🤖 Update image docker.io/valkey/valkey

[foundation-fondue]

This PR contains the following updates:

Package	Update	Change
docker.io/valkey/valkey	patch	9.0.0 → 9.0.3
docker.io/valkey/valkey	minor	9.0-alpine → 9.1-alpine

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

valkey-io/valkey (docker.io/valkey/valkey)

v9.0.3

Compare Source

Valkey 9.0.3

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes

• (CVE-2025-67733) RESP Protocol Injection via Lua error_reply
• (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
• (CVE-2026-27623) Reset request type after handling empty requests

Bug fixes

• Avoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#​3160)
• Fix server assert on ACL LOAD when current user loses permission to channels (#​3182)
• Fix bug causing no response flush sometimes when IO threads are busy (#​3205)

v9.0.2

Compare Source

Upgrade urgency HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

• Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#​2973)
• Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#​2974)
• Avoid empty hash object when HSETEX added no fields (#​2998)
• Fix case-sensitive check for the FNX and FXX arguments in HSETEX (#​3000)
• Prevent assertion in active expiration job after a hash with volatile fields is overwritten (#​3003, #​3007)
• Fix HRANDFIELD to return null response when no field could be found (#​3022)
• Fix HEXPIRE to not delete items when validation rules fail and expiration is in the past (#​3023, #​3048)
• Fix how hash is handling overriding of expired fields overwrite (#​3060)
• HSETEX - Always issue keyspace notifications after validation (#​3001)
• Make zero a valid TTL for hash fields during import mode and data loading (#​3006)
• Trigger prepareCommand on argc change in module command filters (#​2945)
• Restrict TTL from being negative and avoid crash in import-mode (#​2944)
• Fix chained replica crash when doing dual channel replication (#​2983)
• Skip slot cache optimization for AOF client to prevent key duplication and data corruption (#​3004)
• Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#​3005)
• Avoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance (#​3046)
• Fix XREAD returning error on empty stream with + ID (#​2742)

Performance/Efficiency Improvements

• Track reply bytes in I/O threads if commandlog-reply-larger-than is -1 (#​3086, #​3126).
  This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix #​2652.

Full Changelog: valkey-io/valkey@9.0.1...9.0.2

v9.0.1

Compare Source

Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.

Bug fixes

• Authenticate slot migration client on source node to internal user (#​2785)
• Bug fix: reset io_last_written on c->buf resize to prevent stale pointers (#​2786)
• Sentinel: fix regression requiring "+failover" ACL in failover path (#​2780)
• Cluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#​2817)
• Send duplicate multi meet packet only for node which supports it in mixed clusters (#​2840)
• Fix: LTRIM should not call signalModifiedKey when no elements are removed (#​2787)
• Fix build on some 32-bit ARM by only using NEON on AArch64 (#​2873)
• Fix deadlock in IO-thread shutdown during panic (#​2898)
• Fix COMMANDLOG large-reply when using reply copy avoidance (#​2652)
• Fix CLUSTER SLOTS crash when called from module timer callback (#​2915)

Full Changelog: valkey-io/valkey@9.0.0...9.0.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.