Add release notes entry for Valkey 9.1.0 GA

[ranshid]

Add a release notes entry for Valkey 9.1.0 GA covering the three security fixes being ported to the 9.1 branch:

• CVE-2026-23479 — Use-After-Free in unblock client flow
• CVE-2026-25243 — Invalid Memory Access in RESTORE command
• CVE-2026-23631 — Use-after-free when full sync occurs during a yielding Lua/function execution

Only modifies 00-RELEASENOTES. The actual code fixes are in separate PRs targeting 9.1.

[roshkhatri]

Is this supposed to be Valkey 9.1.0 GA?

[ranshid]

Is this supposed to be Valkey 9.1.0 GA?

What else?

[roshkhatri]

Is this supposed to be Valkey 9.1.0 GA?

What else?

RC3 for CVE?

[ranshid]

Is this supposed to be Valkey 9.1.0 GA?

What else?

RC3 for CVE?

I do not think we will do an RC-3. this will just be part of the GA release

[zuiderkwast]

There are lots of PRs in the "To be backported" column in the 9.1 project. They should be cherry-picked to the 9.1 branch and included in 9.1.0 too.

Also some still under review that I think we can merge before the release.

[ranshid]

There are lots of PRs in the "To be backported" column in the 9.1 project. They should be cherry-picked to the 9.1 branch and included in 9.1.0 too.

Also some still under review that I think we can merge before the release.

@zuiderkwast - agree. I was not planning to start the ga release, mainly wanted to backport the CVE fixes at this point

[zuiderkwast]

Shall we keep this PR open and add more release notes to it while we backport more PRs?

[madolson]

Yeah, @lucasyonge fyi, you should have permissions to update this with the remaining release notes.

[ranshid]

I think in the long term - we should add a release section every time we : splt a new releaes branch and/or release rc candidate. maybe we can add this to the release process doc?( @madolson )

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 056781c2-cedc-4f87-9e2a-e14d2308fdf4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[enjoy-binbin]

Let's also update the version together, see #3682

[lucasyonge]

Let's also update the version together, see #3682

Let me close this and add GA section in PR #3682

[lucasyonge]

Close this PR and add updated information in pr #3682 @ranshid