BullMQ 5

Apply the Node.js 24, TypeScript 5.9, and JavaScript ES2026 prompts first. These rules target BullMQ 5 on its Redis backend, including its queues, workers, locks, deduplication, job schedulers, flows, and Redis client adapters, and were checked against 5.81.4.

Redis backend and connections

• Use a security-maintained Redis release compatible with BullMQ's documented Redis 6.2.0-or-newer baseline, or an officially tested compatible server; the client's lower hard version check is not a support or security guarantee.
• Point connection at an authenticated TLS endpoint on a private network with a dedicated Redis ACL user. Restrict keys and commands to the required queue operations, including Lua execution, and keep these credentials away from untrusted producers and tenants.
• Set maxmemory-policy to noeviction and enable AOF persistence, since arbitrary key eviction silently destroys jobs, locks, and deduplication keys.
• Map authorized workloads to server-controlled connection, prefix, and queue names; these select Redis keys and provide namespacing, not tenant authorization.
• Use BullMQ's prefix, never ioredis keyPrefix. For Redis Cluster, place keys used by an atomic queue or flow operation in the same hash slot with a controlled hash tag.
• Leave skipVersionCheck disabled so Redis version, server-type, and eviction-policy diagnostics run; independently enforce deployment settings rather than treating warnings as a configuration gate.
• Use skipMetasUpdate only to suppress a Queue instance's metadata writes, such as for an observer; it neither