chore(deps): bump redis from 7-alpine to 8-alpine in /docker

[dependabot]

Bumps redis from 7-alpine to 8-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[lml2468]

[APPROVE] Safe major bump. Redis 8 is backward-compatible for this usage pattern.

Verified

The compose config uses explicit flags: redis-server --save 60 1 --loglevel warning. Both flags are supported unchanged in Redis 8. No ACL config, no custom redis.conf — the default auth model change in Redis 8 does not affect this deployment.

CI: ✅ all checks pass.

[Jerry-Xin]

Project relevance gate: passes. This PR updates a Docker backing service that is part of the octo-deployment stack.

One-line summary: The Redis image bump is scoped and compose still renders correctly; no blocking runtime, security, or architecture issue found.

💬 Non-blocking

🟡 Warning: Documentation still references the old image tag. docker/README.md:171 and docker/README.zh.md:93 still say users need access to pull redis:7-alpine, while the compose stack now uses redis:8-alpine at docker/docker-compose.yaml:197. This is not a merge blocker, but it should be cleaned up to avoid operator confusion.

🔵 Suggestion: Redis 8’s documented potentially breaking changes are mainly around ACL category behavior for integrated module commands; this stack does not configure Redis ACL users and connects to plain redis:6379, so I do not see this PR introducing a blocking compatibility issue. (redis.io)

✅ Highlights

• docker/docker-compose.yaml:197 keeps the change minimal and consistent with the existing service definition.
• docker/docker-compose.yaml:206 keeps the existing redis-cli ping healthcheck, which remains appropriate for this unauthenticated Redis setup.
• Verified docker compose -f docker/docker-compose.yaml config --quiet; it rendered successfully, with only expected warnings for unset required .env secrets in the review checkout.
• Verified rendered images include redis:8-alpine.

[lml2468]

Review at d0453de

Dependabot bump: redis 7-alpine → 8-alpine in docker-compose.

⚠️ This is a major version bump. Redis 7 → 8 considerations:

Compatibility check

Concern	Status
CLI args --save 60 1 --loglevel warning	✅ Unchanged in Redis 8
RDB format (upgrade)	✅ Redis 8 reads Redis 7 RDB files
RDB format (rollback)	⚠️ Redis 8 RDB may not be readable by Redis 7 — one-way upgrade
No AUTH configured (default)	✅ Same behavior
No config file	✅ CLI-only config, no format migration needed

Findings

P1 (non-blocking but important)

1. 🟡 One-way data upgrade — existing Redis 7 volumes will be readable by Redis 8, but rolling back to Redis 7 after Redis 8 writes data is not guaranteed. Operators running this in production should snapshot their Redis volume before docker compose pull && docker compose up -d. Worth a note in release notes / changelog.

2. 🟡 Helm chart drift — helm/octo/values.yaml still pins redis:7-alpine. After this Docker Compose bump lands, the two deployment paths will diverge on Redis version. Should be coordinated.

Recommendation

The bump itself is safe for this workload (basic caching + pub/sub, no exotic Redis features). Ship it, but note the one-way upgrade path for production operators.