[diegosouzapw]

Why

#9310 ("deps: bump the production group with 10 updates") carries ioredis 5.10.1 → 6.0.0 — a breaking major — alongside 9 routine bumps (axios, jose, playwright, better-sqlite3, fumadocs, lucide-react, material-symbols, aws-sdk).

That combination is unusually hard to catch:

• ioredis is a soft/optional dependency resolved through a dynamic import in src/lib/quota/redisQuotaStore.ts (Redis driver requires ioredis package), so a breaking API change cannot fail the build or typecheck:core.
• Its only other consumers are src/lib/quota/storeFactory.ts and an import type Redis in src/shared/utils/rateLimiter.ts — types, not runtime.
• Nothing in test:unit or test:vitest opens a live Redis connection.

So a v5→v6 break ships fully green and surfaces only at runtime, for operators running Redis-backed distributed quota — the users least able to absorb a surprise.

What changes

Adds ioredis to the existing ignore list for majors only (minors and patches keep flowing), following the same convention already used for typescript, jscpd, next and @huggingface/transformers, each with its justification inline.

Minor/patch bumps are unaffected. The ioredis 6 migration gets its own PR and its own review when we choose to do it.

Validation

Config-only change to .github/dependabot.yml; no product code touched.

[diegosouzapw]

Merged via local merge-train on 192.168.0.113 (32 cores) @ train tip 7eb0840f219a403081d79244e61e7747cfec92a4 — log /srv/omniroute-train/.claude/worktrees/train-20260804-200844-suite.log.

Green: typecheck:core, check-complexity, check-cognitive-complexity, check-changelog-integrity.

This was the first train of the day to run against a genuinely clean base — #9447 and #9392 had just taken the release back to green after 15 unit failures inherited from #9275 — so every red here was re-run in isolation on the exact train tip rather than assumed. All of them passed:

Failure	Suite	Isolated on the train tip
consoleInterceptor-writes — log-unavailable notice	unit	6/6 pass (also failing on the bare tip)
modelsDevSync-extended — duplicate timers	unit	13/13 pass (also 13/13 on the bare tip)
audit.test.ts ×3 (shutdown checkpoint, node:sqlite fallback)	vitest	pass — the documented WAL/timeout-under-load flake class
Sidebar.search.test.tsx ×2	vitest	pass — timed out at 20s/10s under the full concurrent run

No failure was attributable to any boarded PR.

For reference, check-file-size remains a pre-existing base-red on the bare tip (src/sse/handlers/chat.ts 1846>1845, open-sse/executors/base.ts 1623>1578) — baseline drift for the release captain.