webgrip/homelab-cluster

Fork 0

valkey ( 8.1.7 ➔ 9.0.4 ) #267

New issue

Closed

opened 2026-06-08 08:31:09 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 08:31:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/100
Author: @webgrip-renovate[bot]
Created: 5/22/2026
Status: ❌ Closed

Base: main ← Head: renovate/major-docker.iovalkeyvalkey

📝 Commits (1)

99ed6d0 feat(container)!: Update image docker.io/valkey/valkey ( 8.1.7 ➔ 9.0.4 )

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 kubernetes/apps/searxng/searxng/app/valkey.yaml (+1 -1)

📄 Description

This PR contains the following updates:

Package	Update	Change	Pending
docker.io/valkey/valkey	major	`8.1.7` → `9.0.4`	`9.1.0`

⚠️ Major update: review upstream migration notes, chart values, and rollout impact before merging.

Release Notes

valkey-io/valkey (docker.io/valkey/valkey)

`v9.0.4`

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2026-23479) Use-After-Free in unblock client flow
(CVE-2026-25243) Invalid Memory Access in RESTORE command
(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

Valkey 9.0.3

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
(CVE-2026-27623) Reset request type after handling empty requests

Bug fixes

Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
Fix server assert on ACL LOAD when current user loses permission to channels (#3182)
Fix bug causing no response flush sometimes when IO threads are busy (#3205)

`v9.0.2`

Compare Source

Upgrade urgency HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)
Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)
Avoid empty hash object when HSETEX added no fields (#2998)
Fix case-sensitive check for the FNX and FXX arguments in HSETEX (#3000)
Prevent assertion in active expiration job after a hash with volatile fields is overwritten (#3003, #3007)
Fix HRANDFIELD to return null response when no field could be found (#3022)
Fix HEXPIRE to not delete items when validation rules fail and expiration is in the past (#3023, #3048)
Fix how hash is handling overriding of expired fields overwrite (#3060)
HSETEX - Always issue keyspace notifications after validation (#3001)
Make zero a valid TTL for hash fields during import mode and data loading (#3006)
Trigger prepareCommand on argc change in module command filters (#2945)
Restrict TTL from being negative and avoid crash in import-mode (#2944)
Fix chained replica crash when doing dual channel replication (#2983)
Skip slot cache optimization for AOF client to prevent key duplication and data corruption (#3004)
Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
Avoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance (#3046)
Fix XREAD returning error on empty stream with + ID (#2742)

Performance/Efficiency Improvements

Track reply bytes in I/O threads if commandlog-reply-larger-than is -1 (#3086, #3126).
This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix #2652.

Full Changelog: https://github.com/valkey-io/valkey/compare/9.0.1...9.0.2

`v9.0.1`

Compare Source

Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.

Bug fixes

Authenticate slot migration client on source node to internal user (#2785)
Bug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)
Sentinel: fix regression requiring "+failover" ACL in failover path (#2780)
Cluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
Send duplicate multi meet packet only for node which supports it in mixed clusters (#2840)
Fix: LTRIM should not call signalModifiedKey when no elements are removed (#2787)
Fix build on some 32-bit ARM by only using NEON on AArch64 (#2873)
Fix deadlock in IO-thread shutdown during panic (#2898)
Fix COMMANDLOG large-reply when using reply copy avoidance (#2652)
Fix CLUSTER SLOTS crash when called from module timer callback (#2915)

Full Changelog: https://github.com/valkey-io/valkey/compare/9.0.0...9.0.1

Valkey 9.0.0 GA - October 21, 2025

Upgrade urgency LOW: This is the first release of Valkey 9.0 which
includes stability, bug fixes, and incremental improvements over the third release candidate.

Bug fixes

HSETEX with FXX should not create an object if it does not exist (#2716)
Fix crash when aborting a slot migration while child snapshot is active (#2721)
Fix double MOVED reply on unblock at failover (#2734)
Fix memory leak with CLIENT LIST/KILL duplicate filters (#2362)
Fix incorrect accounting after completed atomic slot migration (#2749)
Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826, #2750)
Fix invalid memory address caused by hashtable shrinking during safe iteration (#2753)

For a high level overview of the release, you can checkout release blog
For the full set of changes for the releases, please review the previous release candidates rc1, rc2 and rc3.

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/100 **Author:** [@webgrip-renovate[bot]](https://github.com/apps/webgrip-renovate) **Created:** 5/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `renovate/major-docker.iovalkeyvalkey` --- ### 📝 Commits (1) - [`99ed6d0`](https://github.com/webgrip/homelab-cluster/commit/99ed6d0022cb37220926f8fd13bea6eac9f6a370) feat(container)!: Update image docker.io/valkey/valkey ( 8.1.7 ➔ 9.0.4 ) ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `kubernetes/apps/searxng/searxng/app/valkey.yaml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Update | Change | Pending | |---|---|---|---| | [docker.io/valkey/valkey](https://redirect.github.com/valkey-io/valkey) | major | `8.1.7` → `9.0.4` | `9.1.0` | ⚠️ Major update: review upstream migration notes, chart values, and rollout impact before merging. --- ### Release Notes <details> <summary>valkey-io/valkey (docker.io/valkey/valkey)</summary> ### [`v9.0.4`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.4) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.3...9.0.4) Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. ##### Security fixes - (CVE-2026-23479) Use-After-Free in unblock client flow - (CVE-2026-25243) Invalid Memory Access in RESTORE command - (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution ### [`v9.0.3`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.3) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.2...9.0.3) ### Valkey 9.0.3 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. ##### Security fixes - (CVE-2025-67733) RESP Protocol Injection via Lua error\_reply - (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message - (CVE-2026-27623) Reset request type after handling empty requests ##### Bug fixes - Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand ([#3160](https://redirect.github.com/valkey-io/valkey/issues/3160)) - Fix server assert on ACL LOAD when current user loses permission to channels ([#3182](https://redirect.github.com/valkey-io/valkey/issues/3182)) - Fix bug causing no response flush sometimes when IO threads are busy ([#3205](https://redirect.github.com/valkey-io/valkey/issues/3205)) ### [`v9.0.2`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.2) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.1...9.0.2) Upgrade urgency HIGH: There are critical bugs that may affect a subset of users. ## Bug fixes - Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields ([#2973](https://redirect.github.com/valkey-io/valkey/issues/2973)) - Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking ([#2974](https://redirect.github.com/valkey-io/valkey/issues/2974)) - Avoid empty hash object when HSETEX added no fields ([#2998](https://redirect.github.com/valkey-io/valkey/issues/2998)) - Fix case-sensitive check for the FNX and FXX arguments in HSETEX ([#3000](https://redirect.github.com/valkey-io/valkey/issues/3000)) - Prevent assertion in active expiration job after a hash with volatile fields is overwritten ([#3003](https://redirect.github.com/valkey-io/valkey/issues/3003), [#3007](https://redirect.github.com/valkey-io/valkey/issues/3007)) - Fix HRANDFIELD to return null response when no field could be found ([#3022](https://redirect.github.com/valkey-io/valkey/issues/3022)) - Fix HEXPIRE to not delete items when validation rules fail and expiration is in the past ([#3023](https://redirect.github.com/valkey-io/valkey/issues/3023), [#3048](https://redirect.github.com/valkey-io/valkey/issues/3048)) - Fix how hash is handling overriding of expired fields overwrite ([#3060](https://redirect.github.com/valkey-io/valkey/issues/3060)) - HSETEX - Always issue keyspace notifications after validation ([#3001](https://redirect.github.com/valkey-io/valkey/issues/3001)) - Make zero a valid TTL for hash fields during import mode and data loading ([#3006](https://redirect.github.com/valkey-io/valkey/issues/3006)) - Trigger prepareCommand on argc change in module command filters ([#2945](https://redirect.github.com/valkey-io/valkey/issues/2945)) - Restrict TTL from being negative and avoid crash in import-mode ([#2944](https://redirect.github.com/valkey-io/valkey/issues/2944)) - Fix chained replica crash when doing dual channel replication ([#2983](https://redirect.github.com/valkey-io/valkey/issues/2983)) - Skip slot cache optimization for AOF client to prevent key duplication and data corruption ([#3004](https://redirect.github.com/valkey-io/valkey/issues/3004)) - Fix used\_memory\_dataset underflow due to miscalculated used\_memory\_overhead ([#3005](https://redirect.github.com/valkey-io/valkey/issues/3005)) - Avoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance ([#3046](https://redirect.github.com/valkey-io/valkey/issues/3046)) - Fix XREAD returning error on empty stream with + ID ([#2742](https://redirect.github.com/valkey-io/valkey/issues/2742)) ## Performance/Efficiency Improvements - Track reply bytes in I/O threads if commandlog-reply-larger-than is -1 ([#3086](https://redirect.github.com/valkey-io/valkey/issues/3086), [#3126](https://redirect.github.com/valkey-io/valkey/issues/3126)). This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix [#2652](https://redirect.github.com/valkey-io/valkey/issues/2652). **Full Changelog**: <https://github.com/valkey-io/valkey/compare/9.0.1...9.0.2> ### [`v9.0.1`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.1) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.0...9.0.1) Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent. ## Bug fixes - Authenticate slot migration client on source node to internal user ([#2785](https://redirect.github.com/valkey-io/valkey/issues/2785)) - Bug fix: reset io\_last\_written on c->buf resize to prevent stale pointers ([#2786](https://redirect.github.com/valkey-io/valkey/issues/2786)) - Sentinel: fix regression requiring "+failover" ACL in failover path ([#2780](https://redirect.github.com/valkey-io/valkey/issues/2780)) - Cluster: Avoid usage of light weight messages to nodes with not ready bidirectional links ([#2817](https://redirect.github.com/valkey-io/valkey/issues/2817)) - Send duplicate multi meet packet only for node which supports it in mixed clusters ([#2840](https://redirect.github.com/valkey-io/valkey/issues/2840)) - Fix: LTRIM should not call signalModifiedKey when no elements are removed ([#2787](https://redirect.github.com/valkey-io/valkey/issues/2787)) - Fix build on some 32-bit ARM by only using NEON on AArch64 ([#2873](https://redirect.github.com/valkey-io/valkey/issues/2873)) - Fix deadlock in IO-thread shutdown during panic ([#2898](https://redirect.github.com/valkey-io/valkey/issues/2898)) - Fix COMMANDLOG large-reply when using reply copy avoidance ([#2652](https://redirect.github.com/valkey-io/valkey/issues/2652)) - Fix CLUSTER SLOTS crash when called from module timer callback ([#2915](https://redirect.github.com/valkey-io/valkey/issues/2915)) **Full Changelog**: <https://github.com/valkey-io/valkey/compare/9.0.0...9.0.1> ### [`v9.0.0`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.0) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/8.1.7...9.0.0) ## Valkey 9.0.0 GA - October 21, 2025 Upgrade urgency LOW: This is the first release of Valkey 9.0 which includes stability, bug fixes, and incremental improvements over the third release candidate. ##### Bug fixes - HSETEX with FXX should not create an object if it does not exist ([#2716](https://redirect.github.com/valkey-io/valkey/issues/2716)) - Fix crash when aborting a slot migration while child snapshot is active ([#2721](https://redirect.github.com/valkey-io/valkey/issues/2721)) - Fix double MOVED reply on unblock at failover ([#2734](https://redirect.github.com/valkey-io/valkey/issues/2734)) - Fix memory leak with CLIENT LIST/KILL duplicate filters ([#2362](https://redirect.github.com/valkey-io/valkey/issues/2362)) - Fix incorrect accounting after completed atomic slot migration ([#2749](https://redirect.github.com/valkey-io/valkey/issues/2749)) - Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD ([#1826](https://redirect.github.com/valkey-io/valkey/issues/1826), [#2750](https://redirect.github.com/valkey-io/valkey/issues/2750)) - Fix invalid memory address caused by hashtable shrinking during safe iteration ([#2753](https://redirect.github.com/valkey-io/valkey/issues/2753)) For a high level overview of the release, you can checkout [release blog](https://valkey.io/blog/introducing-valkey-9/) For the full set of changes for the releases, please review the previous release candidates [rc1](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.0-rc1), [rc2](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.0-rc2) and [rc3](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.0-rc3). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Amsterdam) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 08:31:09 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/homelab-cluster#267

No description provided.

Rows
Columns