chore(deps): bump redis from 5.4.1 to 6.0.0

[dependabot]

Bumps redis from 5.4.1 to 6.0.0.

Release notes

Sourced from redis's releases.

6.0.0

This is a major release of the redis and redis-clustering gems. The headline change is that the client now speaks RESP3 by default, alongside first-class support for the Redis Query Engine and the JSON module, a batch of new Redis 6.2–8.10 commands, and experimental support for the Redis 8.10 HIMPORT bulk-ingestion command family.

Command return values are unchanged from 5.x with one exception (GEO coordinates, see below), so for most applications this upgrade is a Gemfile bump.

Requires Ruby 3.2+ and works with Redis server 6.0+ (older servers are handled via automatic RESP2 fallback).

RESP3 by default

RESP3's richer wire types (native maps, doubles, booleans) let the parser deliver replies already in their final Ruby shape. Under RESP2, structured replies arrive as flat arrays of bulk strings that the client must re-shape in Ruby — e.g. HGETALL builds a Hash from a flat [field, value, ...] array, and sorted-set scores are converted String → Float pair by pair. Under RESP3 that re-shaping pass disappears.

Measured with bench/resp_comparison.rb (redis-rb 6.0.0, Ruby 3.4.1, Redis 8.8, localhost, 100-element replies):

Pure-Ruby driver (default):

Workload	RESP2 → RESP3 RPS (8 threads)	RESP2 → RESP3 µs CPU/op
GET (50B string)	4251 → 4436 (+4%)	23.4 → 22.9 (~0)
HGETALL (100 fields)	2361 → 2560 (+8%)	164 → 129 (−22%)
ZRANGE WITHSCORES (100)	2597 → 2459 (−5%)	130 → 147 (~0, noise)
XRANGE (100 entries)	1544 → 1570 (+2%)	346 → 328 (~0)

hiredis driver (C parser):

Workload	RESP2 → RESP3 RPS (8 threads)	RESP2 → RESP3 µs CPU/op
GET	12756 → 12620 (~0)	69 → 70 (~0)
HGETALL	10175 → 10592 (+4%)	97 → 89 (−8%; 1 thread: 88 → 63, −28%)
ZRANGE WITHSCORES	10036 → 11629 (+16%)	108 → 85 (−22%)
XRANGE	7053 → 6999 (~0)	152 → 152 (~0)

In short: hash reads use ~10–25% less client CPU per call on both drivers; sorted-set reads with scores gain up to 16% throughput and ~20% less CPU with hiredis (unchanged on the pure-Ruby driver, where parsing RESP3 doubles costs roughly what the re-shaping pass did); simple string and stream commands are unaffected — their reply shapes are the same in both protocols. RESP3 pairs best with the hiredis driver, which moves all reply construction out of Ruby and into C.

Methodology note: figures are per-reply CPU measurements against a localhost server; wall-clock throughput gains in production depend on how network-bound your workload is.

Beyond performance, RESP3 also lays the groundwork for push-based features — such as server-assisted client-side caching (CLIENT TRACKING invalidation events) — in future 6.x releases, without another protocol migration.

🔥 Breaking changes

• RESP3 by default (see above); pass protocol: 2 to keep RESP2. The only return-value change is GEO coordinates as Float. (#1351)
• Requires Ruby 3.2+ (previously 2.7/2.6). Bundler will keep older Rubies on the 5.4.x series automatically. (#1353, #1365)

Cluster gem (redis-clustering) only

• Commands are now routed by their server-declared command tips (redis-cluster-client 0.16.6+): SLOWLOG GET returns one entry list per master; SLOWLOG LEN and LATENCY RESET return the sum across all masters; FUNCTION LOAD/DELETE/FLUSH/RESTORE now execute on all masters (previously a single arbitrary node — this also fixes FCALL failing for keys on other masters); commands with keys in subcommands (e.g. XINFO STREAM) route to the key's slot owner.

🚀 New features

• Redis Query Engine (RediSearch, FT.*): ft_create, ft_alter, ft_dropindex, ft_info, ft_search, ft_aggregate, vector and hybrid search, suggestions, dictionaries, synonyms, aliases, and spellcheck. Not supported by Redis::Distributed. (#1356, #1359, #1360, #1361)
• JSON module: json_set, json_get, json_mset, json_mget, json_del, json_forget, json_clear, json_merge, json_arr*, json_obj*, json_str*, json_numincrby, json_toggle, json_type, json_debug_memory. (#1346, #1347, #1348, #1349)

... (truncated)

Changelog

Sourced from redis's changelog.

6.0.0

Breaking changes

• Use RESP3 (HELLO 3) by default; pass protocol: 2 to keep RESP2. GEOPOS and GEOSEARCH/GEORADIUS with WITHCOORD now return coordinates as Float instead of String. See https://github.com/redis/redis-rb/blob/master/specs/migration-resp3.md. (#1351)
• Require Ruby 3.2+. (#1353, #1365)

New features

• Add support for the Redis Query Engine (RediSearch, FT.*): ft_create, ft_alter, ft_dropindex, ft_info, ft_search, ft_aggregate, vector and hybrid search, suggestions, dictionaries, synonyms, aliases, and spellcheck. Not supported by Redis::Distributed. (#1356, #1359, #1360, #1361)
• Add support for the JSON module: json_set, json_get, json_mset, json_mget, json_del, json_forget, json_clear, json_merge, json_arr*, json_obj*, json_str*, json_numincrby, json_toggle, json_type, json_debug_memory. (#1346, #1347, #1348, #1349)
• Add keyspace notification support: channel builders and a binary-safe parser for the classic __keyspace@*/__keyevent@* channels and the Redis 8.8 subkey notification families (Redis::KeyspaceNotifications), plus a manager (Redis#keyspace_notifications) that owns a dedicated connection, dispatches typed Notification objects to handlers, and automatically re-subscribes after connection loss (on_reconnect signals the lossy gap). Enabling notify-keyspace-events on the server remains the operator's responsibility. Not supported by Redis::Distributed. See specs/keyspace-notifications/user-guide.md.
• Add lmovem and blmovem (Redis 8.10). (#1363)
• Add sunioncard and sdiffcard (Redis 8.10). (#1357)
• xread and xreadgroup now accept max_count: and max_size: (Redis 8.10). (#1358)
• Add hexpire, hpexpire, httl and hpttl (Redis 7.4). (#1324, #1325, #1331)
• Add hexpireat, hpexpireat, hexpiretime, hpexpiretime and hpersist; hexpire and hpexpire now accept the nx:/xx:/gt:/lt: condition options (Redis 7.4). All are available on Redis::Distributed. (#1374)
• hscan and hscan_each now accept novalues: true (Redis 7.4). (#1327)
• Add geosearch and geosearchstore (Redis 6.2); geo commands are now available on Redis::Distributed. (#1342)
• geoadd now accepts nx:, xx: and ch:; geo radius searches accept count_any:; xadd accepts limit: (Redis 6.2). (#1345)
• Redis::Distributed now implements hscan, hscan_each and hstrlen. (#1319)
• Identify the client to the server via CLIENT SETINFO (lib-name=redis-rb, lib-ver=<version>). Extend the reported name with driver_info:, or disable with driver_info: false. See the README "Client identification" section. (#1369)

Experimental

• Add himport_prepare, himport_set, himport_discard and himport_discard_all (Redis 8.10 HIMPORT). Lost fieldsets are re-prepared and retried automatically; disable with himport_auto_prepare: false. The API may change in a future minor release. See the README "Bulk hash ingestion (HIMPORT)" section. (#1364)

Bug fixes

... (truncated)

Commits

• 0fa108a Fixed merge conflicts
• 4dca97d Sync with master
• 32d781b Identify redis-rb to the server via CLIENT SETINFO (#1369)
• e5d6b0a Testing with 8.10 GA (#1368)
• 19f8a63 Testing with 8.10 GA
• 60c4aad Prepare 6.0.0 release (#1366)
• 89407d4 Fixed unstable test
• eba7fdc Fixed rubocop
• 56fc0b9 Prepare 6.0.0 release
• dd2d158 Added support for Ruby 3.2+ (#1365)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
rubygems/redis	6.0.0	🟢 4.4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 6 Found 19/29 approved changesets -- score normalized to 6 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• Gemfile.lock

[doerfli]

@dependabot rebase