What's New

v1.3.0

Release Date: October 2026

Key Features

Per-user isolation on the server: Every Valkey client, cluster topology, and metrics collector now belongs to an owner: one Valkey identity on one Valkey deployment. Users who connect as different Valkey users, or as the same user to different servers, share nothing. Commands always run as your own Valkey user, and the metrics you see were collected with your credentials against your server. Valkey checks the credentials on every connect, against the node you named, and the server reaches only that identity’s state on that node. In Kubernetes, where sidecars collect under one set of credentials, the collector-backed features show a message instead of data from another user. See Users and Valkey identities. (#581, #585)

Hot Slots heatmap: The Hot Keys heatmap gains a Slots tab in hot-slots mode. Keys are grouped by hash slot, each slot is a tile colored by activity, and clicking a slot lists its keys with size, TTL and owning node. Clicking a key opens it in the Key Browser. The modal reports when some nodes failed to report. (#503)

Longer CPU and memory history: The fixed 1H / 6H / 12H buttons are replaced by a Last [number] [Hours / Days] picker, up to 30 days. Default retention is unchanged (about a day per node); Keeping more history explains how to raise it. (#554)

Changed Defaults

Review these before upgrading. See the server configuration reference for details.

Setting	v1.2.0	v1.3.0	What to do
WebSocket Host check in Web mode with no VALKEY_ADMIN_ALLOWED_WS_ORIGINS	Any Host whose Origin matched	Host must be localhost, a *.localhost name, or an IP address; other names are refused with 403	If users open the UI through a DNS name (Ingress, reverse proxy, LAN hostname), set VALKEY_ADMIN_ALLOWED_WS_ORIGINS to that origin. The server log prints the exact value. kubectl port-forward and docker run -p 127.0.0.1:8080:8080 are unaffected. VALKEY_ADMIN_ALLOW_ANY_HOST=true (new) turns the check off, with a startup warning (#585)
VALKEY_ADMIN_ALLOWED_WS_ORIGINS when set in Web mode	Listed origins plus same-origin	Listed origins only	Add the origin users load the UI from to the list (#551)
gcp-iam without VALKEY_CA_CERT_PATH	Token sent to any host with a publicly trusted certificate	Refused	Point VALKEY_CA_CERT_PATH at the Memorystore server CA. Memorystore’s per-instance and shared CA modes already require the file (#585)
iam (ElastiCache) without TLS or with verification off	Token sent	Refused	Enable TLS and keep verification on. ElastiCache requires TLS for IAM, so working setups are unaffected (#585)
caCertPath in a WebSocket connection request	Overrode VALKEY_CA_CERT_PATH	Ignored	Nothing for UI users; the UI never sent it. Raw WebSocket clients must rely on VALKEY_CA_CERT_PATH (#585)
Collector data directories	${DATA_DIR}/<nodeId>	${DATA_DIR}/<owner>/<nodeId>, where <owner> encodes the Valkey identity and the host and port	Dashboard history and changed collector settings start empty after the upgrade. Delete the old directories when you no longer need them (#581, #585)
Send Command	Allowed SELECT, AUTH, HELLO, RESET, QUIT	Blocked	Use the connection’s database setting instead of SELECT. The other four changed the shared connection’s state for every user (#534)

Upgrade Notes

• The preconfigured connection and the metrics collectors are one owner. A user joins the owner configured through VALKEY_HOST, VALKEY_PORT, VALKEY_USERNAME and VALKEY_PASSWORD, and sees its collectors and history, by connecting as that identity to VALKEY_HOST and VALKEY_PORT spelled as configured. The same node typed as an IP or an alias is a separate owner with its own collectors. See Users and Valkey identities (#585)
• Cluster owners are matched by announced addresses. A second node of a cluster shares the first connection’s owner only if the cluster announces the first node’s address. Connecting the first node by a Kubernetes service name or a hostname alias gives each node you then connect from the topology view its own collectors. Connect through the cluster endpoint form, or by an announced address, to share them. See Known Limitations (#585)
• Host names are normalized. Hosts are case-insensitive and lose a trailing dot; the port must be a plain number with no leading zeros. Saved connections are renamed on load. If two saved connections now spell the same host, the one already saved under the new spelling is kept and the other keeps its old name for you to edit or delete (#585)
• Kubernetes: collector-backed features (dashboard history, hot keys, big keys, command logs, Monitor, collector settings) are not available in this release, because sidecars collect under one set of credentials that cannot be scoped to the user. See Kubernetes deployment (#581)
• Desktop app without an OS keyring: passwords saved unencrypted by builds before 1.2.0 are removed on startup. Affected connections prompt for the password on next use (#555)

Improvements

• Send Command shows how long each command took, next to the response and in the history list (#553)
• The Cluster Topology view keeps node roles in sync after a failover, and counts memory toward utilization only for nodes with maxmemory set; nodes without it show ∞ capacity (#515)
• The MONITOR dialog shows the Cluster Slot Stats setup commands inline instead of in a tooltip (#583)
• Failed authentication attempts are limited per node and Valkey identity, so the server cannot be used to guess passwords. The limit key uses the normalized host and port, so different spellings of one endpoint share a budget (#581, #585)
• A new troubleshooting page entry explains each of the new connection refusals (#585)
• Local development: tools/build_run_all.sh starts an LFU cluster, a default cluster and a standalone node, all with RedisJSON and seed data (#584)

Fixes

• A user who authenticated as a Valkey username against their own server could reach another user’s connections to a different server under the same username, and a fake cluster node could overwrite a real cluster’s node list and stored password. Server state is now keyed by Valkey user and deployment, the server checks that the connection id names the host the credentials were proven against, and a cluster node joins an existing owner only when both sides’ topologies agree (#585)
• The server’s GCP access token (cloud-platform scope) and ElastiCache IAM connect token could be sent to any host a client named. IAM credentials now travel only over TLS with verification, gcp-iam requires the operator’s CA file so the token reaches only the Memorystore instance, and a client-supplied caCertPath no longer replaces the server’s trust roots (#585)
• DNS rebinding could give a remote web page the WebSocket API of a local Web-mode server (Docker on loopback, kubectl port-forward). The upgrade now requires a local Host header when no origins allowlist is set (#585)
• A retried cluster connection leaked the replaced cluster client and, with gcp-iam, its token-refresh timer (#585)
• CPU chart values were 100× too small; the collector now reports percent of one core, matching Cluster Topology (#582)
• Dashboard Total Memory showed host RAM when maxmemory was 0; it now shows ∞ (#582)
• The MONITOR “Running for” timer could show a negative value right after starting (#582)
• UI-initiated connects and discovery fell back to VALKEY_CA_CERT_PATH for private-CA TLS (#535)
• The integration test stack’s cluster initializer waited for the wrong node names after the dev-tooling rename, so Integration CI failed on release branches (#587)

Contributors

@ravjotbrar, @ArgusLi, @nassery318, @tkesgar

Full Changelog: v1.2.0…v1.3.0

Release: GitHub Releases

Container Images:

• Docker Hub: docker pull valkey/valkey-admin:1.3.0
• GHCR: docker pull ghcr.io/valkey-io/valkey-admin:1.3.0
• ECR Public: docker pull public.ecr.aws/valkey/valkey-admin:1.3.0

---

v1.2.0

Release Date: September 2026

Key Features

Cluster Topology Utilization View: The Cluster Topology page now shows load as well as layout. Summary cards show total nodes, cluster memory (used / limit), total ops/sec, cluster hit ratio, and flagged nodes. The node table groups replicas under their primary and shows each primary’s memory against maxmemory (or host RAM when maxmemory is unset), main-thread CPU, ops/sec, hit ratio, and connected clients. Each primary gets a Low, Normal, or High badge, and High primaries (memory ≥ 90% or CPU ≥ 85%) are highlighted. You can filter nodes by role or utilization level, and the view refreshes every 5 seconds while open. (#486)

Safer Defaults: The web server, and the metrics collectors it spawns, now listen on loopback unless you opt in. Collectors must authenticate to register, and TLS connections configured through environment variables verify certificates. The desktop app protects its local connection with a per-launch token. Some of these change behavior on upgrade, so review Changed Defaults and Upgrade Notes below. (#490, #494, #504, #516, #521)

Changed Defaults

Review these before upgrading. See the server and metrics configuration references for details.

Setting	v1.1.1	v1.2.0	What to do
Server bind address (SERVER_BIND_HOST, new)	All interfaces (desktop app: 127.0.0.1)	127.0.0.1. Kubernetes mode (DEPLOYMENT_MODE=K8) and the Docker image use 0.0.0.0	If you run the server directly on a host or VM and open it from another machine, set SERVER_BIND_HOST=0.0.0.0. Web mode has no built-in authentication, so expose it only behind access controls (#521)
TLS certificate verification for connections configured through environment variables (VALKEY_VERIFY_CERT)	Off unless "true"	On unless "false"	Connections to servers with self-signed or private-CA certificates fail until you set VALKEY_VERIFY_CERT=false (#490)
Bind address of metrics collectors spawned by the server (METRICS_BIND_HOST)	0.0.0.0	127.0.0.1. Kubernetes sidecars keep 0.0.0.0	Nothing, unless something reached a spawned collector from another host (#494)
Rate limit on /orchestrator/* (ORCHESTRATOR_RATE_LIMIT_MAX, new)	None	600 requests per minute per source address	All collectors the server spawns (one per primary or standalone node) share one loopback budget at about 6 requests per minute each. Raise the limit when you monitor close to 100 primaries at once. The symptom is Register failed: 429 in collector logs (#504)
Collector signature age limit (ORCHESTRATOR_AUTH_WINDOW_MS, new)	None (collector requests were not authenticated)	60 seconds	Raise it only if collector and server clocks drift apart by more than that (#504)
Collector client mode (VALKEY_MODE, valkey.mode)	cluster created a cluster client	Ignored, with a warning	Remove the setting. Each collector samples one node, so it always uses a node-local client (#528)

Upgrade Notes

• Kubernetes collector key: Metrics sidecars now sign their register and ping requests. Create the valkey-admin-orchestrator-key Secret and expose it as ORCHESTRATOR_KEY on the app Deployment and every sidecar; sidecars exit at startup without it. Web, Docker, and desktop generate collector keys automatically. See the Kubernetes guide (#504, #512)
• Collector config: Epics in config.yml are identified by name only. type and file_prefix are no longer read, and an epic with an unrecognized name is skipped. The shipped epic names are unchanged. POST /update-config now takes { "epics": { "<name>": { ... } } } and rejects unknown fields and out-of-range values (#501)
• Desktop app without an OS keyring: Passwords are no longer saved when the system has no secure store (previously they were saved in cleartext). You are prompted for the password each session (#522)

Improvements

• Key Browser search matches anywhere in a key name (user searches *user*). Input containing *, ?, [, or ] is used as a pattern exactly as typed (#479)

• Editing a string value keeps its existing TTL (#488)

• Adding a String or JSON key that already exists fails with an error instead of overwriting it (#520)

• Binary string values are detected and can’t be edited as text (#520)

• Big Keys has a Scan button, Hot Keys has a Start Monitor button in its toolbar, and cluster connections have an Open button (#481)

• Connection port is validated (1–65535) with an inline error (#489)

• Unknown routes show a Not Found page instead of a blank screen (#487)

• A TTL of -1 shows “No expiry”, and hit ratio shows “-” when there have been no hits or misses (#531)

• The WebSocket URL includes the page path, so it connects through reverse proxies that serve Valkey Admin under a path prefix (#471)

• Upgraded Valkey GLIDE to 2.5.2. Valkey Admin connections report a lib-name such as GlideJS(valkey-admin-web:1.2.0) in CLIENT LIST (#506)

Fixes

• Require a per-launch token for the desktop app’s WebSocket handshake, so web pages can’t connect to its local backend (#516)
• Never store a cleartext password when no OS keystore is available (#522)
• Default the server bind to loopback (#521), and default TLS certificate verification to on for env-configured connections (#490)
• Authenticate /orchestrator/register and /orchestrator/ping with HMAC-signed requests, bind spawned collectors to loopback, and accept only loopback metrics URIs outside Kubernetes (#494, #504)
• Scope Valkey client reuse, connection retry, and cluster topology broadcasts to the owning session (#496, #499, #500)
• Validate POST /update-config against a strict schema with field bounds (#501)
• Fix quoted command names bypassing Send Command’s blocked-command check, and replace the regex parser to remove a ReDoS (#472)
• Parse cluster INFO into null-prototype objects (#493)
• Update nanoid, express, body-parser, and qs (#493, #526)
• Attach provenance and SBOM attestations to Docker images (#521)
• Pin GitHub Actions to commit SHAs, and replace the labeler’s pull_request_target trigger with a pull_request + workflow_run split (#491, #492)
• Fix Kubernetes metrics sidecars being rejected at registration (regressed in v1.1.0) (#512)
• Fix Cluster Topology not picking up topology changes. The server now re-discovers each cluster every 30 seconds (TOPOLOGY_REFRESH_INTERVAL) (#512)
• Fix hot keys being attributed to the wrong node on Kubernetes (#528)
• Kubernetes examples seed discovery from the headless Service and wait for the cluster to form before starting the app (#528)
• Fix shutdown clearing cluster and metrics state before cleanup ran, and drain WebSockets before closing Valkey clients (#469)
• Reduce log noise from JSON module detection, binary string values, and early metrics requests (#520)

Contributors

@ravjotbrar, @ArgusLi, @nassery318, @tkesgar

Full Changelog: v1.1.1…v1.2.0

Release: GitHub Releases

Container Images:

• Docker Hub: docker pull valkey/valkey-admin:1.2.0
• GHCR: docker pull ghcr.io/valkey-io/valkey-admin:1.2.0
• ECR Public: docker pull public.ecr.aws/valkey/valkey-admin:1.2.0

---

v1.1.1

Release Date: August 2026

Performance

• Pipeline per-key commands (MEMORY USAGE, TYPE, TTL) in Big Keys scan for 20x throughput improvement on large clusters (#451)

Security

• Bind server to localhost in Electron mode to prevent LAN access (#466)
• Update vulnerable dependencies (ip-address, nanoid, js-yaml, postcss) and run containers as non-root (#467)

Full Changelog: v1.1.0…v1.1.1

---

v1.1.0

Release Date: July 2026

Key Features

Big Keys Analysis: Scan your keyspace to identify the largest keys by memory usage. Configurable scan limit and top N, with per-key access frequency via OBJECT FREQ when an LFU eviction policy is configured. Results show key name, size, type, TTL, owning node (cluster mode), and access frequency. (#376, #378, #383, #390)

Command Autocomplete: The Send Command interface now provides autocomplete suggestions from a built-in list of Valkey commands with full subcommand support (396 total entries including subcommands like CLUSTER SHARDS, COMMANDLOG GET, CLIENT TRACKING, etc.). (#361, #362, #415)

Numbered Database Support: Connect to specific logical databases (db 0–15) via a database dropdown in the connection modal. Each (host, port, db) combination opens an independent client. Cluster mode supports multiple databases on Valkey 9.0+. (#366, #368)

Persist State Across Refresh: Page refreshes no longer kick users back to the connection page. The application auto-reconnects and navigates back to the previous view. Command history also persists across refreshes. (#389, #393)

Cluster Config Retry: Configuration updates fan out to all cluster nodes with automatic per-node retry and Fibonacci backoff. Live per-node status is streamed to the UI so operators can see which nodes are updating, retrying, or failed. (#391)

Large Cluster Reliability: Fixed intermittent “No primary node found” errors when connecting to clusters with 50+ nodes by upgrading to Valkey GLIDE 2.4 with NodeDiscoveryMode.STATIC. (#371, #359)

Improvements

• Preconfigured standalone connections — VALKEY_HOST/VALKEY_PORT now auto-detect standalone vs cluster (#379)
• Key Browser uses pagination for all collection types (hash, list, set, sorted set) (#364)
• Dangerous commands are blocked or require confirmation before execution (#358)
• Command parsing correctly handles quoted keys and escaped characters (#381)
• Binary values display as hex (\x80\x00\x88) with printable ASCII shown as-is (#381)
• Monitor and Command Log errors now surface in the Activity view instead of failing silently (#373)
• Homebrew cask install available for macOS: brew install --cask valkey-admin (#380)
• KEY_VALUE_SIZE_LIMIT_BYTES configurable via environment variable (#370)
• Upgraded Valkey GLIDE client to 2.4.0 (#359)

Security

• Enforce session-based connection authorization in WebSocket dispatch loop (#411)
• Fix Electron CSP blocking WebSocket connections (#410)
• Update vulnerable dependencies (#412)
• Upgrade react-router to 8.3.0 (#420)
• Add explicit permissions to CI workflows

Bug Fixes

• Fix metrics server not starting for cluster connections in Electron mode (#388)
• Fix NodeErrorsBanner showing incorrect label across Activity tabs (#388)
• Fix upgrade-insecure-requests breaking non-localhost HTTP deployments (#385)
• Fix number input spinners snapping to unexpected values (#421)
• Fix session authorization rejecting db-stripped node IDs (#419)
• Fix hot keys returning empty on first MONITOR cycle (#434)
• Fix monitor stop failing when metrics server crashes (#431)
• Fix closeMetricsServer sending wrong ID to metrics process (#428)
• Make search case-insensitive in Send Command view (#426)

Contributors

@ravjotbrar, @ArgusLi, @nassery318, @dbaker-arch, @michaelstingl, @antonin-suzor

Full Changelog: v1.0.1…v1.1.0

Release: GitHub Releases

Container Images:

• Docker Hub: docker pull valkey/valkey-admin:1.1.0
• GHCR: docker pull ghcr.io/valkey-io/valkey-admin:1.1.0
• ECR Public: docker pull public.ecr.aws/valkey/valkey-admin:1.1.0

---

v1.0.1

Release Date: June 2026

Initial stable release with dashboard, key browser, send command, cluster topology, hot keys monitoring, and command logs.