Skip to content

feat(container): update image ghcr.io/valkey-io/valkey ( 9.0.3 → 9.1.1 ) - #3335

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-valkey-io-valkey-9.x
Open

feat(container): update image ghcr.io/valkey-io/valkey ( 9.0.3 → 9.1.1 )#3335
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-valkey-io-valkey-9.x

Conversation

@renovate

@renovate renovate Bot commented May 6, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
ghcr.io/valkey-io/valkey minor 9.0.39.1.1

Release Notes

valkey-io/valkey (ghcr.io/valkey-io/valkey)

v9.1.1

Compare Source

Valkey 9.1.1 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#​4234)
  • CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @​z0v3r1n and @​lifip. (#​4073)
Bug Fixes
  • Omit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output by @​dvkashapov (#​3964)
  • Improve throughput when IO threads are enabled by offloading object deallocation from the main thread by @​roshkhatri (#​3938)
  • Fix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred by @​ranshid (#​3800)
  • Enforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens by @​enjoy-binbin (#​3801)
  • Enforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases by @​enjoy-binbin (#​3806)
  • Fix use-after-free in the module API when unregistering the first registered cluster message receiver by @​eifrah-aws (#​3846)
  • Fix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count by @​cjx-zar (#​4047)
  • Fix clients left on the wrong database after module keyspace notifications for MOVE and COPY by @​enjoy-binbin (#​4024)
  • Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @​lukepalmer (#​4068)
  • Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @​ranshid (#​3950)
  • Fix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback by @​enjoy-binbin (#​3743)
  • Fix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds by @​enjoy-binbin (#​3941)
  • Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @​madolson (#​3920)
  • Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @​madolson (#​3921)
  • Fix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @​nanyan0312 (#​4060)
  • Fix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating INFO output by @​chenshi5012 (#​3787)
  • HGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced by @​lcxn123 (#​4049)
  • COMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @​rickrams (#​3939)
  • Send the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @​hpatro (#​4105)
  • Fix duplicate failure handling and an invalid reply sequence in cluster slot migration by @​chx9 (#​3723)
  • Reject control characters in SENTINEL SET values to prevent config-file injection via Sentinel config rewrite by @​eifrah-aws (#​3847)
  • Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf injection by @​eifrah-aws (#​3848)
  • Redact key names and user data from more server log messages when hide-user-data-from-log is enabled by @​zackcam (#​3872)
  • ACL LOG now reports the denied database ID for COPY instead of the command name when db= access is denied by @​enjoy-binbin (#​3888)
  • Fix garbled shard IDs in the cluster UPDATE message log line by @​enjoy-binbin (#​3942)
  • Fix negative master_sync_total_bytes in INFO replication during disk-based sync when the RDB exceeds 2GB by @​chx9 (#​3811)
  • Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @​pkhartsk (#​3843)

Full Changelog: valkey-io/valkey@9.1.0...9.1.1

v9.1.0

Compare Source

Upgrade urgency LOW: This is the first stable release of Valkey 9.1.

Security fixes
  • (CVE-2026-23479) Use-After-Free in unblock client flow
  • (CVE-2026-25243) Invalid Memory Access in RESTORE command
  • (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
New Features and enhanced behavior
Bug Fixes

See also the release notes for 9.1.0-rc1 and 9.1.0-rc2.

v9.0.5

Compare Source

Valkey 9.0.5 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#​4234)
  • CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @​z0v3r1n and @​lifip. (#​4073)
Bug Fixes
  • Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @​enjoy-binbin (#​2872)
  • Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @​twooster (#​3283)
  • Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @​sarthakaggarwal97 (#​3342)
  • Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @​madolson (#​3516)
  • Fix a crash from a race between IO threads and asynchronous client freeing by @​deepakrn (#​3458)
  • Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @​enjoy-binbin (#​3498)
  • Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @​smkher (#​3591)
  • Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @​eifrah-aws (#​3578)
  • Fix a NULL pointer crash in TLS pending-data handling by @​zuiderkwast (#​3641)
  • Fix a server crash when multiple RDMA clients disconnect at the same time by @​quanyeyang (#​3448)
  • Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @​ranshid (#​3800)
  • Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @​eifrah-aws (#​3846)
  • Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @​cjx-zar (#​4047)
  • Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @​enjoy-binbin (#​4024)
  • Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @​lukepalmer (#​4068)
  • Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @​dvkashapov (#​3306)
  • Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @​jjuleslasarte (#​3878)
  • Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @​ranshid (#​3950)
  • Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @​madolson (#​3541)
  • Fix a potential crash from a dangling slot migration job reference when the migration client is reset by @​murphyjacob4 (#​3554)
  • Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @​eifrah-aws (#​3503)
  • Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @​bandalgomsu (#​3568)
  • Fix a crash when a slot migration target node is removed from the cluster before the migration connects by @​chenshi5012 (#​3596)
  • Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @​yaronsananes (#​3610)
  • Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @​enjoy-binbin (#​3743)
  • Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @​enjoy-binbin (#​3942)
  • Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 milliseconds by @​enjoy-binbin (#​3941)
  • Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @​madolson (#​3920)
  • Reject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later crash on skiplist conversion by @​madolson (#​3921)
  • Fix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value formatting mismatches by @​chenshi5012 (#​3787)
  • Fix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and reply buffer reuse by @​nanyan0312 (#​4060)
  • COMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands without subcommands by @​rickrams (#​3939)
  • The dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding stale replica entries behind NAT by @​jdheyburn (#​2846)
  • Prevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty primary within a shard by @​zhijun42 (#​2811)
  • Send the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs no longer fail by @​hpatro (#​4105)
  • Fix slot migration failure handling running twice on ownership changes and an out-of-order error reply in the internal SYNCSLOTS FINISH command by @​chx9 (#​3723)
  • Allow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by @​enjoy-binbin (#​3443)
  • Fix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large values by @​enjoy-binbin (#​3440)
  • Reject SENTINEL SET values containing control characters and safely quote Sentinel config values to prevent config file injection by @​eifrah-aws (#​3847)
  • Reject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf corruption or injection by @​eifrah-aws (#​3848)
  • Fix changes to lua-enable-insecure-api via CONFIG SET not taking effect when the option was set at startup by @​enjoy-binbin (#​4182)
  • Fix incorrect memory overhead reported for watched keys in client memory usage tracking by @​enjoy-binbin (#​3359)
  • Replica logs now report 'Connection reset by peer' instead of the misleading 'Success' when the primary closes the connection by @​abmathur-ie (#​3580)
  • Redact key names and user data from more log messages when hide-user-data-from-log is enabled by @​zackcam (#​3872)
  • Fix INFO replication reporting negative sync transfer sizes when the RDB exceeds 2GB during disk-based sync by @​chx9 (#​3811)
  • Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @​pkhartsk (#​3843)
  • valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @​yang-z-o (#​3209)
  • Fix valkey-cli crashing after --eval script execution on jemalloc/tcmalloc builds by @​bandalgomsu (#​3281)
  • valkey-cli --cluster fix now spreads uncovered slots randomly across primaries instead of assigning them all to one node by @​abmathur-ie (#​3586)

Full Changelog: valkey-io/valkey@9.0.4...9.0.5

v9.0.4

Compare Source

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes
  • (CVE-2026-23479) Use-After-Free in unblock client flow
  • (CVE-2026-25243) Invalid Memory Access in RESTORE command
  • (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

Configuration

📅 Schedule: (in timezone America/Chicago)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown

Path: main/homelab/manyfold

--- /tmp/tmp.S5BKhQLDgY	2026-07-22 02:37:28.615004368 +0000
+++ /tmp/tmp.mDLilo5uNj	2026-07-22 02:37:29.350014302 +0000
@@ -201,7 +201,7 @@
             - ""
             - --appendonly
             - "no"
-          image: ghcr.io/valkey-io/valkey:9.0.3
+          image: ghcr.io/valkey-io/valkey:9.1.1
           name: redis
           resources:
             limits:

@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown

Path: main/homelab/paperless-ngx

--- /tmp/tmp.IgVNZMJZeB	2026-07-22 02:37:21.006285595 +0000
+++ /tmp/tmp.LTpcDyx4rK	2026-07-22 02:37:21.444288181 +0000
@@ -43,6 +43,43 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  name: release-name-redis
+  namespace: default
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/controller: redis
+      app.kubernetes.io/name: release-name
+      app.kubernetes.io/instance: release-name
+  template:
+    metadata: {}
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+        - image: ghcr.io/valkey-io/valkey:9.1.1
+          name: redis
+          resources:
+            limits:
+              memory: 128Mi
+            requests:
+              cpu: 5m
+              memory: 32Mi
+
+---
+# Source: oscar/charts/app-template/templates/common.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
   name: paperless
   annotations:
     reloader.stakater.com/auto: "true"
@@ -160,43 +197,6 @@
             server: 192.168.1.115
 
 ---
-# Source: oscar/charts/app-template/templates/common.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: release-name-redis
-  namespace: default
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: redis
-      app.kubernetes.io/name: release-name
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata: {}
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-        - image: ghcr.io/valkey-io/valkey:9.0.3
-          name: redis
-          resources:
-            limits:
-              memory: 128Mi
-            requests:
-              cpu: 5m
-              memory: 32Mi
-
----
 # Source: oscar/templates/paperless-ngx-secret.yaml
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

@renovate renovate Bot added the type/minor label May 19, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-valkey-io-valkey-9.x branch from cab3219 to 7079c73 Compare May 19, 2026 18:58
@renovate renovate Bot removed the type/patch label May 19, 2026
@renovate renovate Bot changed the title fix(container): update image ghcr.io/valkey-io/valkey ( 9.0.3 → 9.0.4 ) feat(container): update image ghcr.io/valkey-io/valkey ( 9.0.3 → 9.1.0 ) May 19, 2026
| datasource | package                  | from  | to    |
| ---------- | ------------------------ | ----- | ----- |
| docker     | ghcr.io/valkey-io/valkey | 9.0.3 | 9.1.1 |


Signed-off-by: Roger Rumao <rogerrum@users.noreply.github.com>
@renovate renovate Bot changed the title feat(container): update image ghcr.io/valkey-io/valkey ( 9.0.3 → 9.1.0 ) feat(container): update image ghcr.io/valkey-io/valkey ( 9.0.3 → 9.1.1 ) Jul 22, 2026
@renovate
renovate Bot force-pushed the renovate/ghcr.io-valkey-io-valkey-9.x branch from 7079c73 to 0f105d4 Compare July 22, 2026 02:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants