Dependencies

Redis vendors all of its third-party dependencies under deps/. They are built as static libraries and linked into the final binaries. There is no system-package dependency at runtime beyond libc, OpenSSL (when TLS is enabled), and libsystemd (when sd_notify is enabled).

Dep	Source	Purpose
deps/jemalloc/	jemalloc 5.x	The default memory allocator on Linux. Provides arena-based allocation, accurate mallocx stats, and the active-defrag hooks. Selected via MALLOC=jemalloc (default).
deps/lua/	Lua 5.1 (vendored)	The scripting interpreter for EVAL, EVALSHA, FUNCTION, and Lua-engine functions. Patched to integrate with zmalloc and the script timeout hook.
deps/hiredis/	hiredis	The synchronous Redis client library. Used by redis-cli and redis-benchmark.
deps/linenoise/	linenoise	A minimal readline replacement. Provides line editing and history for redis-cli.
deps/hdr_histogram/	HdrHistogram_c	High dynamic-range histogram. Powers INFO latencystats and LATENCY HISTOGRAM.
deps/fpconv/	fpconv	Fast double-to-string conversion. Used wherever Redis emits numeric replies (ZADD scores, HRANDFIELD, INFO numbers).
deps/xxhash/	xxhash	Used by some module data types (vector sets) and by tests.

Why vendored

Embedding the dependencies into the source tree:

• Guarantees a build works on any host with a compiler, no system-package shopping list.
• Pins the exact version so reviewers and CI test the same code as production.
• Allows custom patches without forking a separate package (jemalloc gets patched to expose Redis-specific arena stats; Lua gets patched to integrate with zmalloc).

The trade-off is that the maintainers must occasionally pull updates from upstream when bugs are fixed. The relevant CI workflow (coverity.yml, daily.yml) catches issues before they reach a release.

Build flow

src/Makefile first builds deps/ via the dispatcher in deps/Makefile. Each dep has its own Makefile that produces a lib*.a archive. The final link step pulls them in:

$(REDIS_SERVER_NAME): $(REDIS_SERVER_OBJ)
    $(REDIS_LD) -o $@ $^ ../deps/hiredis/libhiredis.a ../deps/lua/src/liblua.a \
        ../deps/hdr_histogram/libhdrhistogram.a ../deps/fpconv/libfpconv.a $(FINAL_LIBS)

Jemalloc is included only when MALLOC=jemalloc (the default on Linux). Hiredis_ssl is added when BUILD_TLS=yes.

When to update a dep

Every release cycle the maintainers bump versions for security-relevant deps (jemalloc, hiredis_ssl). To update one:

1. Replace the contents of deps/<dep>/ with the new upstream version.
2. Re-apply Redis-specific patches (search the tree for // PATCHED FOR REDIS markers).
3. Run the full CI matrix.
4. Update 00-RELEASENOTES.

External (non-vendored) dependencies

Dep	When required
OpenSSL (libssl, libcrypto)	Only when BUILD_TLS=yes/module. The hiredis_ssl shim links against the system OpenSSL.
libsystemd	Only when USE_SYSTEMD=yes. Provides sd_notify.
libexecinfo	Only on platforms without built-in backtrace() (Solaris, some BSDs).
Tcl 8.6+	Only at test time. The runtime doesn't depend on Tcl.

Bundled modules

Built only with BUILD_WITH_MODULES=yes:

• modules/redisbloom/ — Bloom, Cuckoo, Count-Min Sketch, t-digest, Top-K. Stub Makefile that fetches from upstream.
• modules/redisearch/ — Query and full-text search.
• modules/redisjson/ — JSON document storage with JSONPath.
• modules/redistimeseries/ — Time series data type.
• modules/vector-sets/ — Vector index (HNSW). Compiled directly into redis-server when atomics are available; not a separate .so.

These are technically dependencies in spirit but are tracked separately because they ship as user-visible features.

Related pages

• Memory management — zmalloc is built on top of jemalloc/libc.
• redis-cli — uses hiredis and linenoise.
• Modules — bundled modules and their integration.