Add release notes entry for Valkey 9.0.5

[valkeyrie-ops]

Note

Opened ready despite 3 flagged items (force_ready was set): notes flagged low-confidence; AI triaged PRs without release-notes (confirm include/exclude); notes credited to a backport. Review the sections below and confirm before merging.

Cuts 9.0.5 onto release line 9.0.

• Promotes the release notes into a dated section, bumps src/version.h, and refreshes the running contributor list.
• Release notes computed over the range below (9.0.4..5166f21f4f7ceb65d53d1e5c7506bae15b370e6e):

mode: ga
source_ref: 9.0
target_branch: 9.0
base: 9.0.4 @ 1cbee84ba69b
head: 5166f21f4f7ceb65d53d1e5c7506bae15b370e6e @ 5166f21f4f7c

⚠️ Notes to double-check

The generator flagged these notes low-confidence; confirm category and wording before merging:

PR	Category	Why flagged
#3359	Observability and Logging	could be Bug Fixes
#3306	Bug Fixes	could be Observability and Logging
#3847	Configuration	could be Cluster and Replication
#3848	Configuration	could be Cluster and Replication
#3942	Bug Fixes	log-only impact; could be Observability and Logging

Release-impact review

Code detected release-impact terms (availability, memory safety, data integrity, access control, protocol, compatibility) in these PRs; this forces review, it is not a severity classification.

The requested urgency is SECURITY. Confirm it and decide whether any change needs a hand-authored Security Fixes entry:

29 PR(s) with impact signals

PR	Title	Signal
#3878	fix: Use memory_order_release to prevent store re-ordering.	server crash, assertion, or availability failure
#3950	Fix crash when active field-expiry leaves a single-entry HT vset bucket	server crash, assertion, or availability failure
#3283	cluster: fix use-after-free in generateSyncSlotsEstablishCommand	memory-safety risk
#3443	Fix slot-migration-max-failover-repl-bytes unable to accept -1	server crash, assertion, or availability failure
#3516	Fix HPERSIST RESP protocol violation on wrong-type key	wire-protocol or reply correctness
#3458	Fix race condition during async client freeing with IO threading enabled	server crash, assertion, or availability failure
#3498	Fix double free in stream consumer PEL loading with corrupt RDB data	memory-safety risk
#3554	Ensure client slot migration pointer is cleared during reset	server crash, assertion, or availability failure
#3596	Fix: prevent NULL dereference crash in connectSlotExportJob when target node disappears	server crash, assertion, or availability failure
#3591	Handle NULL pointer in streamTrim listpack delta calculation	server crash, assertion, or availability failure
#3610	Fix SIGSEGV in VM_GetLRU/SetLRU/GetLFU/SetLFU on NULL key	server crash, assertion, or availability failure
#3448	Fixes server crash when RDMA benchmark clients disconnect	memory-safety risk
#3743	Fix buffered_reply assert in HFE commands with module keyspace notifications	server crash, assertion, or availability failure
#3800	Fix heap-use-after-free in ACL LOAD when client free is deferred	memory-safety risk
#3723	Fix double-finish and RESP reply violation in cluster slot migration	wire-protocol or reply correctness
#3846	Fix use-after-free in VM_RegisterClusterMessageReceiver	memory-safety risk
#3847	Harden SENTINEL commands and config rewrite against control-character injection	security, access-control, or injection hardening
#3848	Fix cluster AUX-field control-character and delimiter injection	data or persisted-state corruption risk
#3941	Avoid random() % 0 undefined behaviour when cluster-node-timeout < 30	undefined behavior or unsafe arithmetic
#3920	Reject integer overflow of length fields in zipmapValidateIntegrity	memory-safety risk
#3921	Reject NAN scores in listpack/ziplist-encoded sorted sets on RDB load	server crash, assertion, or availability failure
#3939	Fix RESP3 type violation in addReplyCommandSubCommands	wire-protocol or reply correctness
#3811	Fix off_t to int truncation in bio repl transfer size reporting	undefined behavior or unsafe arithmetic
#4047	Fix HRANDFIELD CASE 4 infinite loop when valid fields fewer than count	server crash, assertion, or availability failure
#4073	fix: Reject corrupt stream RDB with shared NACK across consumers	memory-safety risk
#4068	Fix sentinel failover coordinated segfault when old leader's client is disconnected	server crash, assertion, or availability failure
#3787	Fix "time_t' different typedef on 32-bit /64-bit systems	server crash, assertion, or availability failure
#4060	Fix io_last_written bookmark desync that corrupts replies with IO threads	data or persisted-state corruption risk
#4234	Fix use-after-free in tlsProcessPendingData() on CLIENT KILL	memory-safety risk

Excluded from generated notes (listed under Security Fixes)

#4073, #4234 were supplied as a --security-fix, so the generated bullet(s) in the normal categories were dropped to avoid double-listing. To keep the notes consistent, they appear only under Security Fixes, where each is reviewed as a factual security entry.

AI-triaged into the notes

These PRs had no release-notes label but were noted in the dated section; remove any note that does not belong before merging.

27 PR(s) triaged in

PR	Title	Why included
#3878	fix: Use memory_order_release to prevent store re-ordering.	Fixes IO-thread job queue assertion/crash on weakly-ordered ARM/aarch64 caused by relaxed atomic store reordering
#3950	Fix crash when active field-expiry leaves a single-entry HT vset bucket	Fixes server assertion crash when active hash field expiry leaves a single-entry hashtable bucket, later tripped by HDEL/HSETEX
#3281	Fix use zfree in cli --eval path	Fixes valkey-cli crash (invalid free) in --eval mode on jemalloc/tcmalloc builds
#3541	Fix FD leak in connSocketBlockingConnect on timeout	Fixes file descriptor leak in blocking connect timeout path (e.g. MIGRATE to unreachable host), including TLS
#3554	Ensure client slot migration pointer is cleared during reset	Fixes dangling slot-migration job pointer on client reset that could crash the server
#3503	Fix remove cached eval scripts on engine unregister	Fixes dangling engine pointers and stale memory accounting in eval script cache when a scripting engine is unregistered
#3568	Fix GEOSEARCH BYPOLYGON leak on invalid COUNT	Fixes memory leak of GEOSEARCH BYPOLYGON points on invalid COUNT and other error paths
#3586	fix(cluster): Remove per-call srand in clusterManagerNodePrimaryRandom	Fixes valkey-cli cluster manager assigning all uncovered slots to the same primary due to per-call srand reseeding
#3596	Fix: prevent NULL dereference crash in connectSlotExportJob when target node disappears	Fixes NULL dereference crash in slot migration when target node disappears (e.g. CLUSTER FORGET race)
#3610	Fix SIGSEGV in VM_GetLRU/SetLRU/GetLFU/SetLFU on NULL key	Fixes SIGSEGV in module API VM_GetLRU/SetLRU/GetLFU/SetLFU when passed a NULL key
#3743	Fix buffered_reply assert in HFE commands with module keyspace notifications	Fixes server assertion in HEXPIRE/HGETDEL/HPERSIST family when a module blocks the client in a keyspace notification callback
#3723	Fix double-finish and RESP reply violation in cluster slot migration	Fixes double-finish of slot migration job on ownership change and a RESP reply-ordering violation in CLUSTER SYNCSLOTS FINISH
#3847	Harden SENTINEL commands and config rewrite against control-character injection	⚠️ Security hardening: rejects control characters in SENTINEL SET values and escapes config rewrite to prevent config injection
#3848	Fix cluster AUX-field control-character and delimiter injection	⚠️ Security hardening: rejects control characters and delimiters in cluster AUX fields and validates cluster-announce-ip to prevent nodes.conf corruption/injection
#3942	Fix shard_id format specifier in UPDATE message log	Fixes log message reading past non-NUL-terminated shard_id buffer (out-of-bounds read, garbled operator log output)
#3941	Avoid random() % 0 undefined behaviour when cluster-node-timeout < 30	Fixes random() % 0 undefined behavior in failover delay when cluster-node-timeout is a legal value below 30
#3920	Reject integer overflow of length fields in zipmapValidateIntegrity	Rejects crafted RESTORE zipmap payloads with integer-overflowing length fields that bypass validation and cause out-of-bounds access on 32-bit builds
#3921	Reject NAN scores in listpack/ziplist-encoded sorted sets on RDB load	Rejects NAN scores in listpack/ziplist sorted sets on RDB/RESTORE load, preventing a later assertion crash on skiplist conversion
#3939	Fix RESP3 type violation in addReplyCommandSubCommands	Fixes RESP3 protocol violation: COMMAND INFO subcommands field emitted as Set instead of Array for commands without subcommands
#3811	Fix off_t to int truncation in bio repl transfer size reporting	Fixes INFO replication reporting negative sync transfer bytes when RDB exceeds 2GB (off_t truncated to int)
#3843	Increase max proctitle length from 255 to 1024	Raises max process title length from 255 to 1024, fixing truncated proctitle for long paths; operator-visible ps output
#4016	Fix build warnings with OpenSSL 4.0	OpenSSL 4.0 compatibility: replaces deprecated cert-validity and subject-name APIs so TLS builds work against new OpenSSL
#4073	fix: Reject corrupt stream RDB with shared NACK across consumers	Rejects corrupt stream RDB/RESTORE payloads with a NACK shared across consumers, preventing use-after-free
#4182	[9.0] Fix lua-enable-insecure-api default value cannot be changed to yes (#3548)	⚠️ Fixes CONFIG SET lua-enable-insecure-api not taking effect, so insecure Lua APIs stayed accessible after being disabled; security-relevant config behavior
#3787	Fix "time_t' different typedef on 32-bit /64-bit systems	Fixes startup/INFO segfault and time_t format mismatches on 32-bit time64 systems (e.g. 32-bit Alpine/musl)
#4060	Fix io_last_written bookmark desync that corrupts replies with IO threads	Fixes reply corruption (dropped leading RESP bytes) with IO threads due to io_last_written bookmark desync
#4234	Fix use-after-free in tlsProcessPendingData() on CLIENT KILL	⚠️ Fixes use-after-free in TLS pending-data processing triggered by CLIENT KILL (was under security embargo, GHSA-53mc-f3m3-99vh)

AI-triaged out of the notes

These PRs are absent from the notes; label a wrongly-dropped one release-notes and re-cut to include it.

19 PR(s) triaged out

PR	Title	Why excluded
#3257	Fix TSAN compatibility for module loading	Only affects thread-sanitizer instrumented builds (dlopen flags, no_sanitize attributes); no behavior change in release builds
#3452	Fix some flaky tests using CLIENT REPLY OFF	Test-only flaky-test fix using CLIENT REPLY OFF; no production code changed
#3461	Attempt to deflake 'diskless no replicas drop during rdb pipe'	Test-only timeout increase to deflake replication test
#3511	Stabilize diskless no-drop replication test	Test-only stabilization of diskless replication test
#3317	Use ar archiver installed by brew in CI build-macos-latest	CI workflow change (macOS build toolchain); no shipped behavior
#3753	Update the datasize to match the automated perfs	CI benchmark configuration change only; no shipped behavior
#3154	Skips the internal clients from logresreq checks	Fix to req/res logging, a compile-flag-gated test/validation facility; targets CI validator failures, no default-build effect
#3851	Replace AUTOMATION_PAT with Valkeyrie Bot GitHub App token	CI workflow token change for release automation; no shipped behavior
#3642	Skip deferred_reply test in req/res log validation	Test-only: skips a module test under req/res log validation
#3164	Fix flake replicas different ranks test	Test-only fix for flaky replica rank assertion
#3261	[DEFLAKE] Deflake replica selection test by relaxing cluster configurations	Test-only deflake of replica selection test (Valgrind timeouts)
#3161	Separate jobs for large memory tests with sanitizers	CI workflow restructuring for sanitizer large-memory test jobs
#3263	Fix OOM aborts in large-memory ASAN tests on GitHub runners	CI and test-only changes to avoid OOM in ASAN large-memory test runs
#3294	[DEFLAKE] Fix flaky block_keyspace_notification pipelining test	Test-only deflake of module keyspace notification pipelining test
#4006	Reduce execution time for replica migration tests	Test-only speedup of replica migration tests
#3770	Add --failures-output flag to test runners for weekly CI compatibility	Test runner/CI infrastructure (--failures-output flag); no shipped behavior
#3404	Fix race condition in diskless swapdb RedisModuleEvent_ReplAsyncLoad tests	Test-only fix for race in module RDB async-load test
#3464	Fix use-after-unload crash in auth module's blocking thread	Fix confined to a test module (tests/modules/auth.c); no shipped server change
#4196	[9.0] Backport 32-bit Alpine CI coverage and fixes	CI job addition and unit-test build fixes for 32-bit musl; the shipped time_t formatting fix is covered by #3787

⚠️ Notes credited to a backport (original PR not recovered)

These notes credit the backport PR, not the change's author; confirm the original PR and correct the credit before merging:

Backport PR	Title
#4182	[9.0] Fix lua-enable-insecure-api default value cannot be changed to yes (#3548)

Generated by valkey-ci-agent. Review before merging into the release line.