docs(redis): release notes v4.1.7

[chideat]

v4.1.7 is a CVE / security patch on the release-4.1 line (tag v4.1.7 → b9e1f591). It rebuilds the operator and its sub-images; the bundled Redis servers move to 5.0.16 / 6.0.22 / 7.2.15.

Changes

File	Change
docs/en/release_notes.mdx	v4.1.7 compatibility row + version section
docs/en/upgrade.mdx	v4.1.7 row, plus backfill of v4.1.6 and v4.1.3
doom.config.yml	mw-redis-v4.1.7-fixed query template

Notes for the reviewer

• The Fixed Issues list renders empty, by design. v4.1.7 contains no functional bug fixes; the CVE content is published through the errata, which is also why the bug query excludes 安全问题. The heading is kept for consistency with every other version section.
• upgrade.mdx had stopped at v4.1.2 — v4.1.3 and v4.1.6 were never added. Backfilled here. (v4.1.4 and v4.1.5 are intentionally absent: they were renamed forward by fix: reset version #43 and fix: bump release notes v4.1.5 to v4.1.6 #44 and never shipped as separate releases.)
• Server versions come from each release tag's values.yaml, not copied between tables. One consequence worth flagging: upgrade.mdx lists v4.1.3 as 7.2.13 — which is what the v4.1.3 tag actually ships — while the existing release_notes.mdx row says 7.2.12. That looks like a pre-existing error in release_notes.mdx; not changed here, happy to correct it in this PR if preferred.
• mw-redis-v4.1.7-fixed is the first template to query project = ECO. Issue tracking moved MIDDLEWARE → ECO in 2026-07, so the earlier templates would return nothing today.

Verification

yarn lint → 0 errors, 0 warnings.

Release testing for v4.1.7 passed on both architectures (amd64 281 passed / arm64 241 passed, 0 failures and 0 broken on each).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying alauda-redis with    Cloudflare Pages

Latest commit:	9fd6187
Status:	✅  Deploy successful!
Preview URL:	https://f6c46c46.alauda-redis.pages.dev
Branch Preview URL:	https://docs-release-notes-v4-1-7.alauda-redis.pages.dev

View logs

[chideat]

Follow-up commit 9fd6187: corrected the v4.1.3 Redis 7.2 version in release_notes.mdx from 7.2.12 → 7.2.13.

The v4.1.3 tag (ab492b79) pins redis-v72 at version: 7.2.13; the 7.2.12 value appears to have been carried over from the v4.1.2 row. This was flagged in the PR description as a pre-existing discrepancy — validate_coupling.py then failed it as a hard cross_table_equality error once upgrade.mdx gained a v4.1.3 row with the tag-verified value, so it is fixed here rather than left inconsistent.

Re-verified after the fix:

• validate_coupling.py → PASS (version/ACP coupling consistent for v4.1.7)
• yarn lint → 0 errors, 0 warnings

[chideat]

Scope correction — the CVE set for v4.1.7 is 8 tickets, not 6.

ECO-749 and ECO-750 (application / system vulnerabilities in the redis-operator image itself) were also fixed in this release, via branch sec/eco-749-750 merged as e9c9efb2 — which became rc.1 and is an ancestor of the v4.1.7 tag. They had simply never been closed out; both are now 完成 with fixVersion = Redis-v4.1.7.

This does not change any file in this PR — the release notes deliberately carry no per-CVE list, and the Security Fixes note already points at the errata for the full set. Flagging it because the errata scope is larger than earlier comments implied.

For whoever compiles the errata: project = ECO AND fixVersion = "Redis-v4.1.7" returns only 4 of the 8 (ECO-744/745/749/750). The other four (ECO-746/747/748/751) cover sub-images shared with the 5.0 line and are closed under Redis-v5.0.2, so the CVE list must come from the image scans rather than a single Jira query.