chore(deps): bump ioredis from 5.11.1 to 6.0.0 - #238
Conversation
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
Bumps [ioredis](https://github.com/redis/ioredis) from 5.11.1 to 6.0.0. - [Release notes](https://github.com/redis/ioredis/releases) - [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md) - [Commits](redis/ioredis@v5.11.1...v6.0.0) --- updated-dependencies: - dependency-name: ioredis dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
73a7f29 to
b2da93d
Compare
|
Superseded by #241, which bumps ioredis to the same 6.0.0 but also sets The bump on its own is green here, but that green is thinner than it looks: Since |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
ioredis 6 negotiates RESP3 by default and requires Node 20+. The engine requirement is already satisfied (>=22), but the protocol switch is not covered by CI: the Redis client is fully mocked in the unit tests, and the CI service runs the default user on localhost, while production connects as an ACL user over an authenticated URL. That combination is the problem. getRedis() is deliberately fail-open, so a handshake that the server rejects would not surface as an error page or a crash. Rate limiting on the public submit endpoint would simply stop applying, leaving only a log line behind. Set protocol: 2 to keep the v5 wire format. The only consumer is the fixed window EVAL in the rate limiter, which gains nothing from RESP3, so there is no reason to take that risk as a side effect of a version bump. RESP3 can be adopted later as its own change, verified against the live server. Supersedes #238, which bumps the same dependency without the pin.
) ioredis 6 negotiates RESP3 by default and requires Node 20+. The engine requirement is already satisfied (>=22), but the protocol switch is not covered by CI: the Redis client is fully mocked in the unit tests, and the CI service runs the default user on localhost, while production connects as an ACL user over an authenticated URL. That combination is the problem. getRedis() is deliberately fail-open, so a handshake that the server rejects would not surface as an error page or a crash. Rate limiting on the public submit endpoint would simply stop applying, leaving only a log line behind. Set protocol: 2 to keep the v5 wire format. The only consumer is the fixed window EVAL in the rate limiter, which gains nothing from RESP3, so there is no reason to take that risk as a side effect of a version bump. RESP3 can be adopted later as its own change, verified against the live server. Supersedes #238, which bumps the same dependency without the pin.
1 participant
Bumps ioredis from 5.11.1 to 6.0.0.
Release notes
Sourced from ioredis's releases.
... (truncated)
Changelog
Sourced from ioredis's changelog.
Commits
8ed2946chore(release): 6.0.0 [skip ci]3b410f8docs: clarify managed HIMPORT fieldset behavior (#2161)729f174feat: himport managed fieldsets (#2159)6d0716efeat: improve default connection resilience (#2160)cf3bf71fix(types): export ScanStreamOptions, RedisStatus and ClusterStatus (#2158)aac171bci: update Redis test image (#2156)807bb1cchore(release): update repository URL (#2154)6c889e7docs: add security policy (#2153)6455dbefix: clear stale socket timeout on reconnect (#2148)9618206fix(cluster): validate MOVED slot to prevent Array.prototype pollution (#2151)