Valkey 8.1 release notes
========================
--------------------------------------------------------------------------------
Upgrade urgency levels:
LOW:      No need to upgrade unless there are new features you want to use.
MODERATE: Program an upgrade of the server, but it's not urgent.
HIGH:     There is a critical bug that may affect a subset of users. Upgrade!
CRITICAL: There is a critical bug affecting MOST USERS. Upgrade ASAP.
SECURITY: There are security fixes in the release.
--------------------------------------------------------------------------------

================================================================================
Valkey 8.1.4  -  Released Fri 09 October 2025
================================================================================

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Security fixes
==============
* (CVE-2025-49844) A Lua script may lead to remote code execution
* (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
* (CVE-2025-46818) A Lua script can be executed in the context of another user
* (CVE-2025-46819) LUA out-of-bound read

Bug fixes
=========
* Fix accounting for dual channel RDB bytes in replication stats (#2614)
* Fix EVAL to report unknown error when empty error table is provided (#2229)
* Fix use-after-free when active expiration triggers hashtable to shrink (#2257)
* Fix MEMORY USAGE to account for embedded keys (#2290)
* Fix memory leak when shrinking a hashtable without entries (#2288)
* Prevent potential assertion in active defrag handling large allocations (#2353)
* Prevent bad memory access when NOTOUCH client gets unblocked (#2347)
* Converge divergent shard-id persisted in nodes.conf to primary's shard id (#2174)
* Fix client tracking memory overhead calculation (#2360)
* Fix RDB load per slot memory pre-allocation when loading from RDB snapshot (#2466)
* Don't use AVX2 instructions if the CPU doesn't support it (#2571)
* Fix bug where active defrag may be unable to defrag sparsely filled pages (#2656)

================================================================================
Valkey 8.1.3  -  Released Sun 07 July 2025
================================================================================

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Bug fixes
=========
* Fix missing response when AUTH is errored inside a transaction (#2287)

Security fixes
==============
* CVE-2025-32023 prevent out-of-bounds write during hyperloglog operations (#2146)
* CVE-2025-48367 retry accept on transient errors (#2315)

================================================================================
Valkey 8.1.2  -  Released Wed 11 June 2025
================================================================================

Upgrade urgency HIGH: This release includes CVE fix for valkey-check-aof tool, we recommend you
apply as soon as possible if you use the tool.

Bug fixes
=========
* Properly escape double quotes and backslash in `MONITOR` command (#2036)
* Fix high CPU usage when fetching a random element in skewed sparse hash table (#2085)
* Fix a bug that allowed clients to process commands when the server has paused command processing (#2109)
* Fix a crash where the wrong slot is used when processing sharded pubsub unsubscribe events  (#2137)
* Fix a crash when a module attempts to write auxiliary data with AOF enabled  (#2132)
* Fix a bug where the engine may crash when establishing new outbound TLS connections (#2140)
* Fix a bug where a cluster bus packet may be incorrectly marked as invalid (#2144)
* Fix a bug where CLUSTER SLOTS/NODES information can be stale after updating node port/tls-port (#2186)
* Fix a bug where replica in cluster mode can't finish failover when config epoch is outdated (#2178)
* Fix a bug to avoid CLIENT UNBLOCK command to unblock paused clients (#2117)

Security fixes
==============
* CVE-2025-27151 Check length of AOF file name in valkey-check-aof (#2146)
  
================================================================================
Valkey 8.1.1  -  Released Wed 23 Apr 2025
================================================================================

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

Bug fixes
=========
* Fix the build on less common platforms in zmalloc.c (#1922)
* fix: add samples to stream object consumer trees (#1825)
* Fix crash during TLS handshake with I/O threads (#1955)
* Fix cluster slot stats assertion during promotion of replica (#1950)
* Fix panic in primary when blocking shutdown after previous block with timeout (#1948)
* Ignore stale gossip packets that arrive out of order (#1777)
* Fix incorrect lag reported in XINFO GROUPS (#1952)
* Fix engine crash on module client blocking during keyspace events (#1819)
* Avoid shard id update of replica if not matching with primary shard id (#573)
* Only enable defrag for vendored jemalloc (#1985)
* Allow scripts to support null characters again (#1984)

Security fixes
==============
* CVE-2025-21605 Limit output buffer for unauthenticated clients (#1994)

================================================================================
Valkey 8.1.0 GA  -  Released Mon 31 March 2025
================================================================================
Upgrade urgency LOW: This is the first release of Valkey 8.1, 
a minor version update designed to further enhance performance, reliability, observability and usability
over Valkey 8.0 for all Valkey installations. This release is fully compatible with all previous Valkey releases 
as well as Redis OSS 7.2.4.

Behavior Changes
================
* Hide input buffer data from being logged on protocol error when hide-user-data-from-log is enabled (#1889)

Bug fixes
=========
* Fix a bug in VM_GetCurrentUserName which leads to engine crash when no valid username provided (#1885)

================================================================================
Valkey 8.1.0 RC2  -  Released Thu 20 March 2025
================================================================================
Upgrade urgency LOW: This is the second release candidate of Valkey 8.1, with several bug fixes, 
control on manual-failover timeout and expended module API to reduce module executed commands overhead.

Performance/Efficiency Improvements - Core
==========================================
* Optimize bitcount command by using x86 SIMD instructions (#1741)
* Embed hash value in hash data type entries to reduce memory footprint (#1579)

Cluster modifications
====================
* Add cluster-manual-failover-timeout configuration to control the timeout for manual failover (#1690)
* Improve error message reporting when invalid port is provided for cluster meet command. (#1686)
* broadcast epoch ASAP when configEpoch changed (#1813)

Module Improvements
===================
* Add new module API flag to bypass command validation in order to reduce processing overhead (#1357)

Behavior Changes
================
* Enable TCP_NODELAY for engine initiated cluster and replication connections (#1763)

Bug Fixes
=========
* Fix `ACL LOAD` crash on a connected replica node (#1842)
* Fix bug where no tracking-redir-broken is issued when the redirect client is in the process of getting closed. (#1823)
* Fix replica sometimes disconnecting when replication is using TLS. (#1737)
* Fix file descriptor leak when aborting dual channel replication due to error (#1721)
* Fix rax crash when using keys larger than 512MB (#1722)
* Fix RANDOMKEY command leading to infinite loop during when all CLIENT are PAUSED and all keys are with expiry (#1850)
* Removing unicode optimization in Lua cjson library to avoid OOM when very large strings are used. (#1785)
* Fix update large-reply in COMMANDLOG when reply is deferred (#1760)
* Avoid setting TCP/TLS specific options for UNIX Domain Socket connections (#1706)
* Fix a bug in the valkey-cli which would incorrectly render commands with text output in multi/exec (#1782)


Build and Packaging changes
=================================
* Check both arm64 and aarch64 for ARM based system architecture during CMake builds (#1829)
* Cleanup lua object files on make distclean (#1812)
* Fixed build error with CMake when using clang v19 (#1806)

================================================================================
Valkey 8.1.0 RC1  -  Released Thu 11 Feb 2025
================================================================================
Upgrade urgency LOW: This is the first release candidate of Valkey 8.1, with
performance improvements, extended observability and cluster improvements and different bug fixes. 
It includes a new implementation of the Valkey dictionary which is more memory and cache efficient, 
better performance for encryption in transit, reduced replication overhead by offloading work to I/O threads,
faster failover support in cluster mode, major improvements to the active defrag process to reduce the impact on command processing,
different API changes for improved usability and ability to track large requests and replies. 
Valkey now supports new new check-and-set feature for native STRINGs.

API and Interface changes
=========================
* Introduce cancel argument to bgsave command (#757)
* Add conditional update support to the `SET` command using `IFEQ` argument (#1324)
* Add more filters to `CLIENT LIST` (#1401)
* Add `availability_zone` to the HELLO response (#1487)

Observability and Monitoring changes
====================================
* Extend `LATENCY LATEST` to add sum / cnt stats (#1570)
* Add `paused_actions` and `paused_timeout_milliseconds` for `INFO CLIENTS` (#1519)
* Add paused_reason to `INFO CLIENTS` (#1564)
* Added `COMMANDLOG` to record slow executions and large requests/replies (#1294)
* Fix cluster info sent stats for message with light header (#1563)
* Add latency stats around cluster config file operations (#1534)
* Add new flag in `CLIENT LIST` for import-source client (#1398)
* Show client capabilities in `CLIENT LIST` / `CLIENT INFO` (#1698)

Performance/Efficiency Improvements - Core
==========================================
* Introduce a new memory efficient hash table to store keys (#1186)
* Accelerate hash table iterator with prefetching (#1501)
* Accelerate hash table iterator with value prefetching (#1568)
* Replace dict with new hashtable: hash datatype (#1502)
* Replace dict with new hashtable for sets datatype (#1176)
* Replace dict with new hashtable: sorted set datatype (#1427)
* Free strings during BGSAVE/BGAOFRW to reduce copy-on-write (#905)
* Create an empty lua table with specified initial capacity as much as possible (#1092)
* Move prepareClientToWrite out of loop for HGETALL command (#1119)
* Improved hashing algorithm for Lua tables (#1168)
* Replace dict with new hashtable for sets datatype (#1176)
* Do security attack check only when command not found to reduce the critical path. (#1212)
* Trim free space from inline command argument strings to avoid excess memory usage (#1213)
* Increase the max number of io threads to 256. (#1220)
* Refactor of ActiveDefrag to reduce latencies (#1242)
* Integrate fast_float to optionally replace strtod (#1260)
* Improvements for TLS with I/O threads (#1271)
* Optimize PFCOUNT, PFMERGE command by SIMD acceleration (#1293)
* Optimize sdscatrepr by batch processing printable characters (#1342)
* Optimize ZRANK to avoid path comparisons (#1389)
* Move clientCron onto a separate timer (#1387)
* Client struct: lazy init components and optimize struct layout (#1405)
* Offload reading the replication stream to IO threads (#1449)
* Skip CRC checksumming during diskless full sync with TLS enabled. (#1479)

New/Modified configurations
===========================
* Deprecate `io-threads-do-reads`, which has no effect since io threads will now always do reads. (#1138)
* Introduce `import-mode` config to avoid expiration and eviction during data syncing (#1185)
* Introduce new `rdb-version-check` config which allows for relaxed RDB version verification (#1604)
* Deprecate `dynamic-hz`, since server cron jobs are handled dynamically by default (#1387) 
* Introduce `log-format` and `log-timestamp-format` to control the log format (#1022)
* Introducing `active-defrag-cycle-us` for more fine-grinned control of memory defragmentation run time (#1242) 
* Introduce new configurations to control the new `COMMANDLOG` reporting thresholds (#1294)

Build and Packaging changes
=================================
* Introduce CMake build system for valkey (#1196)
* RDMA builtin support (#1209)
* Fix Valkey binary build workflow, version support changes. (#1429)
* Remove Valkey specific changes in jemalloc source code (#1266)

Module Improvements
===================
* Add API UpdateRuntimeArgs for updating the module arguments during runtime (#1041)
* Add support for MustObeyClient Module API (#1582)
* Adds support for scripting engines as Valkey modules (#1277, #1497)

Cluster improvements
====================
* Do election in order based on failed primary rank to avoid voting conflicts (#1018)
* Make replica `CLUSTER RESET` flush async based on `lazyfree-lazy-user-flush` (#1190)
* Trigger the election as soon as possible when doing a forced manual failover (#1067)
* Make manual failover reset the on-going election to promote failover (#1274)
* Broadcast a PONG to all node in cluster when role changed (#1295)
* Manual failover vote is not limited by two times the node timeout (#1305)
* Automatic failover vote is not limited by two times the node timeout (#1356)

Behavior Changes
================
* Streams use an additional 8 bytes to track their internal size (#688)
* Take hz into account in activerehashing to avoid CPU spikes (#977)
* Incr `expired_keys` if the expiration time is already expired (#1517)
* Fix replica not able to initiate election in time when epoch fails (#1009)
* Make `FUNCTION RESTORE FLUSH` flush async based on `lazyfree-lazy-user-flush` (#1254)
* Allow `MEMORY MALLOC-STATS` and `MEMORY PURGE` during loading phase (#1317)
* Use `DEEPBIND` flag when loading external modules in order to avoid symbol conflicts (#1703)


Logging and Tooling Improvements
================================
* Remove the restriction that cli --cluster create requires at least 3 primary nodes (#1075)
* Add short client info log to CLUSTER MEET / FORGET / RESET commands (#1249)
* Support for reading from replicas in valkey-benchmark (#1392)
* valkey-cli will now re-select previously selected database after reconnect (#1694)
* valkey-cli will now auto-exit from subscribed mode when there are no more active subscriptions (#1432)

Bug Fixes
=========
* Mark the node as FAIL when the node is marked as NOADDR and broadcast the FAIL (#1191)
* [Bug Fix] Optimize RDB Load Performance and Fix Cluster Mode Resizing (#1199)
* Log as primary role (M) instead of child process (C) during startup (#1282)
* Fix empty primary may have dirty slots data due to bad migration (#1285)
* RDMA: Fix dead loop when transfer large data (20KB) (#1386)

We appreciate the efforts of all who contributed code to this release!


Alan Scherger (flyinprogrammer), Amit Nagler (naglera), Anastasia Alexandrova (nastena1606), Basel Naamna (xbasel), Ben Totten (bentotten), Benson-li (li-benson), 
Binbin (enjoy-binbin), Bogdan Petre (bogdanp05), chzhoo, Caiyi Wu (Codebells), Danish Mehmood (danish-mehmood), Eran Ifrah (eifrah-aws), Guillaume Koenig (knggk), 
Harkrishn Patro (hpatro), Jacob Murphy (murphyjacob4), jeon1226, Jim Brunner (JimB123), Josef Šimánek (simi), Jungwoo Song (bluayer), Karthick Ariyaratnam (karthyuom), 
Karthik Subbarao (KarthikSubbarao), kronwerk, Lipeng Zhu (lipzhu), Madelyn Olson (madolson), Marek Zoremba (zori-janea), Masahiro Ide (imasahiro), Meinhard Zhou (MeinhardZhou), Melroy van den Berg (melroy89), Mikhail Koviazin (mkmkme), Nadav Gigi (NadavGigi), Nadav Levanoni (nadav-levanoni), Nikhil Manglore (Nikhil-Manglore), Parth Patel (parthpatel), Pierre (pieturin), Ping Xie (PingXie), Qu Chen (QuChen88), Rain Valentine (SoftlyRaining), Ray Cao (RayaCoo), Ran Shidlansik (ranshid), Ray Cao (RayaCoo), Ricardo Dias (rjd15372), Romain Geissler (Romain-Geissler-1A), Roman Gershman (romange), Roshan Khatri (roshkhatri), Rueian (rueian), Sarthak Aggarwal (sarthakaggarwal97), Seungmin Lee (sungming2), 
Shai Zarka (zarkash-aws), Shivshankar (Shivshankar-Reddy), Simon Baatz (gmbnomis), Sinkevich Artem (ArtSin), Stav Ben-Tov (stav-bentov), Stefan Mueller (muelstefamzn), secwall, 
Tal Shachar (talxsha), Thalia Archibald (thaliaarchi), Uri Yagelnik (uriyage), Vadym Khoptynets (poiuj), Vanessa Tang (YueTang-Vanessa), Viktor Söderqvist (zuiderkwast), Viktor Szépe (szepeviktor), VoletiRam, 
Vu Diep (vudiep411), Wen Hui (hwware), WelongZuo, Yanqi Lv (lyq2333), Yury Fridlyand (Yury-Fridlyand), Zvi Schneider (zvi-code), bodong.ybd (yangbodong22011), chx9 (chx9), otheng (otheng03), skyfirelee (artikell), Shawn Wang (xingbowang), Xuyang WANG (Nugine), zhaozhao.zz (soloestoy), zhenwei pi (pizhenwei), zixuan zhao (azuredream), 烈香 (hengyoush), 
风去幽墨 (fengquyoumo)
