00-RELEASENOTES

Valkey 9.1 release notes
========================

Upgrade urgency levels:

| Level    | Meaning                                                             |
|----------|---------------------------------------------------------------------|
| LOW      | No need to upgrade unless there are new features you want to use.   |
| MODERATE | Program an upgrade of the server, but it's not urgent.              |
| HIGH     | There is a critical bug that may affect a subset of users. Upgrade! |
| CRITICAL | There is a critical bug affecting MOST USERS. Upgrade ASAP.         |
| SECURITY | There are security fixes in the release.                            |

Valkey 9.1.0 GA - Released Tue May 12 2026
---------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

### New Features and enhanced behavior
* Add cluster bus network traffic usage metric in bytes by @@hpatro (#3396)

### New Features and enhanced behavior
* Reduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)

### Bug Fixes
* Fix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)
* Fix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)
* Handle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)
* Fixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)
* Fix the memory leak in valkey-benchmark by @nmvk (#3643)


Valkey 9.1.0-rc2 - Released Tue Apr 28 00:00:00 2026
-------------------------------------

Upgrade urgency LOW: This is the second release candidate of Valkey 9.1.0.

### Behavior Changes
* Revert strict TLS certificate validation at config load as it is a breaking change, deferred to next major version (#3572)

### New Features and enhanced behavior
* Do the failover immediately if the replica is the best ranked replica by @enjoy-binbin (#2227)
* Add `cluster-config-save-behavior` option to control nodes.conf save behavior by @enjoy-binbin (#3372)
* Lua scripting engine is now statically linked by default instead of dynamically linked by @eifrah-aws (#3392)
* Module command result callback addition by @martinrvisser (#2936)

### Performance and Efficiency improvements
* Redesign IO threading communication model with lock-free queues (8-17% throughput gain) by @akashkgit (#3324)
* Increase embedded string threshold from 64 to 128 bytes (30% GET throughput gain) by @Nikhil-Manglore (#3397)
* ARM NEON SIMD optimization for pvFind() in vset.c (2-3x speedup) by @ahmadbelb (#3033)
* Optimize WATCH duplicate key check from O(N) to O(1) using per-db hashtable by @enjoy-binbin (#3360)
* Optimize `CLUSTERSCAN MATCH` so that it uses a specific slot if given by @nmvk (#3380)
* Improve COB memory tracking with copy avoidance by @dvkashapov (#3306)

### Bug Fixes
* Fix `valkey-cli --cluster del-node` for unreachable nodes by @yang-z-o (#3209)
* Enhance cluster stale packet detection to prevent sub-replica and empty primary by @zhijun42 (#2811)
* Big endian bitmap byte order mismatch fix by @nmvk (#3401)
* Fix slot-migration-max-failover-repl-bytes unable to accept -1 by @enjoy-binbin (#3443)
* Fix config rewrite producing negative values for unsigned memory configs by @enjoy-binbin (#3440)
* Fix HPERSIST RESP protocol violation on wrong-type key by @madolson (#3516)
* Fix lua-enable-insecure-api default value cannot be changed to yes by @enjoy-binbin (#3548)

Valkey 9.1.0-rc1 - Released Tue Mar 17 00:00:00 2026
-------------------------------------

Upgrade urgency LOW: This is the first release candidate of Valkey 9.1.0, with
new features, performance improvements, and bug fixes.

### New Features and enhanced behavior
* Database-level access control by @dvkashapov (#2309)
* Move Lua scripting engine into a Valkey module by @rjd15372 (#2858)
* Support cross node consistency for `SCAN` commands through configurable DB hash seed by @sarthakaggarwal97 (#2608)
* Support automatic TLS reload by @yang-z-o (#3020)
* Support TLS authentication using SAN URI by @yang-z-o (#3078)
* Prevent invalid TLS certificates from being loaded by @yang-z-o (#2999)
* Failing to save the cluster config file will no longer exit the process by @enjoy-binbin (#1032)

### Command and API updates
* Makes `CLUSTER KEYSLOT` available in standalone mode by @stockholmux (#3040)
* Update HSETEX so that it always issue keyspace notifications after validation by @ranshid (#3001)
* Adds HGETDEL command by @roshkhatri (#2851)
* Support NX/XX flag in HSETEX command by @hanxizh9910 (#2668)
* New `CLUSTERSCAN` command for cluster-wide key scanning across nodes by @nmvk (#2934)
* New `MSETEX` command to set multiple keys with a shared expiration by @enjoy-binbin (#3121)
* `CLUSTER SHARDS`/`CLUSTER SLOTS` now include an `availability-zone` field by @bandalgomsu (#3156)

### Performance and Efficiency improvements
* Optimize zset memory usage by embedding element in skiplist by @chzhoo (#2508)
* Remove internal server object pointer overhead in small strings by @rainsupreme (#2516)
* Optimize skiplist query efficiency by embedding the skiplist header by @chzhoo (#2867)
* Improve performance during rehashing by @chzhoo (#3073)
* Optimize SREM/ZREM/HDEL to pause auto shrink when deleting multiple items by @enjoy-binbin (#3144)
* Abort and swap the tables if ht1 is very full during the hashtable shrink rehashing by @enjoy-binbin (#3175)
* Improve performance of copy avoidance when command reply tracking is disabled by @dvkashapov (#3086)
* Enable hardware clock by default by @dvkashapov (#3103)
* Improve `COMMAND` performance by caching responses by @ebarskiy (#2839)
* Add support for asynchronous freeing of keys on writable replicas by @Scut-Corgis (#2849)
* Faster `XRANGE`/`XREVRANGE` via stream range hot-path optimization by @nesty92 (#3002)
* Replicas can reuse the RDB file as AOF preamble after disk-based full sync by @RayaCoo (#1901)

### Module API changes
* Add ValkeyModule_ClusterKeySlotC by @bandalgomsu (#2984)
* Add more client info flags to module API by @martinrvisser (#2868)
* Add prefix-aware ACL permission checks and new module API by @eifrah-aws (#2796)
* Support unsigned 64-bit numeric config values in module API by @artikell (#1546)

### Observability and logging
* Cumulative metrics for active I/O threads usage by @deepakrn (#2463)
* Cumulative metric for active main thread usage by @dvkashapov (#2931)
* Support whole cluster info for INFO command in cluster_info section by @soloestoy, @ranshid (#2876, #2964)
* Add remaining_repl_size field in `CLUSTER GETSLOTMIGRATIONS` output by @enjoy-binbin (#3135)
* Add logging helper function to print node's ip:port when nodename not explicitly set by @zhijun42 (#2777)
* Dual-channel-replication announces itself at replica-announce-ip if configured by @jdheyburn (#2846)
* Show replica dual-channel replication buffer memory in `INFO MEMORY` and `MEMORY STATS` by @enjoy-binbin (#2924)
* Add `rdb_transmitted` state to replica state in `INFO` by @enjoy-binbin (#2833)
* New INFO section for scripting engines by @rjd15372 (#2738)
* Adding json support for log-format config by @jbergstroem (#1791)
* Add server side TLS certificate expiry tracking and INFO telemetry by @YiwenZhang12 (#2913)
* Add option to use libbacktrace for backtraces in crash reports by @rainsupreme (#3034)

### Build and Tooling
* Show RPS histogram in valkey-benchmark by @hanxizh9910 (#2471)
* Add --warmup and --duration parameters to valkey-benchmark by @rainsupreme (#2581)
* Lazy loading of RDMA libs in CLI/Benchmark when building as module by @Ada-Church-Closure (#3072)
* Add support for atomic slot migration to valkey-cli by @murphyjacob4 (#2755)
* Replace C++ fast_float dependency with pure C implementation (ffc) by @lemire (#3329)

### Bug Fixes
* Strictly check CRLF when parsing querybuf by @enjoy-binbin (#2872)

### Contributors
* abmathur-ie @abmathur-ie
* Adam Fowler @adam-fowler
* Aditya Teltia @AdityaTeltia
* Akash Kumar @akashkgit
* Alina Liu @asagege
* Allen Samuels @allenss-amazon
* Alon Arenberg @alon-arenberg
* aradz44 @aradz44
* Arthur Lee @arthurkiller
* bandalgomsu @bandalgomsu
* Baswanth @baswanth09
* Benson-li @li-benson
* Binbin @enjoy-binbin
* Björn Svensson @bjosv
* bpint @bpint
* chenshi @chenshi5012
* chzhoo @chzhoo
* cjx-zar @cjx-zar
* Daejun Kim @djk1027
* Daniil Kashapov @dvkashapov
* Deepak Nandihalli @deepakrn
* Diego Ciciani @diegociciani
* eifrah-aws @eifrah-aws
* Evgeny Barskiy @ebarskiy
* FAN PEI @fanpei91
* Gabi Ganam @gabiganam
* Gagan H R @gaganhr94
* Hanxi Zhang @hanxizh9910
* Harkrishn Patro @hpatro
* Harry Lin @harrylin98
* hieu2102 @hieu2102
* Jacob Murphy @murphyjacob4
* Jeff Duffy @jaduffy
* jiegang0219 @jiegang0219
* Jim Brunner @JimB123
* Johan Bergström @jbergstroem
* John @johnufida
* Joseph Heyburn @jdheyburn
* Jun Yeong Kim @junyeong0619
* Katie Holly @Fusl
* Ken @otherscase
* korjeek @korjeek
* Kurt McKee @kurtmckee
* Kyle J. Davis @stockholmux
* Kyle Kim @kyle-yh-kim
* Leon Anavi @leon-anavi
* Madelyn Olson @madolson
* Mangat Singh Toor @immangat
* Marc Jakobi @mrcjkb
* martinrvisser @martinrvisser
* Marvin Rösch @marvinroesch
* Murad Shahmammadli @MuradSh
* NAM UK KIM @namuk2004
* Nikhil Manglore @Nikhil-Manglore
* Ouri Half @ouriamzn
* Patrik Hermansson @phermansson
* Ping Xie @PingXie
* Quanye Yang @Ada-Church-Closure
* Quanye Yang @quanyeyang
* Raghav Muddur @nmvk
* Rain Valentine @rainsupreme
* Ran Shidlansik @ranshid
* Ricardo Dias @rjd15372
* Ritoban Dutta @ritoban23
* Roshan Khatri @roshkhatri
* ruihong123 @ruihong123
* Sachin Venkatesha Murthy @sachinvmurthy
* sananes @yaronsananes
* Sarthak Aggarwal @sarthakaggarwal97
* Satheesha CH Gowda @satheesha
* Saurabh K @smkher
* Seungmin Lee @sungming2
* Shinobu Nunotaba @Ada-Church-Closure
* Simon Baatz @gmbnomis
* skyfirelee @artikell
* Sourav Singh Rawat @frostzt
* stydxm @stydxm
* Ted Lyngmo @TedLyngmo
* Tony Wooster @twooster
* uriyage @uriyage
* Vadym Khoptynets @poiuj
* Venkat Pamulapati @ChiliPaneer
* Viktor Söderqvist @zuiderkwast
* Vitah Lin @vitahlin
* Vitali @VitalyAR
* withRiver @withRiver
* wxmzy88 @wxmzy88
* xbasel @xbasel
* Yair Gottdenker @yairgott
* Yana Molodetsky @yanamolo
* Yang Zhao @yang-z-o
* Yiwen Zhang @YiwenZhang12
* yzc-yzc @yzc-yzc
* zhaozhao.zz @soloestoy
* Zhijun Liao @zhijun42