GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

Bug Fixes

Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during CLIENT PAUSE WRITE or CLUSTER FAILOVER by @smkher (#3645)
Fix event loop busy-spinning on virtual machines by not using raw TSC for the monotonic clock when the kernel clocksource is not tsc by @quanyeyang (#4707)
Fix a crash in ValkeyModule_HashHasStringRef on a missing or expired field and correct wrong return values in the hash stringRef module APIs by @ShubhamTaple (#4504)
Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
Clear a stale primary-failure gossip flag on replicas so later failovers don't incorrectly skip the election delay by @charsyam (#4533)
Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
valkey-check-aof now recognizes RDB base files with the VALKEY signature instead of misreporting a valid multipart AOF as invalid by @sarthakaggarwal97 (#4739)
Fix module commands that access undeclared keys in other slots reading or writing the wrong slot in cluster mode, and aborting in debug builds by @patrickswedish (#4424)
Reject relative expire times in SET/GETEX, RESTORE, and ValkeyModule_SetExpire that overflow when added to the current time, preventing server aborts from negative expires by @madolson (#4880)
HDEL, HGETDEL, HPERSIST, and HEXPIRE no longer propagate fields they treat as expired, preventing replica and AOF-reload divergence by @xdk-amz (#4772)
Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
Fix a segfault on Alpine/musl when Lua is built as a module, caused by a symbol clash on an internal clock function by @mohammedgqudah (#4270)
COPY of a hash now includes expired-but-unreaped fields so their deletion is propagated and replicas stay in sync by @pirate329 (#4939)
Restore acceptance of hexadecimal float sorted set scores (such as 0x10), keeping replication and AOF replay compatible with Valkey 9.0 by @quanyeyang (#4875)
Sorted set range commands with a negative LIMIT offset now return an empty result instead of a spurious element on btree-encoded keys by @xiaocj (#4637)
Fix listpack encoding incompatibility that caused RDB load and replication failures for entries of certain lengths between 9.0 and 9.1.x by @jjuleslasarte (#4819)
Fix atomic slot migration not replicating evictions on the import target, which let replicas grow far past maxmemory by @shanezx-sc (#4920)
Redact error text in server logs when hide-user-data-from-log is enabled, so command arguments no longer leak into logs by @zackcam (#4815)
Fix HSETEX and HGETEX failing to parse their arguments when the key is named fields by @sebxt (#4945)
Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)
Fix atomic slot migration with cluster-databases > 1 applying writes made during the snapshot to the wrong database on the target by @pirate329 (#4952)

Full Changelog: https://github.com/valkey-io/valkey/compare/9.1.2...9.1.3

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [valkey/valkey](https://github.com/valkey-io/valkey) | patch | `9.1.2-alpine` → `9.1.3-alpine` | --- ### Release Notes <details> <summary>valkey-io/valkey (valkey/valkey)</summary> ### [`v9.1.3`](https://github.com/valkey-io/valkey/releases/tag/9.1.3) [Compare Source](https://github.com/valkey-io/valkey/compare/9.1.2...9.1.3) ## Valkey 9.1.3 - Released Mon 26 October 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. ##### Security Fixes - GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by [@roshkhatri](https://github.com/roshkhatri) ([#5030](https://github.com/valkey-io/valkey/issues/5030)) ##### Bug Fixes - Fix stream commands that mutate consumer-group or PEL state (`XGROUP`, `XSETID`, `XREADGROUP`, `XACK`, `XCLAIM`, `XAUTOCLAIM`) not triggering `WATCH` and client-side tracking invalidation by [@Tarte12](https://github.com/Tarte12) ([#3459](https://github.com/valkey-io/valkey/issues/3459)) - Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during `CLIENT PAUSE WRITE` or `CLUSTER FAILOVER` by [@smkher](https://github.com/smkher) ([#3645](https://github.com/valkey-io/valkey/issues/3645)) - Fix event loop busy-spinning on virtual machines by not using raw TSC for the monotonic clock when the kernel clocksource is not tsc by [@quanyeyang](https://github.com/quanyeyang) ([#4707](https://github.com/valkey-io/valkey/issues/4707)) - Fix a crash in `ValkeyModule_HashHasStringRef` on a missing or expired field and correct wrong return values in the hash stringRef module APIs by [@ShubhamTaple](https://github.com/ShubhamTaple) ([#4504](https://github.com/valkey-io/valkey/issues/4504)) - Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by [@enjoy-binbin](https://github.com/enjoy-binbin) ([#4733](https://github.com/valkey-io/valkey/issues/4733)) - Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0\*inf; a NaN weighted score now counts as 0, matching ZUNION by [@leomurillo](https://github.com/leomurillo) ([#4997](https://github.com/valkey-io/valkey/issues/4997)) - Clear a stale primary-failure gossip flag on replicas so later failovers don't incorrectly skip the election delay by [@charsyam](https://github.com/charsyam) ([#4533](https://github.com/valkey-io/valkey/issues/4533)) - Correct `ValkeyModule_FreeModuleUser`, `ValkeyModule_ACLAddLogEntry` and `ValkeyModule_ACLAddLogEntryByUserName` declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by [@rainsupreme](https://github.com/rainsupreme) ([#4676](https://github.com/valkey-io/valkey/issues/4676)) - valkey-check-aof now recognizes RDB base files with the `VALKEY` signature instead of misreporting a valid multipart AOF as invalid by [@sarthakaggarwal97](https://github.com/sarthakaggarwal97) ([#4739](https://github.com/valkey-io/valkey/issues/4739)) - Fix module commands that access undeclared keys in other slots reading or writing the wrong slot in cluster mode, and aborting in debug builds by [@patrickswedish](https://github.com/patrickswedish) ([#4424](https://github.com/valkey-io/valkey/issues/4424)) - Reject relative expire times in `SET`/`GETEX`, `RESTORE`, and `ValkeyModule_SetExpire` that overflow when added to the current time, preventing server aborts from negative expires by [@madolson](https://github.com/madolson) ([#4880](https://github.com/valkey-io/valkey/issues/4880)) - `HDEL`, `HGETDEL`, `HPERSIST`, and `HEXPIRE` no longer propagate fields they treat as expired, preventing replica and AOF-reload divergence by [@xdk-amz](https://github.com/xdk-amz) ([#4772](https://github.com/valkey-io/valkey/issues/4772)) - Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by [@magic-peach](https://github.com/magic-peach) ([#4214](https://github.com/valkey-io/valkey/issues/4214)) - Fix a segfault on Alpine/musl when Lua is built as a module, caused by a symbol clash on an internal clock function by [@mohammedgqudah](https://github.com/mohammedgqudah) ([#4270](https://github.com/valkey-io/valkey/issues/4270)) - `COPY` of a hash now includes expired-but-unreaped fields so their deletion is propagated and replicas stay in sync by [@pirate329](https://github.com/pirate329) ([#4939](https://github.com/valkey-io/valkey/issues/4939)) - Restore acceptance of hexadecimal float sorted set scores (such as `0x10`), keeping replication and AOF replay compatible with Valkey 9.0 by [@quanyeyang](https://github.com/quanyeyang) ([#4875](https://github.com/valkey-io/valkey/issues/4875)) - Sorted set range commands with a negative `LIMIT` offset now return an empty result instead of a spurious element on btree-encoded keys by [@xiaocj](https://github.com/xiaocj) ([#4637](https://github.com/valkey-io/valkey/issues/4637)) - Fix listpack encoding incompatibility that caused RDB load and replication failures for entries of certain lengths between 9.0 and 9.1.x by [@jjuleslasarte](https://github.com/jjuleslasarte) ([#4819](https://github.com/valkey-io/valkey/issues/4819)) - Fix atomic slot migration not replicating evictions on the import target, which let replicas grow far past `maxmemory` by [@shanezx-sc](https://github.com/shanezx-sc) ([#4920](https://github.com/valkey-io/valkey/issues/4920)) - Redact error text in server logs when `hide-user-data-from-log` is enabled, so command arguments no longer leak into logs by [@zackcam](https://github.com/zackcam) ([#4815](https://github.com/valkey-io/valkey/issues/4815)) - Fix `HSETEX` and `HGETEX` failing to parse their arguments when the key is named `fields` by [@sebxt](https://github.com/sebxt) ([#4945](https://github.com/valkey-io/valkey/issues/4945)) - Fix cluster config saving to avoid publishing truncated `nodes.conf` files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate `nodes.conf.lock` file by [@KewangZhili](https://github.com/KewangZhili) ([#4489](https://github.com/valkey-io/valkey/issues/4489)) - Fix `LSET` on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by [@charsyam](https://github.com/charsyam) ([#4823](https://github.com/valkey-io/valkey/issues/4823)) - Fix atomic slot migration with `cluster-databases` > 1 applying writes made during the snapshot to the wrong database on the target by [@pirate329](https://github.com/pirate329) ([#4952](https://github.com/valkey-io/valkey/issues/4952)) **Full Changelog**: <https://github.com/valkey-io/valkey/compare/9.1.2...9.1.3> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

Renovate added the

renovate

label

2026-10-26 22:03:16 -04:00

Renovate added 1 commit

2026-10-26 22:03:16 -04:00

chore(deps): update valkey/valkey docker tag to v9.1.3

Actions / Build Flake Packages & Push to Cache (pull_request) Successful in 4m27s

Details

50d1eb1f36