From 57460944c4527caac6e10d53853a8ba854e0ec9d Mon Sep 17 00:00:00 2001
From: Ai Vong <ai.vong@openhands.dev>
Date: Thu, 8 Oct 2026 15:46:55 -0500
Subject: [PATCH] fix(valkey): pin the opt-in Valkey cache to 9.1.2-alpine

---
 charts/openhands/values.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/charts/openhands/values.yaml b/charts/openhands/values.yaml
index c1094a69..f574b698 100644
--- a/charts/openhands/values.yaml
+++ b/charts/openhands/values.yaml
@@ -901,6 +901,10 @@ valkey:
   enabled: false
   image:
     repository: valkey/valkey
+    # The subchart defaults to its appVersion (9.1.1, Debian), which has
+    # critical/high OS findings with fixes available. The Alpine build of the
+    # current 9.1 patch has none.
+    tag: "9.1.2-alpine"
   auth:
     enabled: true
     # The same Secret the redis subchart reads.