webgrip/homelab-cluster

Fork 0

valkey ( 8.1.7 ➔ 9.0.4 ) #58

New issue

Closed

opened 2026-06-08 08:29:40 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 08:29:40 +00:00

Owner

Originally created by @Ryangr0 on GitHub.

Originally assigned to: @Ryangr0, @Copilot on GitHub.

Renovate dependency review task

Marker: renovate-agent-review:webgrip/homelab-cluster#165

Review pull request: https://github.com/webgrip/homelab-cluster/pull/165
Repository: webgrip/homelab-cluster
Pull request number: 165
Title: feat(container)!: Update image docker.io/valkey/valkey ( 8.1.7 ➔ 9.0.4 )
Author: @webgrip-renovate[bot]
Base branch: main

Your task

Use the renovate-reviewer agent instructions to produce a dependency update risk assessment for PR #165 in webgrip/homelab-cluster.

How to research

Fetch live PR metadata, diff, and changed files via gh api or the github/* tools.
Read relevant repository files — find every place this dependency is used.
Look up upstream release notes. Use execute to curl wherever the info lives:
- GitHub releases API for GitHub-hosted projects
- Docker Hub API (https://hub.docker.com/v2/repositories/<image>/tags) for container images
- npm, PyPI, crates.io, ArtifactHub, or the project's own changelog/release page
- Check ALL versions between old and new, not just the latest
Write the review following the format in the renovate-reviewer agent profile.

How to deliver the review

Auth tokens are stripped from this environment, so API write calls fail.
However, git push works (uses the integration credential). Deliver your review like this:

Write the completed review to .copilot-review/result.md with this exact format:
```
pr: 165

<full review body>
```

Commit and push:

git add .copilot-review/result.md
git commit -m "copilot-review: PR #165"
git push

A relay workflow will detect the push, read the file, and post the comment to PR #165.

Initial changed files

kubernetes/apps/searxng/searxng/app/valkey.yaml (+1/-1)

Renovate PR body (contains changelog links — follow them)

This PR contains the following updates:

Package	Update	Change	Pending
docker.io/valkey/valkey	major	`8.1.7` → `9.0.4`	`9.1.0`

⚠️ Major update: review upstream migration notes, chart values, and rollout impact before merging.

Merge Confidence badges are included where Renovate supports them; low/neutral confidence means this update deserves a manual impact check before merge.

Release Notes

valkey-io/valkey (docker.io/valkey/valkey)

`v9.0.4`

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2026-23479) Use-After-Free in unblock client flow
(CVE-2026-25243) Invalid Memory Access in RESTORE command
(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

`v9.0.3`

Compare Source

Valkey 9.0.3

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
(CVE-2026-27623) Reset request type after handling empty requests

Bug fixes

Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
Fix server assert on ACL LOAD when current user loses permission to channels (#3182)
Fix bug causing no response flush sometimes when IO threads are busy (#3205)

`v9.0.2`

Compare Source

Upgrade urgency HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)
Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)
Avoid empty hash object when HSETEX added no fields (#2998)
Fix case-sensitive check for the FNX and FXX arguments in HSETEX (#3000)
Prevent assertion in active expiration job after a hash with volatile fields is ove

Originally created by @Ryangr0 on GitHub. Originally assigned to: @Ryangr0, @Copilot on GitHub. # Renovate dependency review task Marker: `renovate-agent-review:webgrip/homelab-cluster#165` Review pull request: https://github.com/webgrip/homelab-cluster/pull/165 Repository: `webgrip/homelab-cluster` Pull request number: 165 Title: feat(container)!: Update image docker.io/valkey/valkey ( 8.1.7 ➔ 9.0.4 ) Author: @webgrip-renovate[bot] Base branch: `main` ## Your task Use the `renovate-reviewer` agent instructions to produce a dependency update risk assessment for **PR #165** in `webgrip/homelab-cluster`. ## How to research 1. Fetch live PR metadata, diff, and changed files via `gh api` or the `github/*` tools. 2. Read relevant repository files — find every place this dependency is used. 3. Look up upstream release notes. Use `execute` to `curl` wherever the info lives: - GitHub releases API for GitHub-hosted projects - Docker Hub API (`https://hub.docker.com/v2/repositories/<image>/tags`) for container images - npm, PyPI, crates.io, ArtifactHub, or the project's own changelog/release page - Check ALL versions between old and new, not just the latest 4. Write the review following the format in the `renovate-reviewer` agent profile. ## How to deliver the review Auth tokens are stripped from this environment, so API write calls fail. However, **git push works** (uses the integration credential). Deliver your review like this: 1. Write the completed review to `.copilot-review/result.md` with this exact format: ``` pr: 165 <full review body> ``` 2. Commit and push: ``` git add .copilot-review/result.md git commit -m "copilot-review: PR #165" git push ``` 3. A relay workflow will detect the push, read the file, and post the comment to PR #165. ## Initial changed files - `kubernetes/apps/searxng/searxng/app/valkey.yaml` (+1/-1) ## Renovate PR body (contains changelog links — follow them) This PR contains the following updates: | Package | Update | Change | Pending | |---|---|---|---| | [docker.io/valkey/valkey](https://redirect.github.com/valkey-io/valkey) | major | `8.1.7` → `9.0.4` | `9.1.0` | ⚠️ Major update: review upstream migration notes, chart values, and rollout impact before merging. Merge Confidence badges are included where Renovate supports them; low/neutral confidence means this update deserves a manual impact check before merge. --- ### Release Notes <details> <summary>valkey-io/valkey (docker.io/valkey/valkey)</summary> ### [`v9.0.4`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.4) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.3...9.0.4) Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. ##### Security fixes - (CVE-2026-23479) Use-After-Free in unblock client flow - (CVE-2026-25243) Invalid Memory Access in RESTORE command - (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution ### [`v9.0.3`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.3) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.2...9.0.3) ### Valkey 9.0.3 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. ##### Security fixes - (CVE-2025-67733) RESP Protocol Injection via Lua error\_reply - (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message - (CVE-2026-27623) Reset request type after handling empty requests ##### Bug fixes - Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand ([#3160](https://redirect.github.com/valkey-io/valkey/issues/3160)) - Fix server assert on ACL LOAD when current user loses permission to channels ([#3182](https://redirect.github.com/valkey-io/valkey/issues/3182)) - Fix bug causing no response flush sometimes when IO threads are busy ([#3205](https://redirect.github.com/valkey-io/valkey/issues/3205)) ### [`v9.0.2`](https://redirect.github.com/valkey-io/valkey/releases/tag/9.0.2) [Compare Source](https://redirect.github.com/valkey-io/valkey/compare/9.0.1...9.0.2) Upgrade urgency HIGH: There are critical bugs that may affect a subset of users. ## Bug fixes - Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields ([#2973](https://redirect.github.com/valkey-io/valkey/issues/2973)) - Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking ([#2974](https://redirect.github.com/valkey-io/valkey/issues/2974)) - Avoid empty hash object when HSETEX added no fields ([#2998](https://redirect.github.com/valkey-io/valkey/issues/2998)) - Fix case-sensitive check for the FNX and FXX arguments in HSETEX ([#3000](https://redirect.github.com/valkey-io/valkey/issues/3000)) - Prevent assertion in active expiration job after a hash with volatile fields is ove

ryangr0 closed this issue

2026-06-08 08:29:40 +00:00

ryangr0 referenced this issue

2026-06-08 08:31:25 +00:00

[PR #58] [MERGED] fix(container): update image ghcr.io/spegel-org/helm-charts/spegel ( 0.7.0 ➔ 0.7.1 ) #302

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/homelab-cluster#58

No description provided.

Rows
Columns