Update Helm release valkey to v2

.github/workflows/install-test.yml

@@ -120,7 +120,7 @@ jobs:
       # invisible there. The value mirrors K3S_IMAGE above (v1.35.5), which is
       # the cluster this client talks to.
       # renovate: datasource=github-releases depName=kubernetes/kubernetes
-      KUBECTL_VERSION: v1.37.1
+      KUBECTL_VERSION: v1.35.9
       # The same expression as runs-on above, written a second time because the
       # env context is not available in runs-on - so it cannot be the other way
       # round, and reading the label back off the runner is not possible either

.github/workflows/validate-charts.yml

@@ -376,7 +376,7 @@ jobs:
         chart: ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }}
     env:
       # renovate: datasource=github-releases depName=aquasecurity/trivy
-      TRIVY_VERSION: v0.76.0
+      TRIVY_VERSION: v0.75.0
       # "report" always exits 0. Switch to "gate" to make a finding that no
       # documented exception covers fail the job - the intended step once the
       # seccomp gap (#84) is closed.

minecraft-router/Chart.yaml

@@ -5,8 +5,8 @@ icon: https://avatars.githubusercontent.com/u/988985
 
 type: application
 
-version: 5.1.0+up1.48.0
-appVersion: "1.48.0"
+version: 5.0.0+up1.47.2
+appVersion: "1.47.2"
 
 maintainers:
   - name: jklein

paperless-ngx/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/dev/src-ui/s
 
 type: application
 
-version: 14.1.0+up3.3.1
+version: 15.0.0+up3.3.1
 
 appVersion: 3.3.1
 
@@ -57,7 +57,7 @@ dependencies:
     #
     # Independent of appVersion: raising it is a patch or minor bump of this
     # chart and is never tied to the paperless-ngx image.
-    version: "1.0.0+up9.1.2.alpine"
+    version: "2.0.0+up9.1.2.alpine"
     # Our own published index, and the READ path only - anonymously readable
     # (measured), so ci/helm-dependencies.sh needs no credential and was not
     # touched. The publish target and its credentials still live in 1Password

stalwart/Chart.yaml

@@ -37,7 +37,7 @@ type: application
 #
 # Note for whoever bumps this next: the suffix tracks appVersion, so a major
 # here keeps the +up<appVersion> it was merged with.
-version: 2.0.0+upv0.16.26
+version: 3.0.0+upv0.16.26
 appVersion: "v0.16.26"
 
 maintainers:
@@ -95,7 +95,7 @@ dependencies:
     #
     # Independent of appVersion: raising it is a patch or minor bump of this
     # chart and is never tied to the Stalwart image.
-    version: "1.0.0+up9.1.2.alpine"
+    version: "2.0.0+up9.1.2.alpine"
     # Our own published index, and the READ path only. It is anonymously
     # readable - measured 2026-10-02: GET .../index.yaml returns 200 without
     # credentials - so ci/helm-dependencies.sh needs no secret and was not