Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during CLIENT PAUSE WRITE or CLUSTER FAILOVER by @smkher (#3645)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• valkey-check-aof now recognizes RDB base files with the VALKEY signature instead of misreporting a valid multipart AOF as invalid by @sarthakaggarwal97 (#4739)
• Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided by @murphyjacob4 (#3598)
• Reject relative expire times in SET/GETEX, RESTORE, and ValkeyModule_SetExpire that overflow when added to the current time, preventing server aborts from negative expires by @madolson (#4880)
• HDEL, HGETDEL, HPERSIST, and HEXPIRE no longer propagate fields they treat as expired, preventing replica and AOF-reload divergence by @xdk-amz (#4772)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• COPY of a hash now includes expired-but-unreaped fields so their deletion is propagated and replicas stay in sync by @pirate329 (#4939)
• Sorted set range commands with a negative LIMIT offset now return an empty result instead of a spurious element on btree-encoded keys by @xiaocj (#4637)
• Fix atomic slot migration not replicating evictions on the import target, which let replicas grow far past maxmemory by @shanezx-sc (#4920)
• Redact error text in server logs when hide-user-data-from-log is enabled, so command arguments no longer leak into logs by @zackcam (#4815)
• Fix HSETEX and HGETEX failing to parse their arguments when the key is named fields by @sebxt (#4945)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix atomic slot migration with cluster-databases > 1 applying writes made during the snapshot to the wrong database on the target by @pirate329 (#4952)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)

Full Changelog: https://github.com/valkey-io/valkey/compare/9.0.6...9.0.7

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during CLIENT PAUSE WRITE or CLUSTER FAILOVER by @smkher (#3645)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• Fix valkey-benchmark spinning on would-block writes, which could starve reply processing and the --duration timer by @thweetkomputer (#4567)
• Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided by @murphyjacob4 (#3598)
• Reject relative expire times in SET/GETEX, RESTORE, and ValkeyModule_SetExpire that overflow when added to the current time, preventing server aborts from negative expires by @madolson (#4880)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• Sorted set range commands with a negative LIMIT offset now return an empty result instead of a spurious element on btree-encoded keys by @xiaocj (#4637)
• Redact error text in server logs when hide-user-data-from-log is enabled, so command arguments no longer leak into logs by @zackcam (#4815)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)

Full Changelog: https://github.com/valkey-io/valkey/compare/8.0.11...8.0.12

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Fix a server crash when module timer callbacks or thread-safe contexts attempt writes while writes are paused by CLIENT PAUSE WRITE or CLUSTER FAILOVER; such module writes are now rejected by @smkher (#3645)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided by @murphyjacob4 (#3598)
• Reject relative expire times in SET/GETEX, RESTORE, and the module SetExpire API that overflow when the current time is added, preventing negative expires that abort the server by @madolson (#4880)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• Fix sorted set range commands with a negative LIMIT offset returning a wrong element on btree-encoded keys; negative offsets now return an empty result in both encodings by @xiaocj (#4637)
• Redact error reply text in server logs when hide-user-data-from-log is enabled, so keys and values no longer leak into logs via error messages by @zackcam (#4815)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)

Full Changelog: https://github.com/valkey-io/valkey/compare/8.1.10...8.1.11

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Reject module write commands while the server is paused for writes, preventing a crash from module timer callbacks during CLIENT PAUSE WRITE or CLUSTER FAILOVER by @smkher (#3645)
• Fix event loop busy-spinning on virtual machines by not using raw TSC for the monotonic clock when the kernel clocksource is not tsc by @quanyeyang (#4707)
• Fix a crash in ValkeyModule_HashHasStringRef on a missing or expired field and correct wrong return values in the hash stringRef module APIs by @ShubhamTaple (#4504)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Clear a stale primary-failure gossip flag on replicas so later failovers don't incorrectly skip the election delay by @charsyam (#4533)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• valkey-check-aof now recognizes RDB base files with the VALKEY signature instead of misreporting a valid multipart AOF as invalid by @sarthakaggarwal97 (#4739)
• Fix module commands that access undeclared keys in other slots reading or writing the wrong slot in cluster mode, and aborting in debug builds by @patrickswedish (#4424)
• Reject relative expire times in SET/GETEX, RESTORE, and ValkeyModule_SetExpire that overflow when added to the current time, preventing server aborts from negative expires by @madolson (#4880)
• HDEL, HGETDEL, HPERSIST, and HEXPIRE no longer propagate fields they treat as expired, preventing replica and AOF-reload divergence by @xdk-amz (#4772)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• Fix a segfault on Alpine/musl when Lua is built as a module, caused by a symbol clash on an internal clock function by @mohammedgqudah (#4270)
• COPY of a hash now includes expired-but-unreaped fields so their deletion is propagated and replicas stay in sync by @pirate329 (#4939)
• Restore acceptance of hexadecimal float sorted set scores (such as 0x10), keeping replication and AOF replay compatible with Valkey 9.0 by @quanyeyang (#4875)
• Sorted set range commands with a negative LIMIT offset now return an empty result instead of a spurious element on btree-encoded keys by @xiaocj (#4637)
• Fix listpack encoding incompatibility that caused RDB load and replication failures for entries of certain lengths between 9.0 and 9.1.x by @jjuleslasarte (#4819)
• Fix atomic slot migration not replicating evictions on the import target, which let replicas grow far past maxmemory by @shanezx-sc (#4920)
• Redact error text in server logs when hide-user-data-from-log is enabled, so command arguments no longer leak into logs by @zackcam (#4815)
• Fix HSETEX and HGETEX failing to parse their arguments when the key is named fields by @sebxt (#4945)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)
• Fix atomic slot migration with cluster-databases > 1 applying writes made during the snapshot to the wrong database on the target by @pirate329 (#4952)

Full Changelog: https://github.com/valkey-io/valkey/compare/9.1.2...9.1.3

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

• GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to crash the server or potentially execute arbitrary code by publishing an oversized message by @roshkhatri (#5030)

• Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
• Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart by @chzhoo (#4342)
• Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns by @tjade273 (#3971)
• Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded by @enjoy-binbin (#4360)
• Fix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message type by @enjoy-binbin (#4410)
• AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled by @lukepalmer (#3984)
• Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload and its ACL flags become no-ops by @jjuleslasarte (#3721)
• Fix a client memory accounting leak on replicas that inflated the mem_clients_normal INFO field after primary disconnections by @enjoy-binbin (#4395)
• Fix stream commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) not triggering WATCH and client-side tracking invalidation by @Tarte12 (#3459)
• Fix a server abort on a RESTORE payload declaring a string length that overflows the allocation size; such payloads are now rejected as bad data by @enjoy-binbin (#4733)
• Fix ZINTER/ZINTERSTORE returning input-order-dependent scores when a weighted term is 0*inf; a NaN weighted score now counts as 0, matching ZUNION by @leomurillo (#4997)
• Harden stream validation on RDB load and RESTORE so crafted payloads can no longer crash the server on later commands by @madolson (#3922)
• Fix a use-after-free crash when serving clients blocked on the same key if one client is freed during processing by @quanyeyang (#4212)
• Fix a stack overflow crash in TLS connections when retrying a large write after a write failure by @murphyjacob4 (#4307)
• Fix a crash from forged cluster bus PUBLISH or MODULE packets declaring payload lengths that exceed the packet size by @tjade273 (#3972)
• Correct ValkeyModule_FreeModuleUser, ValkeyModule_ACLAddLogEntry and ValkeyModule_ACLAddLogEntryByUserName declarations to return int as implemented, fixing undefined behavior on targets with strict call signature checks by @rainsupreme (#4676)
• Fix valkey-benchmark spinning on would-block writes, which could starve reply processing and the --duration timer by @thweetkomputer (#4567)
• Fix a huge memory allocation when a command such as COMMAND GETKEYS EVAL declares a far larger key count than the arguments provided by @murphyjacob4 (#3598)
• Reject stream payloads with mismatched live/deleted record counts, preventing XDEL from destroying unaccounted entries by @roshkhatri (#4381)
• Fix a server crash when loading an ACL file containing a selector with an unmatched parenthesis by @magic-peach (#4214)
• Fix cluster config saving to avoid publishing truncated nodes.conf files, losing the startup lock after the first save, and failing every save on SMB filesystems such as Azure Files; the lock now lives on a separate nodes.conf.lock file by @KewangZhili (#4489)
• Fix LSET on 64-bit builds silently modifying the wrong element for out-of-range indexes instead of returning an index out of range error by @charsyam (#4823)

Full Changelog: https://github.com/valkey-io/valkey/compare/7.2.14...7.2.15

• Fixed CVE-2026-18036, CVE-2026-59949, CVE-2026-71888, CVE-2026-71889, CVE-2026-71891, CVE-2026-76183, CVE-2026-90559, CVE-2026-93452, CVE-2026-102554, CVE-2026-106450, CVE-2026-106451, CVE-2026-107314, CVE-2026-108106 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16292
• Protected OAuth2 authorization request cookie from tampering by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16363
• Fixed arbitrary file write in TBEL script sandbox by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15930
• Fixed CVE-2026-76844, CVE-2026-93687, CVE-2026-93748, CVE-2026-93749, CVE-2026-101896, CVE-2026-102276, CVE-2026-102278, CVE-2026-102422, CVE-2026-102992, CVE-2026-104850, CVE-2026-110816, CVE-2026-111752, CVE-2026-111755, CVE-2026-111756, CVE-2026-111767, CVE-2026-111768 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/16392
• Fixed CVE-2025-13466, CVE-2026-5758, CVE-2026-9358, CVE-2026-12590, CVE-2026-24001, CVE-2026-33532, CVE-2026-41148, CVE-2026-41149, CVE-2026-41150, CVE-2026-41159, CVE-2026-41907, CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, and 34 others by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/16405
• Fixed CVE-2026-101296, CVE-2026-101356 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16413

• Handled validation results consistently in telemetry and attribute callbacks by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16306
• Fixed partitions being lost after a ZooKeeper session expiry by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/16263
• Fixed unbounded growth of Kafka notification topics from RPC and REST API reply flows by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15729
• Fixed calculated field time series ignoring the tenant profile's default storage TTL by @irynamatveieva in https://github.com/thingsboard/thingsboard/pull/16185

• Added a warning that updating a solution template recreates everything it installed by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16153
• IoT Hub: added filtering of the catalogue by the creator's verification status by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16165
• IoT Hub: changed the hero search popup to show one ranked list, and added filters to the search page by @ShvaykaD in https://github.com/thingsboard/thingsboard/pull/16148
• IoT Hub: made item screenshots and readme images open in a fullscreen viewer by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16151
• Fixed empty Provisioning step when navigating the device install wizard via the stepper header by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16265
• Updated IoT Hub "Professional Edition required" dialog to point to the Community Grant Program by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16231
• Fixed color range settings being corrupted when rangeList has no advancedMode by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/16342
• Fixed "Unsaved changes" warning shown on the Alarm rule details page when no changes were made and the rule has a clear condition by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15868

• Fixed reconnect race where the closing edge session cancelled the new session's edge event check by @MazurenkoNick in https://github.com/thingsboard/thingsboard/pull/16082
• Fixed persistent RPC status changes and deletions not syncing between Edge and Cloud by @MazurenkoNick in https://github.com/thingsboard/thingsboard/pull/15913

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.3.1.7...v4.3.1.8

Update urgency: SECURITY: There is a security fix in the release.

• Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode

Update urgency: SECURITY: There is a security fix in the release.

• Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode

Update urgency: SECURITY: There is a security fix in the release.

• Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode

Update urgency: SECURITY: There is a security fix in the release.

• Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode