Bump ioredis from 5.11.1 to 6.0.0

[dependabot]

Bumps ioredis from 5.11.1 to 6.0.0.

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)
• types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

• add LMOVEM and BLMOVEM command support (#2144) (c26af46)
• add Redis 8.10 set cardinality commands (#2143) (301099b)
• himport managed fieldsets (#2159) (729f174)
• improve default connection resilience (#2160) (6d0716e)
• support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

• ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)
• types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

• add LMOVEM and BLMOVEM command support (#2144) (c26af46)
• add Redis 8.10 set cardinality commands (#2143) (301099b)
• himport managed fieldsets (#2159) (729f174)
• improve default connection resilience (#2160) (6d0716e)
• support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

• ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

Commits

• 8ed2946 chore(release): 6.0.0 [skip ci]
• 3b410f8 docs: clarify managed HIMPORT fieldset behavior (#2161)
• 729f174 feat: himport managed fieldsets (#2159)
• 6d0716e feat: improve default connection resilience (#2160)
• cf3bf71 fix(types): export ScanStreamOptions, RedisStatus and ClusterStatus (#2158)
• aac171b ci: update Redis test image (#2156)
• 807bb1c chore(release): update repository URL (#2154)
• 6c889e7 docs: add security policy (#2153)
• 6455dbe fix: clear stale socket timeout on reconnect (#2148)
• 9618206 fix(cluster): validate MOVED slot to prevent Array.prototype pollution (#2151)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bert-e]

Hello dependabot[bot],

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/bypass_source_branch_lineage	Bypass the cross-branch contamination check	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request.
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

The following options are set: bypass_author_approval, bypass_jira_check

[bert-e]

Waiting for approval

The following approvals are needed before I can proceed with the merge:

• the author

• 2 peers

The following options are set: bypass_author_approval, bypass_jira_check

[github-actions]

Dependency Bump Evaluation

Version change: 5.11.1 -> 6.0.0
Semver bump type: major

Changes:

• RESP3 wire protocol enabled by default (replaces RESP2); opt out with protocol: 2
• New in-tree RESP3 decoder replaces the external redis-parser package
• replyMapping defaults to "legacy", preserving RESP2-like JavaScript return types
• Improved default connection resilience (retry/reconnection behavior changes)
• Node.js 20 minimum requirement
• Bug fixes: MOVED slot validation (prevents Array.prototype pollution), stale socket timeout on reconnect, large integer serialization, sentinel zero priority handling
• New commands: LMOVEM, BLMOVEM, set cardinality, HIMPORT managed fieldsets, MAXCOUNT/MAXSIZE for streams
• Security: value redaction for GETSET/PSETEX in tracing

Breaking changes:

• RESP3 is the default wire protocol — the entire parsing layer is replaced with a new in-tree decoder. While replyMapping: "legacy" (the default) preserves RESP2-like return shapes, the underlying parser is completely new.
• Connection resilience defaults changed (ARSN-360 Enable V0 bucket format for Artesca lifecycle listing  #2160) — affects retry timing and reconnection behavior for all connections that don't set custom retryStrategy or maxRetriesPerRequest.

Security concerns: None negative. The bump includes positive security fixes: MOVED slot validation prevents Array.prototype pollution (#2151), stale socket timeout cleared on reconnect (#2148), and value redaction for GETSET/PSETEX (#2134).

Impact on codebase:

• lib/metrics/RedisClient.ts is the only file importing ioredis directly. It creates new Redis(config) without a protocol option, so it will use RESP3 by default.
• RedisClient does not configure any retryStrategy or maxRetriesPerRequest, so it will inherit the new connection resilience defaults.
• lib/metrics/StatsClient.ts:63 — _getCount() depends on pipeline().exec() returning [[null, result], ...] format. With the default "legacy" reply mapping, this format is preserved.
• Commands used (get, incr, incrby, decrby, exists, zadd, zcard, zscore, zrem, zrange, zrangebyscore, ttl, flushdb, scanStream, multi, pipeline) all return primitive types unaffected by RESP3 Map/Set typing. The codebase does not use hgetall, smembers, or other commands whose return types change under RESP3.
• OpenTelemetry ioredis instrumentation (lib/tracing/) references ioredis indirectly — compatibility depends on @opentelemetry/instrumentation-ioredis supporting v6.

Recommendation: REVIEW REQUIRED

Notes:

• CI checks are still in progress — tests must pass before merging to confirm the new RESP3 decoder handles all command patterns correctly.
• The connection resilience change (ARSN-360 Enable V0 bucket format for Artesca lifecycle listing  #2160) could alter retry behavior in production. Verify that the new defaults (retry intervals, max retries) are acceptable for your deployment or add explicit retryStrategy/maxRetriesPerRequest to RedisClient configuration.
• Confirm that @opentelemetry/instrumentation-ioredis (used in tracing) is compatible with ioredis v6.
• The Redis server must support RESP3 (Redis >= 6.0). CI uses image: redis (latest) which supports RESP3. Verify production Redis server versions.
• Low-risk path: if all CI tests pass, the legacy reply mapping ensures JavaScript API backward compatibility. The main residual risk is the new decoder and connection resilience defaults.

— Claude Code