chore(deps): bump the production-dependencies group across 1 directory with 36 updates

[dependabot]

Bumps the production-dependencies group with 36 updates in the / directory:

Package	From	To
@aws-sdk/client-pricing	3.1053.0	3.1110.0
@hono/node-server	2.0.4	2.1.1
@prisma/adapter-pg	7.8.0	7.9.1
@prisma/client	7.8.0	7.9.1
better-auth	1.6.11	1.6.28
hono	4.12.23	4.13.2
ioredis	5.11.0	6.0.0
pg	8.21.0	8.23.0
prisma	7.8.0	7.9.1
resend	6.12.4	6.20.0
uuid	14.0.0	14.0.1
ws	8.21.0	8.21.3
@radix-ui/react-avatar	1.1.11	1.2.6
@radix-ui/react-dialog	1.1.15	1.1.23
@radix-ui/react-dropdown-menu	2.1.16	2.1.24
@radix-ui/react-label	2.1.8	2.1.15
@radix-ui/react-scroll-area	1.2.10	1.2.18
@radix-ui/react-select	2.2.6	2.3.7
@radix-ui/react-separator	1.1.8	1.1.15
@radix-ui/react-slot	1.2.4	1.3.3
@radix-ui/react-tabs	1.1.13	1.1.21
@radix-ui/react-toast	1.2.15	1.2.23
@radix-ui/react-tooltip	1.2.8	1.2.16
@tanstack/react-query	5.100.14	5.101.4
@tanstack/react-router	1.170.8	1.170.27
lucide-react	1.16.0	1.31.0
maplibre-gl	5.24.0	6.3.0
monaco-editor	0.55.1	0.56.0
react	19.2.6	19.2.8
react-dom	19.2.6	19.2.8
react-map-gl	8.1.1	8.1.2
react-resizable-panels	4.11.2	4.12.2
recharts	3.8.1	3.10.1
supercluster	8.0.1	9.0.0
vscode-languageserver-protocol	3.17.5	3.18.2
zustand	5.0.13	5.0.15

Updates @aws-sdk/client-pricing from 3.1053.0 to 3.1110.0

Release notes

Sourced from @​aws-sdk/client-pricing's releases.

v3.1110.0

3.1110.0(2026-08-13)

New Features

• client-auto-scaling: Amazon EC2 Auto Scaling now supports terminating multiple instances in a single TerminateInstanceInAutoScalingGroup call via the new InstanceIds parameter, returning an Activities list. LaunchInstances now returns IdempotentCallInProgressFault for duplicate client tokens. (ee707980)
• client-cleanrooms: This release adds support for minimum aggregation thresholds and comparison controls to the Custom analysis rule type. (1f84f2ae)
• client-codecommit: Added the GetBlobDifferences API operation, which returns line-level diffs between two blob versions without requiring a local clone. Returns structured hunks with context, additions, and deletions. Supports pagination for large diffs. (f1165c62)
• client-securityagent: Add support for setting a maximum task-hour budget cap on penetration tests and code reviews, and for revalidating previously reported findings via a new REVALIDATION job type. (aba75d72)
• client-connect: Adds the StartAssistantContact API to start chat contacts handled by an AI agent. Adds SegmentAttributes to StartWebRTCContact, and corrects its error response to now receive AccessDeniedException (previously returned as an internal server error due to a missing error declaration). (67f9b7bb)
• client-acm: This change allows customers to update their existing email-validated certificates to use the DNS validation method. (71c194a4)

---

For list of updated packages, view updated-packages.md in assets-3.1110.0.zip

v3.1109.0

3.1109.0(2026-08-12)

Documentation Changes

• client-glue: Documentation updates for materialized views APIs. (dae03968)

New Features

• client-quicksight: Added APIs for DLP with Microsoft Purview (manage configs with label enforcement across Spaces, Chat, Knowledge Bases), Approval Workflows (CRUD for policies on asset sharing for Agents, Knowledge Bases, Spaces), and Limits Management (limit profiles for index storage and agent hours per user). (b8913fb5)
• client-odb: Adds support for Oracle Exadata on Exascale Infrastructure (ExaDB-XS) resources including storage vaults and VM clusters. (9fa16070)
• client-mediaconnect: AWS MediaConnect now supports tuning the internal recovery latency between Router Inputs and Outputs to prioritize stream quality versus end-to-end latency. (1ecada3c)
• client-dsql: Improved validation of Kinesis stream ARN format to ensure only valid ARN characters are accepted (f571a2af)
• client-iam: Introduced role manager, an IAM capability that automatically sets up the IAM roles your AWS services need. When you set up a supported service in the console, role manager creates a role for you or reuses an existing one from an AWS-managed template. (1f81145e)
• client-wellarchitected: This change releases the Well-Architected Agent, a generative AI service that analyzes a customer's AWS environment and delivers personalized, prioritized recommendations across cost, security, performance, and resilience. (72d3422b)

---

For list of updated packages, view updated-packages.md in assets-3.1109.0.zip

v3.1108.0

3.1108.0(2026-08-11)

Chores

• codegen:
  • update smithy-ts commit to bring in TS6 change (#8262) (785d467f)
  • sync for operation-level endpoint defaults (#8260) (f50e0d94)
• upgrade to typescript 6 (#8257) (edabd4a5)

Documentation Changes

... (truncated)

Changelog

Sourced from @​aws-sdk/client-pricing's changelog.

3.1110.0 (2026-08-13)

Note: Version bump only for package @​aws-sdk/client-pricing

3.1109.0 (2026-08-12)

Note: Version bump only for package @​aws-sdk/client-pricing

3.1108.0 (2026-08-11)

Note: Version bump only for package @​aws-sdk/client-pricing

3.1107.0 (2026-08-10)

Note: Version bump only for package @​aws-sdk/client-pricing

3.1106.0 (2026-08-07)

Note: Version bump only for package @​aws-sdk/client-pricing

3.1105.0 (2026-08-06)

Note: Version bump only for package @​aws-sdk/client-pricing

3.1104.0 (2026-08-05)

... (truncated)

Commits

• 4efe5bc Publish v3.1110.0
• d2ee371 Publish v3.1109.0
• 26b0eb7 Publish v3.1108.0
• 785d467 chore(codegen): update smithy-ts commit to bring in TS6 change (#8262)
• edabd4a chore: upgrade to typescript 6 (#8257)
• d87c82b Publish v3.1107.0
• 2e4482a chore(codegen): smithy-aws-typescript-codegen 0.52.0 (#8255)
• 655d311 Publish v3.1106.0
• d6c0ea3 Publish v3.1105.0
• b3929bd Publish v3.1104.0
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.4 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in honojs/node-server#377
• perf(request): fast-path QUERY methods by @​usualoma in honojs/node-server#376
• perf(request): fast-path PATCH method by @​yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• 834e54f 2.0.11
• ba72bcd perf(request): fast-path PATCH method (#380)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.

Updates @prisma/adapter-pg from 7.8.0 to 7.9.1

Release notes

Sourced from @​prisma/adapter-pg's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table> 

... (truncated)

Commits

• 35003fd chore(adapter-pg): remove duplicate values parameter (#29650)
• d6d9fc9 chore: remove parameterization from sqlcommenter-query-insights (#29518)
• See full diff in compare view

Updates @prisma/client from 7.8.0 to 7.9.1

Release notes

Sourced from @​prisma/client's releases.

7.9.1

Today, we're issuing a patch release to resolve a security advisory in a transitive dependency of Prisma CLI (via @prisma/dev).

This fixes prisma/prisma#29780.

It does not actually affect @prisma/dev or Prisma CLI so no urgent action is required, but it is recommended to upgrade nevertheless to avoid false positives from security scanners.

7.9.0

Today, we are excited to share the 7.9.0 stable release 🎉

🌟 Star this repo for notifications about new releases, bug fixes & features — or follow us on X!

Highlights

ORM

Tab completions for the Prisma CLI

Typing out CLI commands from memory is now optional. Prisma ships shell tab completions for bash, zsh, fish, and PowerShell, covering commands, subcommands, options, flags, and even option values.

Setting it up. Most projects run Prisma through a package manager, so completions are enabled through @bomb.sh/tab's package-manager integration — install it once, then source the completion for your package manager and shell:

# 1. Install @bomb.sh/tab globally
npm install -g @bomb.sh/tab
2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):
echo 'source <(tab pnpm zsh)'  >> ~/.zshrc            # zsh
echo 'source <(tab pnpm bash)' >> ~/.bashrc           # bash
tab pnpm fish > ~/.config/fish/completions/pnpm.fish  # fish
tab pnpm powershell > ~/.tab-pnpm.ps1                 # PowerShell (then dot-source it from $PROFILE)

@bomb.sh/tab delegates to any locally-installed CLI that ships completions, so pnpm prisma <TAB>, pnpm exec prisma <TAB>, yarn prisma <TAB>, and bun x prisma <TAB> all complete Prisma's commands, options, and values — no per-project setup. (npx and bunx don't support completion themselves; use npm exec and bun x.)

If instead you have Prisma installed globally on your PATH, source its own completion directly: source <(prisma complete zsh) (or the bash / fish / powershell variant).

This is built on @bomb.sh/tab, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from @​AmirSa12 (#28351) — thank you!

prisma.mp4

Prisma ORM, ready for AI agents

Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.

Agent skills installed with prisma init (#29689)

prisma init now installs the prisma/skills catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with --no-skills.

</tr></table> 

... (truncated)

Commits

• b829850 ci: upgrade pnpm to 11 to restore pnpm audit (#29725)
• 280fd56 fix(client): mask each quoted string in maskQuery independently (#29723)
• 4da3774 fix(client): reject invalid raw dates (#29697)
• a7cec97 chore(deps): update engines to 7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6...
• 58f8439 fix(client): pin pg-protocol in prisma-client-imports-postgres e2e test (#29687)
• 918cf5d fix(client): improve adapter-related Prisma 7 error messages (#29624)
• 93da6ea ci(e2e): shard client e2e suite across 3 jobs to fix chronic timeouts (#29619)
• 3937779 fix: remove duplicate 'the the' in test comments (#29610)
• fda8fbc chore(deps): bump @​prisma/dev to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...
• 0036baf fix(client-engine-runtime): surface unmapped driver errors as user-facing P20...
• See full diff in compare view

Updates better-auth from 1.6.11 to 1.6.28

Release notes

Sourced from better-auth's releases.

v1.6.28

better-auth

Bug Fixes

• Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes (#10769)
• Restored client plugin declaration compatibility for downstream TypeScript consumers (#10794)

For detailed changes, see the CHANGELOG.

@better-auth/electron

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers (#10794)

For detailed changes, see the CHANGELOG.

@better-auth/expo

Bug Fixes

• Restored client plugin declaration compatibility for downstream TypeScript consumers (#10794)

For detailed changes, see the CHANGELOG.

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu

Full changelog: v1.6.27...v1.6.28

v1.6.27

better-auth

Bug Fixes

• Fixed duplicate session requests being made across Suspense retries (#10676)

For detailed changes, see CHANGELOG

@better-auth/scim

Bug Fixes

• Fixed auth endpoint types to align with better-call (#10657)

For detailed changes, see CHANGELOG

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.28

Patch Changes

• #10769 773de54 Thanks @​bytaesu! - Prevent duplicate session requests during transient remounts while ensuring incomplete refreshes are revalidated.

• #10794 2ad2928 Thanks @​bytaesu! - Restore client plugin declaration compatibility for downstream TypeScript consumers.

• Updated dependencies []:

  • @​better-auth/core@​1.6.28
  • @​better-auth/drizzle-adapter@​1.6.28
  • @​better-auth/kysely-adapter@​1.6.28
  • @​better-auth/memory-adapter@​1.6.28
  • @​better-auth/mongo-adapter@​1.6.28
  • @​better-auth/prisma-adapter@​1.6.28
  • @​better-auth/telemetry@​1.6.28

1.6.27

Patch Changes

• #10657 2ae491e Thanks @​bytaesu! - Aligned endpoint and middleware context types with runtime route parameters, and preserved response headers when resolving sessions from endpoint contexts.

• #10676 90b5093 Thanks @​bytaesu! - Deduplicate in-flight session requests when React retries a suspended component.

• Updated dependencies [2ae491e]:

  • @​better-auth/core@​1.6.27
  • @​better-auth/drizzle-adapter@​1.6.27
  • @​better-auth/kysely-adapter@​1.6.27
  • @​better-auth/memory-adapter@​1.6.27
  • @​better-auth/mongo-adapter@​1.6.27
  • @​better-auth/prisma-adapter@​1.6.27
  • @​better-auth/telemetry@​1.6.27

1.6.26

Patch Changes

• #10619 9ede805 Thanks @​jeroenvandermerwe! - Ensure database rate-limit cleanup completes when no background task handler is configured.

• #10608 5a811f1 Thanks @​bytaesu! - Pass the email verification type to custom OTP generators after email sign-up.

• #10605 d8327f1 Thanks @​XXMOHAMED012! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.

• #10513 e2c73fb Thanks @​mrosberghaus! - Fix jwtClient() collapsing createAuthClient type inference when combined with other client plugins such as inferAdditionalFields. Additional user fields (for example on updateUser) are preserved again.

• #10635 af50c45 Thanks @​krish-vachhani! - Fix oneTapClient() collapsing createAuthClient type inference when combined with other client plugins. The oneTap action is available on the client again.

• #10633 701cd43 Thanks @​gustavovalverde! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.

... (truncated)

Commits

• 86faaee chore: release v1.6.28 (#10796)
• 773de54 fix(client): deduplicate settled session requests during Suspense retries (#1...
• c92a1ca chore: upgrade next to 16.3 (#10787)
• be47e94 chore: release v1.6.27 (#10686)
• 2ae491e fix(types): align auth endpoints with better-call (#10657)
• 90b5093 fix(client): deduplicate session requests across suspense retries (#10676)
• a16b30e chore: release v1.6.26 (#10521)
• 9ede805 fix(rate-limit): await database cleanup by default (#10619)
• af50c45 fix(one-tap): preserve client plugin inference with oneTapClient (#10635)
• 222facf fix(jwt): resolve the transaction-scoped adapter when signing (#10623)
• Additional commits viewable in compare view

Updates hono from 4.12.23 to 4.13.2

Release notes

Sourced from hono's releases.

v4.13.2

What's Changed

• fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
• fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
• fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
• fix(client): serialize multiple cookies correctly in honojs/hono#5202
• fix(etag): stabilize digest across stream chunks in honojs/hono#5205
• fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
• perf(cors): pre-join static array header options during initialization in honojs/hono#5210
• fix(client): send falsy JSON bodies in honojs/hono#5215
• feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

• fix(trie-router): count every slash a pattern consumes by @​Jaybhade in honojs/hono#5189
• fix(utils/stream): re-acquire writer lock when pipe() throws by @​Sriharsha-dev369 in honojs/hono#4988
• fix(etag): skip unsafe methods or error responses on non-* case by @​na-trium-144 in honojs/hono#5196

New Contributors

• @​Jaybhade made their first contribution in honojs/hono#5189
• @​Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

Here is benchmarks/fetch comparing v4.12 and v4.13 (ROUNDS=5 ./compare.sh, Bun 1.4.0, Apple Silicon — each measurement runs in a fresh process, and the variant order is reversed every round to avoid warm-up bias):

Benchmark	v4.12	v4.13	Speedup
ping — GET /	165.83 ns	163.99 ns	1.01x
query — GET /id/1?name=bun	674.40 ns	616.99 ns	1.09x
json — GET /user	528.99 ns	422.44 ns	1.25x
body — POST /json	1.16 µs	1.00 µs	1.15x

The individual changes:

• perf(context): iterate the header record with for..in honojs/hono#5118
• perf(url): replace regex tests with indexOf honojs/hono#5121
• perf(context): skip Headers creation when there are no headers to merge honojs/hono#5122
• perf(urls): refactor tryDecodeURIComponent honojs/hono#5158

... (truncated)

Commits

• 41bdc42 4.13.2
• 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
• 329b6f4 fix(client): send falsy JSON bodies (#5215)
• a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
• d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
• 26de731 fix(etag): stabilize digest across stream chunks (#5205)
• 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
• f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
• 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
• 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates ioredis from 5.11.0 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)
• types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

• add LMOVEM and BLMOVEM command support (#2144) (c26af46)
• add Redis 8.10 set cardinality commands (#2143) (301099b)
• himport managed fieldsets (#2159) (729f174)
• improve default connection resilience (#2160) (6d0716e)
• support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

• ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

• Add RESP3 (#2127) (5d0862e)

Bug Fixes

• clear stale socket timeout on reconnect (#2148) (6455dbe)
• cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
• cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
• command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
• redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
• sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
• tracing: redact values for GETSET and PSETEX (#2134) (832765d)
• types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

• add LMOVEM and BLMOVEM command support (#2144) (c26af46)
• add Redis 8.10 set cardinality commands (#2143) (301099b)
• himport managed fieldsets (#2159) (729f174)
• improve default connection resilience (#2160) (6d0716e)
• support MAXCOUNT and MAXSIZE for stream reads (#2142) (ae5e41b)

BREAKING CHANGES

• ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

5.11.1 (2026-06-04)

Bug Fixes

• cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
• parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

Commits

[pacphi]

⛔ Snyk checks have failed. 4 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (4)
⛔	Open Source Security	0	2	2	0	4 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.