After-Free in unblock client flow
(CVE-2026-25243) Invalid Memory Access in RESTORE command
(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

`v9.0.3`

Compare Source

Valkey 9.0.3

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
(CVE-2026-27623) Reset request type after handling empty requests

Bug fixes

Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
Fix server assert on ACL LOAD when current user loses permission to channels (#3182)
Fix bug causing no response flush sometimes when IO threads are busy (#3205)

`v9.0.2`

Compare Source

Upgrade urgency HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)
Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)
Avoid empty hash object when HSETEX added no fields (#2998)
Fix case-sensitive check for the FNX and FXX arguments in HSETEX (#3000)
Prevent assertion in active expiration job after a hash with volatile fields is overwritten (#3003, #3007)
Fix HRANDFIELD to return null response when no field could be found (#3022)
Fix HEXPIRE to not delete items when validation rules fail and expiration is in the past (#3023, #3048)
Fix how hash is handling overriding of expired fields overwrite (#3060)
HSETEX - Always issue keyspace notifications after validation (#3001)
Make zero a valid TTL for hash fields during import mode and data loading (#3006)
Trigger prepareCommand on argc change in module command filters (#2945)
Restrict TTL from being negative and avoid crash in import-mode (#2944)
Fix chained replica crash when doing dual channel replication (#2983)
Skip slot cache optimization for AOF client to prevent key duplication and data corruption (#3004)
Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
Avoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance (#3046)
Fix XREAD returning error on empty stream with + ID (#2742)

Performance/Efficiency Improvements

Track reply bytes in I/O threads if commandlog-reply-larger-than is -1 (#3086, #3126).
This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix #2652.

Full Changelog: valkey-io/valkey@9.0.1...9.0.2

`v9.0.1`

Compare Source

Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.

Bug fixes

Authenticate slot migration client on source node to internal user (#2785)
Bug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)
Sentinel: fix regression requiring "+failover" ACL in failover path (#2780)
Cluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
Send duplicate multi meet packet only for node which supports it in mixed clusters (#2840)
Fix: LTRIM should not call signalModifiedKey when no elements are removed (#2787)
Fix build on some 32-bit ARM by only using NEON on AArch64 (#2873)
Fix deadlock in IO-thread shutdown during panic (#2898)
Fix COMMANDLOG large-reply when using reply copy avoidance (#2652)
Fix CLUSTER SLOTS crash when called from module timer callback (#2915)

Full Changelog: valkey-io/valkey@9.0.0...9.0.1

`v9.0.0`

Compare Source

Valkey 9.0.0 GA - October 21, 2025

Upgrade urgency LOW: This is the first release of Valkey 9.0 which
includes stability, bug fixes, and incremental improvements over the third release candidate.

Bug fixes

HSETEX with FXX should not create an object if it does not exist (#2716)
Fix crash when aborting a slot migration while child snapshot is active (#2721)
Fix double MOVED reply on unblock at failover (#2734)
Fix memory leak with CLIENT LIST/KILL duplicate filters (#2362)
Fix incorrect accounting after completed atomic slot migration (#2749)
Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826, #2750)
Fix invalid memory address caused by hashtable shrinking during safe iteration (#2753)

For a high level overview of the release, you can checkout release blog
For the full set of changes for the releases, please review the previous release candidates rc1, rc2 and rc3.

`v8.1.9`

Compare Source

Valkey 8.1.9 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

Fix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)
Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)
Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
Fix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
Reject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)
Fix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)

Full Changelog: valkey-io/valkey@8.1.8...8.1.9

`v8.1.8`

Compare Source

Upgrade urgency HIGH: There is a critical bug that may affect a subset of users.

Bug fixes

Fix ZDIFF algorithm 2 memory leak on early exit (#3342)
Strictly check CRLF when parsing querybuf (#2872)
Fix incorrect memory overhead calculation for watched keys (#3359)
Fix valkey-cli --cluster del-node for unreachable nodes (#3209)
Fix race condition during async client freeing with IO threading enabled (#3458)
Fix double free in stream consumer PEL loading with corrupt RDB data (#3498)
Fixes server crash when RDMA benchmark clients disconnect (#3448)
Fix misleading log "I/O error reading bulk count from PRIMARY: Success" (#3580)
Handle NULL pointer in streamTrim listpack delta calculation (#3591)
Fix Deferred Reply Placeholders in Active Deferred Buffers (#3578)
Add NULL check in updateSSLPendingFlag (#3641)
Fix heap-use-after-free in ACL LOAD when client free is deferred (#3800)
Redacting customer information when hide_user_data_from_log is true in rdb.c, networking.c, debug.c and t_hash (#3872)
Fix use-after-free in VM_RegisterClusterMessageReceiver (#3846)
Harden SENTINEL commands and config rewrite against control-character injection (#3847)
Fix CLUSTER SLOTS crash when called from module timer callback (#2915)

Full Changelog: valkey-io/valkey@8.1.7...8.1.8

`v8.1.7`

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2026-23479) Use-After-Free in unblock client flow
(CVE-2026-25243) Invalid Memory Access in RESTORE command
(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

`v8.1.6`

Compare Source

Valkey 8.1.6

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
(CVE-2025-67733) RESP Protocol Injection via Lua error_reply

Bug fixes

Restrict ttl from being negative and avoid crash in import-mode (#2944)
Fix chained replica crash when doing dual channel replication (#2983)
Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
Fix crashing while MODULE UNLOAD when ACL rules reference a module command or subcommand (#3160)
Fix server assert on ACL LOAD and resetchannels (#3182)
Fix bug causing no response flush sometimes when IO threads are busy (#3205)

`v8.1.5`

Compare Source

Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.

Bug fixes

Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826)
Fix invalid memory address caused by hashtable shrinking during safe iteration (#2753)
Cluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
Send duplicate multi meet packet only for node which supports it (#2840)
Fix loading AOF files from future Valkey versions (#2899)

Full Changelog: valkey-io/valkey@8.1.4...8.1.5

`v8.1.4`

Compare Source

Valkey 8.1.4

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2025-49844) A Lua script may lead to remote code execution
(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
(CVE-2025-46818) A Lua script can be executed in the context of another user
(CVE-2025-46819) LUA out-of-bound read

Bug fixes

Fix accounting for dual channel RDB bytes in replication stats (#2614)
Fix EVAL to report unknown error when empty error table is provided (#2229)
Fix use-after-free when active expiration triggers hashtable to shrink (#2257)
Fix MEMORY USAGE to account for embedded keys (#2290)
Fix memory leak when shrinking a hashtable without entries (#2288)
Prevent potential assertion in active defrag handling large allocations (#2353)
Prevent bad memory access when NOTOUCH client gets unblocked (#2347)
Converge divergent shard-id persisted in nodes.conf to primary's shard id (#2174)
Fix client tracking memory overhead calculation (#2360)
Fix RDB load per slot memory pre-allocation when loading from RDB snapshot (#2466)
Don't use AVX2 instructions if the CPU doesn't support it (#2571)
Fix bug where active defrag may be unable to defrag sparsely filled pages (#2656)

Full Changelog: valkey-io/valkey@8.1.3...8.1.4

`v8.1.3`

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Bug fixes

Fix missing response when AUTH is errored inside a transaction (#2287)

Security fixes

CVE-2025-32023 prevent out-of-bounds write during hyperloglog operations (#2146)
CVE-2025-48367 retry accept on transient errors (#2315)

`v8.1.2`

Compare Source

Upgrade urgency HIGH: This release includes CVE fix for valkey-check-aof tool, we recommend you
apply as soon as possible if you use the tool.

Security fixes

CVE-2025-27151 Check length of AOF file name in valkey-check-aof (#2146)

Bug fixes

Properly escape double quotes and backslash in MONITOR command (#2036)
Fix high CPU usage when fetching a random element in skewed sparse hash table (#2085)
Fix a bug that allowed clients to process commands when the server has paused command processing (#2109)
Fix a crash where the wrong slot is used when processing sharded pubsub unsubscribe events (#2137)
Fix a crash when a module attempts to write auxiliary data with AOF enabled (#2132)
Fix a bug where the engine may crash when establishing new outbound TLS connections (#2140)
Fix a bug where a cluster bus packet may be incorrectly marked as invalid (#2144)
Fix a bug where CLUSTER SLOTS/NODES information can be stale after updating node port/tls-port (#2186)
Fix a bug where replica in cluster mode can't finish failover when config epoch is outdated (#2178)
Fix a bug to avoid CLIENT UNBLOCK command to unblock paused clients (#2117)

Full Changelog: valkey-io/valkey@8.1.1...8.1.2

`v8.1.1`

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security fixes

(CVE-2025-21605) Limit output buffer for unauthenticated clients (#1994)

Bug fixes

Fix the build on less common platforms in zmalloc.c (#1922)
fix: add samples to stream object consumer trees (#1825)
Fix crash during TLS handshake with I/O threads (#1955)
Fix cluster slot stats assertion during promotion of replica (#1950)
Fix panic in primary when blocking shutdown after previous block with timeout (#1948)
Ignore stale gossip packets that arrive out of order (#1777)
Fix incorrect lag reported in XINFO GROUPS (#1952)
Fix engine crash on module client blocking during keyspace events (#1819)
Avoid shard id update of replica if not matching with primary shard id (#573)
Only enable defrag for vendored jemalloc (#1985)
Allow scripts to support null characters again (#1984)

Full Changelog: valkey-io/valkey@8.1.0...8.1.1

`v8.1.0`

Compare Source

Valkey 8.1 release notes

Upgrade urgency levels:
LOW: No need to upgrade unless there are new features you want to use.
MODERATE: Program an upgrade of the server, but it's not urgent.
HIGH: There is a critical bug that may affect a subset of users. Upgrade!
CRITICAL: There is a critical bug affecting MOST USERS. Upgrade ASAP.
SECURITY: There are security fixes in the release.

Valkey 8.1.0 GA - Released Mon 31 March 2025

Upgrade urgency LOW: This is the first release of Valkey 8.1,
a minor version update designed to further enhance performance, reliability, observability and usability
over Valkey 8.0 for all Valkey installations. This release is fully compatible with all previous Valkey releases
as well as Redis OSS 7.2.4.

Behavior Changes

Hide input buffer data from being logged on protocol error when hide-user-data-from-log is enabled (#1889)

Bug fixes

Fix a bug in VM_GetCurrentUserName which leads to engine crash when no valid username provided (#1885)

Valkey 8.1.0 RC2 - Released Thu 20 March 2025

Upgrade urgency LOW: This is the second release candidate of Valkey 8.1, with several bug fixes,
control on manual-failover timeout and expended module API to reduce module executed commands overhead.

Performance/Efficiency Improvements - Core

Optimize bitcount command by using x86 SIMD instructions (#1741)
Embed hash value in hash data type entries to reduce memory footprint (#1579)

Cluster modifications

Add cluster-manual-failover-timeout configuration to control the timeout for manual failover (#1690)
Improve error message reporting when invalid port is provided for cluster meet command. (#1686)
broadcast epoch ASAP when configEpoch changed (#1813)

Module Improvements

Add new module API flag to bypass command validation in order to reduce processing overhead (#1357)

Behavior Changes

Enable TCP_NODELAY for engine initiated cluster and replication connections (#1763)

Bug Fixes

Fix ACL LOAD crash on a connected replica node (#1842)
Fix bug where no tracking-redir-broken is issued when the redirect client is in the process of getting closed. (#1823)
Fix replica sometimes disconnecting when replication is using TLS. (#1737)
Fix file descriptor leak when aborting dual channel replication due to error (#1721)
Fix rax crash when using keys larger than 512MB (#1722)
Fix RANDOMKEY command leading to infinite loop during when all CLIENT are PAUSED and all keys are with expiry (#1850)
Removing unicode optimization in Lua cjson library to avoid OOM when very large strings are used. (#1785)
Fix update large-reply in COMMANDLOG when reply is deferred (#1760)
Avoid setting TCP/TLS specific options for UNIX Domain Socket connections (#1706)
Fix a bug in the valkey-cli which would incorrectly render commands with text output in multi/exec (#1782)

Build and Packaging changes

Check both arm64 and aarch64 for ARM based system architecture during CMake builds (#1829)
Cleanup lua object files on make distclean (#1812)
Fixed build error with CMake when using clang v19 (#1806)

Valkey 8.1.0 RC1 - Released Thu 11 Feb 2025

Upgrade urgency LOW: This is the first release candidate of Valkey 8.1, with
performance improvements, extended observability and cluster improvements and different bug fixes.
It includes a new implementation of the Valkey dictionary which is more memory and cache efficient,
better performance for encryption in transit, reduced replication overhead by offloading work to I/O threads,
faster failover support in cluster mode, major improvements to the active defrag process to reduce the impact on command processing,
different API changes for improved usability and ability to track large requests and replies.
Valkey now supports new new check-and-set feature for native STRINGs.

API and Interface changes

Introduce cancel argument to bgsave command (#757)
Add conditional update support to the SET command using IFEQ argument (#1324)
Add more filters to CLIENT LIST (#1401)
Add availability_zone to the HELLO response (#1487)

Observability and Monitoring changes

Extend LATENCY LATEST to add sum / cnt stats (#1570)
Add paused_actions and paused_timeout_milliseconds for INFO CLIENTS (#1519)
Add paused_reason to INFO CLIENTS (#1564)
Added COMMANDLOG to record slow executions and large requests/replies (#1294)
Fix cluster info sent stats for message with light header (#1563)
Add latency stats around cluster config file operations (#1534)
Add new flag in CLIENT LIST for import-source client (#1398)
Show client capabilities in CLIENT LIST / CLIENT INFO (#1698)

Performance/Efficiency Improvements - Core

Introduce a new memory efficient hash table to store keys (#1186)
Accelerate hash table iterator with prefetching (#1501)
Accelerate hash table iterator with value prefetching (#1568)
Replace dict with new hashtable: hash datatype (#1502)
Replace dict with new hashtable for sets datatype (#1176)
Replace dict with new hashtable: sorted set datatype (#1427)
Free strings during BGSAVE/BGAOFRW to reduce copy-on-write (#905)
Create an empty lua table with specified initial capacity as much as possible (#1092)
Move prepareClientToWrite out of loop for HGETALL command (#1119)
Improved hashing algorithm for Lua tables (#1168)
Replace dict with new hashtable for sets datatype (#1176)
Do security attack check only when command not found to reduce the critical path. (#1212)
Trim free space from inline command argument strings to avoid excess memory usage ([#1213](https://redirect.github.com/val

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

carpenike-bot · 2025-10-22T02:08:02Z

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
❌ COPYPASTE	jscpd	yes	2	no	1.41s
✅ REPOSITORY	git_diff	yes	no	no	0.04s
✅ REPOSITORY	secretlint	yes	no	no	3.76s
✅ YAML	prettier	2	0	0	0.5s
✅ YAML	yamllint	2	0	0	0.71s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

| datasource | package | from | to | | ---------- | ----------------------- | ----- | ----- | | docker | docker.io/valkey/valkey | 8.0.1 | 9.1.1 | | docker | docker.io/valkey/valkey | 7.2.5 | 9.1.1 |

renovate Bot added renovate/container type/major labels Oct 22, 2025

carpenike-bot Bot added area/kubernetes cluster/main labels Oct 22, 2025

renovate Bot changed the title ~~feat(container)!: Update image docker.io/valkey/valkey to v9.0.0~~ feat(container)!: Update image docker.io/valkey/valkey to v9.0.1 Dec 10, 2025

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from eade2d4 to 0b92f78 Compare December 10, 2025 02:51

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from 0b92f78 to c2609db Compare February 3, 2026 17:14

renovate Bot changed the title ~~feat(container)!: Update image docker.io/valkey/valkey to v9.0.1~~ feat(container)!: Update image docker.io/valkey/valkey to v9.0.2 Feb 3, 2026

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from c2609db to 8a27c0d Compare February 24, 2026 20:04

renovate Bot changed the title ~~feat(container)!: Update image docker.io/valkey/valkey to v9.0.2~~ feat(container)!: Update image docker.io/valkey/valkey to v9.0.3 Feb 24, 2026

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from 8a27c0d to 3640df0 Compare May 6, 2026 22:13

renovate Bot changed the title ~~feat(container)!: Update image docker.io/valkey/valkey to v9.0.3~~ feat(container)!: Update image docker.io/valkey/valkey to v9.0.4 May 6, 2026

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from 3640df0 to 373e8de Compare May 19, 2026 21:27

renovate Bot changed the title ~~feat(container)!: Update image docker.io/valkey/valkey to v9.0.4~~ feat(container)!: Update image docker.io/valkey/valkey to v9.1.0 May 19, 2026

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from 373e8de to 6b39d94 Compare June 25, 2026 19:47

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from 6b39d94 to 26876cc Compare July 20, 2026 21:56

feat(container)!: Update image docker.io/valkey/valkey to v9.1.1

8adf5f1

| datasource | package | from | to | | ---------- | ----------------------- | ----- | ----- | | docker | docker.io/valkey/valkey | 8.0.1 | 9.1.1 | | docker | docker.io/valkey/valkey | 7.2.5 | 9.1.1 |

renovate Bot force-pushed the renovate/cluster-0-docker.io-valkey-valkey-9.x branch from 26876cc to 8adf5f1 Compare July 22, 2026 04:38

renovate Bot changed the title ~~feat(container)!: Update image docker.io/valkey/valkey to v9.1.0~~ feat(container)!: Update image docker.io/valkey/valkey to v9.1.1 Jul 22, 2026

Navigation Menu

feat(container)!: Update image docker.io/valkey/valkey to v9.1.1 - #5575

feat(container)!: Update image docker.io/valkey/valkey to v9.1.1#5575
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cluster-0-docker.io-valkey-valkey-9.x

renovate Bot commented Oct 22, 2025 •

edited

Loading

Uh oh!

carpenike-bot Bot commented Oct 22, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Valkey 9.1.1 - Released Tue 21 July 2026

Security Fixes

Bug Fixes

Security fixes

New Features and enhanced behavior

Bug Fixes

Valkey 9.0.5 - Released Tue 21 July 2026

Security Fixes

Bug Fixes

Security fixes

Valkey 9.0.3

Security fixes

Bug fixes

Bug fixes

Performance/Efficiency Improvements

Bug fixes

Valkey 9.0.0 GA - October 21, 2025

Bug fixes

Valkey 8.1.9 - Released Tue 21 July 2026

Security Fixes

Bug Fixes

Bug fixes

Security fixes

Valkey 8.1.6

Security fixes

Bug fixes

Bug fixes

Valkey 8.1.4

Security fixes

Bug fixes

Bug fixes

Security fixes

Security fixes

Bug fixes

Security fixes

Bug fixes

Valkey 8.1 release notes

Valkey 8.1.0 GA - Released Mon 31 March 2025

Behavior Changes

Bug fixes

Valkey 8.1.0 RC2 - Released Thu 20 March 2025

Performance/Efficiency Improvements - Core

Cluster modifications

Module Improvements

Behavior Changes

Bug Fixes

Build and Packaging changes

Valkey 8.1.0 RC1 - Released Thu 11 Feb 2025

API and Interface changes

Observability and Monitoring changes

Performance/Efficiency Improvements - Core

Configuration

Uh oh!

carpenike-bot Bot commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦙 MegaLinter status: ❌ ERROR

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 22, 2025 •

edited

Loading

carpenike-bot Bot commented Oct 22, 2025 •

edited

Loading