chore(deps): update npm packages by renovate[bot] · Pull Request #1620 · jdx/usage

renovate · 2026-11-05T07:31:34Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	`26.6.5` → `26.6.6`
effect (source)	`4.0.6` → `4.1.0`

Release Notes

Effect-TS/effect (effect)

`v4.1.0`

Compare Source

Minor Changes

#8829 631d4f4 Thanks @harrysolovay! - Add Schema.isAscii, a check that accepts only ASCII strings, and the matching SchemaRepresentation.isAsciiReviver.
#8829 7ea1ea2 Thanks @wmaurer! - Add an optional cause to the AI NetworkError. It holds the HttpClientError the request failed with, stored unchanged and not redacted, so the reason a request failed is no longer lost. The new NetworkError.fromHttpClientError sets it, and all AI providers now use it. NetworkError.fromRequestError is unchanged.
#8829 a2ccc14 Thanks @fubhy! - Fix Atom.Serializable to encode to and decode from Schema.Json, matching the JSON codec used by Atom.serializable. Encoded results may now require narrowing; runtime behavior is unchanged.
#8829 c4d298d Thanks @okarin1511! - Render inherited CLI flags in a separate INHERITED FLAGS section and add "full", "summary", and "none" modes for inherited and global flags in CliOutput.defaultFormatter. HelpDoc adds inheritedFlags, commandPath, and globalFlagsScope provenance so summaries can point to the appropriate help, with globals always listed on their declaring command. Custom formatters must read ancestor shared flags from HelpDoc.inheritedFlags instead of HelpDoc.flags.
#10087 ac10e55 Thanks @effect-bot! - Add runnerJoinDebounce to ShardingConfig. When set, a runner joining the cluster is only added to shard assignments once the healthy runners have stayed unchanged for that duration, or at most four times that duration after the first pending join. A scale-up or a deployment with a large surge then hands each shard off once instead of once per join. Runners that already hold shards and leave or become unhealthy are still published immediately; a pending runner that leaves only restarts the quiet period. While joins are pending, runners take no new shards, so a shard can stay unlocked briefly until each runner publishes. Defaults to 0, which keeps the current behavior.
#8829 df8dce5 Thanks @tim-smart! - Add trim and keepEmptyValues options to SchemaGetter.splitKeyValue, SchemaTransformation.splitKeyValue and Config.Record. Both default to false, so existing callers are unaffected.

OtlpResource.fromConfig now trims OTEL_RESOURCE_ATTRIBUTES keys and values and keeps entries with an empty value as "".
#8829 0c24a8f Thanks @sledorze! - Add a maxDepth option to Context.makeUnsafe, controlling how many Context.add calls are kept as overlays before the context is rebased into a flat map. Defaults to 8.
#8829 2d1fcd4 Thanks @effect-bot! - Add an onDstOverlap option to Cron and Schedule.cron that chooses which occurrences of local times repeated when clocks fall back are included: "earlier" (default), "later" or "both". It applies to every repeated local time, including ones not caused by daylight saving time.

Cron.prev now returns the latest matching instant before its input when starting inside a repeated hour. Near a spring-forward gap it no longer throws or returns an instant at or after its input.
#8829 8f23668 Thanks @fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

Breaking changes

Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

#8829 3f8f359 Thanks @jem-computer! - Declare decision images as input fields with Decision.Image, and add Decision.locate, which answers with a bounding box around one target in an image field.
- DecideOptions.images is removed. Add Decision.Image fields to the input schema and refer to each image by its path in instructions:
```
// Before
DecisionModel.decide(Triage, { input: "Checkout error", images: [screenshot] })
// After
const Triage = Decision.make({
  input: Schema.Struct({ report: Schema.String, screenshot: Decision.Image }),
  decisions
})
DecisionModel.decide(Triage, { input: { report: "Checkout error", screenshot } })
```
- Custom providers receive images as { reference, path, image }, with each image replaced by its reference in state and its data as a base64 string or URL.
- Decision.locate({ image: "photo", instructions }) takes a path that Decision.make checks against the input's image fields. Providers opt in with supportsLocate: true. Decision.Any and DecisionModel.ProviderAnswer gain locate variants, so exhaustive switches over them need a Locate case.
- TypeSafeDecisionModel supports images, sent as assets keyed by reference, and sends locate decisions as Box questions, which need jev-preview or jev-1.14.0. OpenAI and Cloudflare label each image with its reference.
#8829 2a03584 Thanks @jayhemnani9910! - Add Duration.formatIso, Duration.fromIso and Schema.DurationFromIsoString for ISO 8601 durations. Only exact units are supported: weeks, days, hours, minutes and seconds. Years and months are rejected because they have no fixed length.
#8829 40e145e Thanks @yordis! - Add Duration.toMicros for converting durations to microseconds.
#8829 7217410 Thanks @tim-smart! - Add encrypted remote compaction to the event log.
#8829 cf249fe Thanks @tim-smart! - Detect unsupported streaming request bodies in FetchHttpClient and fail with an EncodeError instead of silently sending [object ReadableStream]. Set FetchHttpClient.StreamBodyFallback to "buffer" to buffer the body in memory on those runtimes instead.
#8829 4f0fad1 Thanks @effect-bot! - Fence Redis PersistedQueue settlements and lock refreshes on a per-acquisition lock, so a stale handler can no longer release another live claim, including one with the same custom id in another queue. The lock format is incompatible with older workers on the same prefix: stop every old worker and let its locks expire before starting upgraded workers.
#8829 f74db37 Thanks @smit153! - Accept { self } before the generator body in Effect.fnUntraced and Effect.fnUntracedEager to bind this, matching Effect.fn.
#8829 069cf72 Thanks @effect-bot! - Add opt-in RFC 9457 Problem Details support to HttpApi.
- ProblemDetails in effect/http provides the application/problem+json media type, a lenient codec for problem details objects, and a response constructor.
- HttpApiError.Problem<Self>()(tag, { type, status, title }, fields?) declares a typed problem as a yieldable error class that endpoints render, document and decode as application/problem+json, discriminated by type.
- HttpApiSchema.asProblem renders a built-in error such as HttpApiError.NotFound as a problem.
- HttpApiMiddleware.ProblemDetails with HttpApiMiddleware.layerProblemDetails renders request decoding failures as a generic 400 problem (with per-field errors when includeDetails is enabled) and response encoding failures as a 500 problem.
The default behaviour is unchanged: without the opt-in, built-in errors and decoding failures still produce the same responses as before.
#8829 9a07ebc Thanks @effect-bot! - Allow HttpApiSchema.Upgrade alongside ordinary success responses, for servers that decline the upgrade, and add HttpApiClient.isUpgraded to narrow the client result.

HttpApiClient.Upgraded values now carry a [HttpApiClient.UpgradedTypeId] brand. Code that builds Upgraded values by hand, such as client mocks, must add [HttpApiClient.UpgradedTypeId]: HttpApiClient.UpgradedTypeId to the object literal.
#8829 f40dc4e Thanks @bezff! - HttpClient.withCookiesRef now takes a Ref<ReadonlyArray<Cookie>> and sends stored response cookies only to a matching host, path and scheme, using the new Cookies.mergeIntoArray and Cookies.toRequestCookieHeader. Seed the ref with Cookies.mergeIntoArray or with cookies that set a domain.
#8829 fa516c6 Thanks @Tarekkharsa! - Export HttpClient.isTransientError and HttpClient.isTransientResponse, the predicates retryTransient uses to decide what to retry.
#8829 ffd9237 Thanks @effect-bot! - Add log: "Unhandled" to Effect.ignore, Effect.ignoreCause, and their Stream and Channel variants. This resolves References.UnhandledLogLevel when a failure occurs and suppresses logging when that reference is undefined, while preserving each combinator's existing failure semantics.
#8829 93895b9 Thanks @tim-smart! - Add keys to KeyValueStore and SchemaStore. It returns a snapshot of the keys in the store, in no particular order, and is implemented by the memory, file system, SQL, Web Storage and IndexedDB stores. Custom stores built with KeyValueStore.make or KeyValueStore.makeStringOnly must now provide keys.

KeyValueStore.prefix(...) now scopes keys, size and isEmpty to keys under the prefix, with the prefix removed from the returned keys. Previously size and isEmpty reported on the whole backing store.

Stores built with KeyValueStore.make that don't provide clearPrefix now derive it from keys and remove instead of failing for non-empty prefixes.
#8829 e5a1479 Thanks @effect-bot! - Add the unstable Match.literals and Match.literalsExhaustive APIs for matching string and number literal unions with a record of handlers.
#8829 65db606 Thanks @effect-bot! - Add request-level dependencies and middleware to McpServer so handler services can be supplied per request. Breaking: pass registration layers through the transport's registrations option, and capture construction-time handler services in Layer.unwrap instead of Layer.provide.
#8829 7c42335 Thanks @tim-smart! - Add McpServer.visibility to hide tools, resources and prompts per request based on services provided by MCP middleware. Middleware that wraps a visibility now runs on list requests, once for each registration, so MiddlewareMethod includes the list methods. Middleware provided both locally and globally now runs once.
#8829 cb21d14 Thanks @effect-bot! - Add a cacheHints option to the McpServer layers to set how long clients may treat v2026_07_28 discovery and list results as fresh, for example cacheHints: { tools: { ttl: "1 minute", cacheScope: "private" } }. Results without a hint, and resources/read, keep { ttlMs: 0, cacheScope: "private" }.
#8829 c32eb78 Thanks @effect-bot! - Expose SqlMessageStorage.makeEncodedStorage to construct an encoded SQL message storage driver without running migrations or executing startup SQL. Run layerMigrations separately with the same table prefix before using the driver; makeEncoded continues to run migrations by default.
#8829 be9895b Thanks @bezff! - Move fromFileSystem from effect/sql/Migrator to effect/sql/MigratorFileSystem, so React Native apps can import effect/sql/Migrator and effect/sql under Metro. The effect/sql barrel and @effect/sql-sqlite-react-native/SqliteMigrator no longer export fromFileSystem; the other SQL adapter migrators still re-export it.
#8829 26b4bfe Thanks @fubhy! - Type received and forwarded HTTP request methods as string so methods such as PROPFIND are represented accurately, including in AI HTTP error details. Exhaustive matches on request methods now need a fallback or a guard using HttpMethod.isHttpMethod.
#8829 f97711f Thanks @effect-bot! - Isolate Persistence stores on the KeyValueStore and Redis backings. Clearing a store now only removes that store's entries, and different store / key pairs no longer map to the same backing key.

Add KeyValueStore.clearPrefix, implemented by the memory, file system, SQL, Web Storage and IndexedDB stores. KeyValueStore.prefix(...).clear now only removes keys under the prefix. Stores built with KeyValueStore.make that don't provide clearPrefix remove the matching keys one by one instead of clearing everything.

Both backings now store entries under <storeId>:<key>, with % and : in the store id percent-encoded.

Key layout change. Entries written by earlier versions are not read back:
- Persistence.layerKvs / layerBackingKvs: every existing entry becomes unreachable, because keys used to be <storeId><key> with no separator. Cached results are recomputed. Chat.layerPersisted on a KeyValueStore backing loses its stored chat histories.
- Persistence.layerRedis / layerBackingRedis: keys are unchanged unless the store id contains % or :. Entries for those store ids become unreachable.
Old entries are not migrated or removed automatically.
#8829 4f16778 Thanks @effect-bot! - Add the unstable Pool.Stats and Pool.stats APIs for sampling how many pool items are idle or in use and how many borrowers are waiting. PgPool.stats and PgClient.poolStats expose the same snapshot for PostgreSQL sessions, so applications can export connection pool metrics without reaching into pool internals.
#8829 d2b6bc7 Thanks @jpowersdev! - Add experimental Glob path matching and a shared FileSystem.glob implementation for Node, Bun, and Deno.
- Breaking: custom FileSystem implementations, including inputs to FileSystem.make, must provide readDirectoryEntries; mapping readDirectory names to { name, type: "Unknown" } is supported. Wrappers must apply directory-listing changes to both methods.
- FileSystem.make now derives glob instead of accepting it. Apply custom overrides afterward with FileSystem.of({ ...fs, glob: customGlob }).
- Glob patterns use / separators and backslash escapes; Node extglobs no longer expand. Results use / separators and are relative to root unless the pattern is absolute. Deno wildcards now skip dotfiles unless explicitly named or dot: true; unreadable wildcard-reached directories are skipped, while read failures at the root or a leading literal directory propagate.
#8829 3d88452 Thanks @fubhy! - Add CommandLine to effect/process for quoting and joining command lines, and support Redacted arguments and env values in ChildProcess.

Migration:
- ChildProcess.make templates keep quoted words together and throw a CommandLineError for shell syntax such as |, $HOME or *. Quote such characters or pass them with ${}.
- With the shell option, templates cannot contain ${} values and extra arguments fail with BadArgument. Pass the whole script as the command, built with CommandLine.join.
- StandardCommand.args and env values can be Redacted strings.
- ChildProcess.TemplateExpression and ChildProcess.TemplateExpressionItem are removed. Use the CommandLine types of the same name.
#8829 3c42058 Thanks @effect-bot! - Remove AiError.HttpRequestDetails and Response.HttpRequestDetails, so AI errors and response metadata no longer carry request headers or query parameters. AiError.NetworkError records the request as method and url fields instead of request, and the request field is gone from AiError.HttpContext and Response.ResponseMetadataPart.
#8829 2ae4045 Thanks @tim-smart! - Calls made with discard: true now complete when the server acknowledges them, instead of when the request is written.

SchemaBinary peers must be upgraded together because the new discard field changes the envelope fingerprint.
#8829 e853fa1 Thanks @effect-bot! - Add an onDisconnect option to RpcServer.make and its layer and HTTP wrappers, so applications can observe client disconnects without taking from Protocol.disconnects and preventing the server from interrupting the disconnected client's requests.
#8829 1194a4c Thanks @bezff! - sql.insert and sql.updateValues now require a non-empty array of rows at the type level. Narrow array inputs with Array.isReadonlyArrayNonEmpty before passing them to these helpers.
#8829 2cb498e Thanks @effect-bot! - Fix a SQLite client hanging forever after a queued withTransaction or reserve was interrupted just as it received the connection. The interrupted acquisition could keep the connection's only permit without registering its release.

Add Semaphore.takeScoped, which holds permits until the current scope closes. Waiting can be interrupted unless the caller is uninterruptible, and acquired permits are always returned when the scope closes.
#8829 89e5443 Thanks @jpowersdev! - Add Terminal.size, a scoped queue that starts with the current terminal dimensions and receives each resize. Custom terminals passed to Terminal.make must now supply size.
#8829 2a9a425 Thanks @jayhemnani9910! - Toml.parse now returns a Result instead of throwing, failing with an EncodingError on invalid input. It also rejects documents that extend an inline table or a statically defined array, which TOML 1.0 forbids.

Patch Changes

#8829 ed20129 Thanks @effect-bot! - Report unobserved release failures at UnhandledLogLevel for RcMap and RcRef idle expiry, abandoned interrupted RcMap lookups, and ScopedCache expiry discovered by keys, values, or entries scans. Preserve failure propagation when cleanup is observed by a caller.
#10076 20795b9 Thanks @jpowersdev! - Base64Url.decode and Base64Url.decodeString now reject partially padded input such as Zg=. Unpadded input (Zg) and fully padded input (Zg==) still decode.
#10083 a8e5e6c Thanks @jpowersdev! - Fix BigDecimal.fromString and BigDecimal.fromStringUnsafe accepting a sign after the decimal point.
#10093 fb5dbee Thanks @tim-smart! - Release a frozen runner's MySQL shard locks after shardLockExpiration. SqlRunnerStorage sets wait_timeout on its MySQL lock connection, and restores it before returning the connection to the pool, so a runner that stops refreshing loses its named locks instead of holding them until the server drops its TCP connection. Vitess ignores wait_timeout, so runners behind Vitess keep the previous behavior.
#10095 8309b94 Thanks @tim-smart! - Restore idle_session_timeout on the PostgreSQL shard-lock connection before SqlRunnerStorage returns it to the pool, so other queries on that connection no longer have their session ended after shardLockExpiration idle.
#8829 af23904 Thanks @devangpratap! - Reject an append assignment such as FOO+=bar cmd in CommandLine.template and ChildProcess.make with UnsupportedSyntax, as FOO=bar cmd already is, instead of running FOO+=bar as the program.
#8829 468c6ee Thanks @tim-smart! - Keep the source context's maxDepth when Context.pick is given zero or one key, and reduce the bundle size of Context.makeUnsafe.
#8829 fe6b748 Thanks @effect-bot! - Support duplex additionalFds through getInputFd and getOutputFd, preserving both directions when used with pipeTo.
#10064 e75708c Thanks @gcanti! - Fix SchemaRepresentation.toCodeDocument losing __proto__ properties or changing object prototypes in generated annotations.
#10086 7890077 Thanks @jpowersdev! - HttpTraceContext.fromHeaders now rejects uppercase hex trace and span IDs in traceparent, b3 and X-B3-* headers, matching the lowercase encodings required by W3C Trace Context and B3. Previously they were accepted and propagated unchanged, which conforming downstream receivers reject.
#10085 c4a00fc Thanks @jpowersdev! - Reject traceparent headers with malformed trace flags in HttpTraceContext. Flags that are not two lowercase hexadecimal digits now return Option.none() instead of continuing the trace.
#8829 8938b19 Thanks @effect-bot! - Make remove on KeyValueStore.layerFileSystem succeed when the key does not exist, matching the other backends.
#8829 89e1e1e Thanks @tim-smart! - Stop McpServer from sending stateful clients list-change notifications for changes made before the server handled their initialize request, over stdio, HTTP sessions and custom transports.
#8829 eda0960 Thanks @effect-bot! - Let McpServer middleware and visibility layers receive per-request services from HttpRouter.middleware under layerHttp. Unmet per-request services now stay as McpRequest<"Requires", S> layer requirements, replacing MissingRequestDependencies.
#8829 89e1e1e Thanks @tim-smart! - Add McpTest.makeClient, an in-memory MCP client for testing McpServer registrations over the JSON-RPC wire encoding.
#10062 e19c611 Thanks @duailibe! - Otlp.layer, Otlp.layerFromConfig, Otlp.layerJson and Otlp.layerProtobuf now declare the shared OtlpExporter.Flusher they provide, instead of Layer<never>.
#10065 8e668fe Thanks @jpowersdev! - Preserve a leading UTF-8 BOM in URL-encoded body field names.
#10067 ce9e999 Thanks @jpowersdev! - Preserve a leading ? in URL-encoded form field names. urlParamsBody previously dropped it as a query-string prefix, so ?name=value decoded to name.
#8829 6dc3f7c Thanks @jpowersdev! - Add the unstable Csv module to effect/encoding for streaming CSV parsing and writing over text or UTF-8 bytes, with header records and schema adapters that convert cells through Schema.toCodecStringTree.
#10050 1513bbd Thanks @gcanti! - Prevent excessive CPU use when Schema.fromFormData and Schema.fromURLSearchParams decode field names containing unmatched opening brackets.
#10061 c065ed7 Thanks @gcanti! - Fix Schema.TaggedUnion.match and matchOrElse return inference and handler input types, and narrow matchOrElse fallbacks to unhandled variants.

Remove explicit output type arguments from Schema.TaggedUnion.match and matchOrElse calls; annotate handler return types when an explicit output is needed.
#8829 e710bbb Thanks @devangpratap! - Fix Toml.parse accepting out of range dates and times such as 1979-02-30 or 24:00:00, and rolling 1979-02-30T07:32:00Z over to March 2 instead of rejecting it.
#8829 b0d6e75 Thanks @jayhemnani9910! - Fix Toml.parse rejecting multiline basic and literal strings ending with one or two content quotes.
#10068 32b3570 Thanks @effect-bot! - Store the empty string key in Trie instead of silently discarding it. Construction, lookup, replacement, modification, removal, iteration and longestPrefixOf now treat "" like any other key.
#10051 9f93f4f Thanks @okarin1511! - Support YAML 1.1 merge keys (<<) in Yaml.parse. An unquoted << key merges a mapping, or a sequence of mappings, into the enclosing mapping. Explicit keys take precedence over merged keys, and earlier merge sources over later ones. Quote the key ("<<") to keep it as an ordinary key.
#10069 27370c7 Thanks @effect-bot! - Fix Yaml.parse rejecting block sequence entry mappings whose first key sits more than one space after the dash. Later keys in the entry must now align with the first key, and a tab before the first key is rejected.

`v4.0.7`

Compare Source

Patch Changes

#6743 ac3485a Thanks @IMax153! - Add a scoped CliOutput.Presenter service for suppressing, redirecting, or replacing built-in CLI help, invalid-invocation, and version output.
#9873 3a4c691 Thanks @effect-bot! - Require tool parameter schema services in Response.AllParts, Response.Part and Response.StreamPart, including for toolkits with handlers, and add Tool.ParametersDecodingServices.
#9861 4f0600e Thanks @effect-bot! - Add a toModelOutput option to Tool.make and Tool.dynamic for sending text, images and files to the model in place of the serialized tool result. Anthropic and OpenAI Responses send native content blocks; OpenAI-compatible APIs and OpenRouter send text with a placeholder for each file, via the new Prompt.toolModelOutputToText.

OpenAI Responses now sends PDF file parts given as base64, data URL or HTTP(S) URL strings instead of dropping them.
#9377 110fd22 Thanks @gcanti! - Add a concurrency option to Arbitrary.checkEffect and global check configuration to run independent property evaluations concurrently. Results remain deterministic for deterministic generators and repeatable properties, while shrinking and replay stay sequential. The default concurrency is 1.
#9811 aa58cda Thanks @effect-bot! - Speed up Base64.encode and Base64Url.encode on large inputs and reduce the memory they allocate.
#9913 8e257e7 Thanks @Marve10s! - Fix duplicate interrupt reasons when interrupting a fiber inside Effect.withSpan or Effect.fn.
#9846 e62a149 Thanks @mkantautas! - Fix ChildProcessSpawner helpers hanging when a command fills a pipe the helper never reads. exitCode now reads and discards stdout and stderr until the process exits, and string, lines, streamString and streamLines read and discard stderr unless includeStderr is set. A failure reading that output while the helper runs, such as from an output Sink, now fails the helper.
#9794 dcd43a5 Thanks @effect-bot! - Clarify that ChildProcess output sinks for stdout, stderr and output additionalFds only receive data while the corresponding handle stream is consumed, and that the handle stream emits the sink's results.
#9921 3388cdd Thanks @Marve10s! - Fix Bash completion of file and directory paths containing spaces, quotes or glob characters.
#9976 81b0e14 Thanks @effect-bot! - Add Completions.fromCommand to effect/cli. It converts an existing Command tree into a CommandDescriptor, so build tooling can generate shell completion scripts with Completions.generate without running the CLI.
#9881 a046435 Thanks @effect-bot! - Skip Flag.withFallbackPrompt and Argument.withFallbackPrompt fallbacks when TerminalCapabilities.canPrompt is false, failing with the original MissingOption or MissingArgument error instead of rendering a prompt or waiting for input.
#9922 f6d8968 Thanks @Marve10s! - Show command help for invalid global flag values instead of failing with a raw parse error.
#8349 5741c3a Thanks @ArjunCodess! - Add the CliError.userMessage annotation so Command.run renders tagged handler errors without wrapping them in CliError.UserError.
#9959 381d5c6 Thanks @baptisteArno! - Record ClickHouse migrations only after they succeed, so a failed migration and the ones after it are retried on the next run.
#10001 d47478a Thanks @tim-smart! - Stop a runner that lost a shard lock from storing the final reply of a persisted request on that shard. Before storing it, the runner refreshes its shard locks and checks that the shard is still among them. If it is not, the request is left for the shard's new owner.
#10037 383716d Thanks @tim-smart! - Release a frozen runner's PostgreSQL advisory shard locks after shardLockExpiration. On PostgreSQL 14+, SqlRunnerStorage sets idle_session_timeout on its lock connection, so a runner that stops refreshing loses its locks instead of holding them until the server drops its TCP connection.

With advisory locks on PostgreSQL and MySQL, SqlRunnerStorage refresh now only confirms locks its current lock session holds. After the lock connection is replaced, shards held by the previous session are reported lost instead of being silently reacquired.
#9817 46dc30a Thanks @effect-bot! - Fix cluster shutdown waiting for entityTerminationTimeout when a workflow is waiting on a persisted activity request that has not started. During runner shutdown the caller is now abandoned so the request replays under the next owner, and a durable caller abandoned this way is left for replay instead of being answered with an interrupt. With preemptiveShutdown: false, entities drain before the runner is marked as shutting down, so such a caller still waits for entityTerminationTimeout.
#9985 3d5c862 Thanks @tim-smart! - Fix a cluster workflow replay ignoring a durable deferred completion that is persisted but not yet processed by the new owner. A DurableDeferred.raceAll could pick a different winner on replay and run the wrong branch. Workflow replays now read the stored completion from the unprocessed request when it has no reply yet.
#9845 93ebc4f Thanks @effect-bot! - Fix ClusterWorkflowEngine running a completed step's compensation twice when interruptUnsafe interrupts a workflow during a running activity.
#9938 c7b161a Thanks @effect-bot! - Fix a forced shard release stalling forever when a child workflow wakes its still-running parent. The wake's cluster abandonment was retried, so it waited on the retired run and blocked the shard from being reacquired. The abandonment now interrupts the wake, so the activation unwinds, the release completes, and the parent is resumed under the next owner.
#10034 e55945d Thanks @jpowersdev! - Fix HttpClientRequest.compressBody replacing the request's Content-Type with the body's content type. Compression now only updates the Content-Encoding and Content-Length headers.
#10035 1a53d6a Thanks @jpowersdev! - Fix HttpMiddleware.compression sending an uncompressed response when Accept-Encoding contains an empty list member, such as gzip,. Empty members are now ignored as RFC 9110 requires.
#9769 5e25cc9 Thanks @Marve10s! - Fix Equal.equals and Hash.hash treating any two same-length ArrayBuffers as equal. ArrayBuffer and SharedArrayBuffer are now compared and hashed by their bytes.
#9799 9503d5c Thanks @effect-bot! - Fix Exit.hasFails, Exit.hasDies, Exit.hasInterrupts, and AsyncResult.isInterrupted narrowing away every failure when they return false. They now return boolean, like the matching Cause checks; use Exit.isFailure or AsyncResult.isFailure to narrow.
#10026 13efb72 Thanks @tim-smart! - Prevent later Semaphore.take calls from overtaking eligible queued requests while preserving mixed-size overtaking.
#9767 8ca6abb Thanks @Marve10s! - Fix Queue.offerAll, MutableList.appendAll and MutableList.prependAll keeping a reference to the caller's array. Changing that array afterward no longer changes the queued values.
#9982 4a09dd1 Thanks @jpowersdev! - Fix JsonSchema.toDocumentDraft07 emitting enum: [], which the Draft-07 metaschema rejects. An empty enum now becomes an allOf entry that rejects every value.
#9754 346fc92 Thanks @gcanti! - Fix Schema.isCapitalized and Schema.isUncapitalized accepting astral letters with the wrong case.
#9967 20e5ba8 Thanks @gcanti! - Fix Schema.isULID to reject values exceeding the 128-bit ULID limit.
#9878 f4b237e Thanks @Hona! - Fix Effect.fn stack frames retaining call arguments. A fiber forked inside an Effect.fn call inherits the frame, which kept the arguments of that call and of every traced call above it alive for as long as the fiber ran.
#9887 1dd08ee Thanks @jayhemnani9910! - Fix HttpClient.followRedirects re-encoding the query of the Location it follows (%20 became +, flag became flag=, and invalid UTF-8 bytes were replaced with U+FFFD). The redirected request now uses the resolved Location URL without rewriting its query.
#9948 940be42 Thanks @chiefcll! - Format values with own getters in Formatter.formatJson and Cause.pretty without Proxy, so engines that lack it no longer throw a ReferenceError. Getter results stay redacted on every engine.
#10029 37be245 Thanks @jpowersdev! - Fix HttpStaticServer dropping Content-Location, Date, Expires and Vary from 304 responses.
#9944 563fde0 Thanks @effect-bot! - Add HttpApiClient.decodeResponse to decode a raw endpoint response with the endpoint's declared success and error schemas, for example after a responseMode: "response-only" call.
#9796 938cecb Thanks @effect-bot! - Reject . and .. path parameters in HttpApiClient so they cannot change the request path through URL normalization.
#9869 cf197c1 Thanks @sarankumar1325! - Describe undeclared response statuses in HttpApiClient errors. The reason is still a DecodeError, now with the description undeclared status code, so the message reads Decode: undeclared status code (418 GET ...) instead of Decode error (418 GET ...).
#9998 7ca71bb Thanks @tim-smart! - Make HttpApiClient close the upgraded connection of an `HttpApi

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Chicago)

Branch creation
- Only on Thursday (* * * * 4)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-11-05T07:31:39Z

This PR does not match any of the 1 configured review trigger rule.

coderabbitai · 2026-11-05T07:31:42Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: ea3e8ac3-f656-4c88-9342-c8b2f10d0e72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

socket-security · 2026-11-05T07:32:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@types/node@26.6.5 ⏵ 26.6.6	⁺¹		⁺¹	^-1

View full report

chore(deps): update npm packages

5527d82

renovate Bot enabled auto-merge (squash) November 5, 2026 07:31

chore(deps): regenerate dependency artifacts

9338bcd

renovate Bot merged commit c86b600 into main Nov 5, 2026
15 checks passed

renovate Bot deleted the renovate/npm-non-major branch November 5, 2026 07:47

mise-en-dev mentioned this pull request Nov 5, 2026

chore: release v7.2.1 #1616

Open

Navigation Menu

Repository navigation

chore(deps): update npm packages - #1620

chore(deps): update npm packages#1620
renovate[bot] merged 2 commits into
mainfrom
renovate/npm-non-major

renovate Bot commented Nov 5, 2026

Uh oh!

greptile-apps Bot commented Nov 5, 2026

Uh oh!

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading

Review skipped

Uh oh!

socket-security Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 5, 2026

Release Notes

v4.1.0

Minor Changes

Breaking changes

Patch Changes

v4.0.7

Patch Changes

Configuration

Uh oh!

greptile-apps Bot commented Nov 5, 2026

Uh oh!

coderabbitai Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

socket-security Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v4.1.0`

`v4.0.7`

coderabbitai Bot commented Nov 5, 2026 •

edited

Loading