[dependabot]

Bumps effect from 4.0.6 to 4.1.1.

Release notes

Sourced from effect's releases.

effect@4.1.1

Patch Changes

• #10186 8567117 Thanks @​effect-bot! - Restore SchemaBinary.toCodec derivation for Prompt.FilePart and the AI response part schemas that include it.

• #10119 3f5c6aa Thanks @​Marve10s! - Fix AtomRegistry.subscribe without immediate never notifying for an atom that has not been read yet. Subscribing now builds the atom, so the listener hears later changes. This also fixes get.subscribe, get.stream with withoutInitialValue, and useAtomSubscribe in @effect/atom-react.

  A failed build no longer makes subscribe throw: the next read reports the failure, and the listener hears the recovery. An error thrown by a failed build's finalizer no longer aborts the next build; it is reported once that build has its value.

• #10189 29b89b6 Thanks @​tim-smart! - Speed up Base64Url.decode and Base64Url.decodeString by decoding the URL-safe alphabet directly, instead of transliterating the input and decoding it again as standard Base64.

• #10188 0b4cfbc Thanks @​effect-bot! - Limit BigDecimal scales to prevent resource exhaustion.

  • BigDecimal.fromString and Schema.BigDecimalFromString reject strings whose scale, before or after removing trailing zeros, is outside ±10,000, such as "1e300000000", "10e10000" or more than 10,000 fractional digits. BigDecimal.fromStringUnsafe throws for them.
  • Operations that align scales (sum, subtract, remainder, scale, round, truncate, ceil, floor) throw a RangeError when the scales differ by more than 20,000.
  • round returns values already at or below the target scale unchanged.

• #10192 088510f Thanks @​effect-bot! - Enforce MaxBodySize on buffered request body reads in BunHttpServer, DenoHttpServer, and HttpServerRequest.fromClientRequest.

• #10142 ad62cd7 Thanks @​effect-bot! - Add onRejection to CircuitBreaker.execute. With "allow", a call the circuit would refuse with CircuitOpen or CircuitHalfOpen runs unrecorded instead, while a call the circuit admits, probe included, is recorded as usual. Calls that must always run can then still count towards the breaker's state. Defaults to "fail", which keeps the current behavior.

• #10169 ba406a5 Thanks @​tim-smart! - Pass { probe } to CircuitBreaker classify callbacks, including HttpClient.withCircuitBreaker. probe is true when the call is the HalfOpen probe, so a classifier can count an outcome it otherwise ignores, such as a rate-limited response, as a failure that reopens the circuit. Existing one-argument classifiers are unchanged. The callback type is exported as CircuitBreaker.Classifier.

• #10126 5e56eba Thanks @​baptisteArno! - Fix ClickhouseMigrator failing to create its migrations table or record applied migrations, by running those statements as ClickHouse commands instead of queries. Migrator.make accepts an optional transformWrites option for these statements, defaulting to identity.

• #10206 6a95d51 Thanks @​effect-bot! - Retry transient PersistenceErrors when a cluster workflow sends an activity or reads its reply during a pending interrupt, instead of storing the failure as a workflow defect. A request whose save was committed but not acknowledged is deduplicated, so the activity still runs once.

  A cluster client request whose send fails is no longer retained by Sharding.

• #10205 24d5acd Thanks @​effect-bot! - Fix local callers of persisted entity requests hanging when a reply save commits but reports a failure, for example when the connection drops before the COMMIT acknowledgement arrives. The runner now checks storage for the committed reply and lets the caller read it, without replaying the request.

• #10163 c38dfa0 Thanks @​effect-bot! - Fix persisted success replies being stored after a ClusterSchema.WithTransaction request transaction rolled back. A failed save inside the request transaction is no longer retried, since a retry could autocommit the reply outside the aborted transaction (for example after a MySQL deadlock). The failed transaction now replays the request instead.

• #10197 f2755e7 Thanks @​effect-bot! - Fix type-checking the effect crypto declarations with @types/node 22 or 24 and without the DOM library. The *FromCryptoKey constructors in Aead, Cipher, KeyAgreement, KeyWrap, Mac and Signature now accept the new structural WebCrypto.CryptoKey type instead of the global CryptoKey, and DOM and Node Web Crypto keys are both assignable to it. The WebCrypto reference and WebCrypto.layer now use the type of globalThis.crypto instead of the global Crypto type.

• #10137 a40cb20 Thanks @​effect-bot! - Fix DateTime.Zoned exposing its adjustedEpochMilliseconds cache as an enumerable property after DateTime.toDate, which broke Object.keys, spread and deep equality.

• #10174 bd6b9c2 Thanks @​effect-bot! - Speed up DateTime construction by creating the partsUtc, adjustedEpochMilliseconds and partsAdjusted cache properties on first use. Reading and writing these fields is unchanged, but Object.hasOwn, Object.getOwnPropertyNames and Object.getOwnPropertyDescriptor no longer report them before the caches are populated, or at all on instances sealed or frozen before first use. Reading the parts of, or writing these fields on, an instance frozen before first use no longer throws.

• #10082 49d84d6 Thanks @​typedrat! - Fix Equal.equals and Hash.hash throwing on plain objects whose "~effect/Equal" or "~effect/Hash" key is not a function. Such values are now treated as data.

• #10185 a8f77d5 Thanks @​effect-bot! - Verify the session authentication signature before an EventLog server binds a signing key to an identity, and reject a verified key that differs from the identity's existing binding. A request with an invalid signature no longer creates a binding.

  EventLogServerUnencrypted.EventLogServerAuthorization.authorizeIdentity and the authorizeIdentity option of EventLogServer.layerRpcHandlers now also receive the presented signing public key. Use the new EventLogSessionAuth.deriveSigningPublicKey to record an identity's signing key at provisioning time and reject any other key.

• #10164 7a9c22f Thanks @​effect-bot! - Stop finished fibers from retaining their last span and stack frame. A finished fiber kept alive by a cache entry, observer or Deferred no longer keeps the ended span's parent chain, and the success values recorded on those spans, from being garbage collected.

• #10145 efcb8cc Thanks @​jpowersdev! - Fix Host.domainNameFromString rejecting decomposed Unicode domain names.

• #10125 378f5f0 Thanks @​pujitha24! - Fix Effect.request retaining completed requests and their async context in its batch pool.

... (truncated)

Changelog

Sourced from effect's changelog.

4.1.1

Patch Changes

• #10186 8567117 Thanks @​effect-bot! - Restore SchemaBinary.toCodec derivation for Prompt.FilePart and the AI response part schemas that include it.

• #10119 3f5c6aa Thanks @​Marve10s! - Fix AtomRegistry.subscribe without immediate never notifying for an atom that has not been read yet. Subscribing now builds the atom, so the listener hears later changes. This also fixes get.subscribe, get.stream with withoutInitialValue, and useAtomSubscribe in @effect/atom-react.

  A failed build no longer makes subscribe throw: the next read reports the failure, and the listener hears the recovery. An error thrown by a failed build's finalizer no longer aborts the next build; it is reported once that build has its value.

• #10189 29b89b6 Thanks @​tim-smart! - Speed up Base64Url.decode and Base64Url.decodeString by decoding the URL-safe alphabet directly, instead of transliterating the input and decoding it again as standard Base64.

• #10188 0b4cfbc Thanks @​effect-bot! - Limit BigDecimal scales to prevent resource exhaustion.

  • BigDecimal.fromString and Schema.BigDecimalFromString reject strings whose scale, before or after removing trailing zeros, is outside ±10,000, such as "1e300000000", "10e10000" or more than 10,000 fractional digits. BigDecimal.fromStringUnsafe throws for them.
  • Operations that align scales (sum, subtract, remainder, scale, round, truncate, ceil, floor) throw a RangeError when the scales differ by more than 20,000.
  • round returns values already at or below the target scale unchanged.

• #10192 088510f Thanks @​effect-bot! - Enforce MaxBodySize on buffered request body reads in BunHttpServer, DenoHttpServer, and HttpServerRequest.fromClientRequest.

• #10142 ad62cd7 Thanks @​effect-bot! - Add onRejection to CircuitBreaker.execute. With "allow", a call the circuit would refuse with CircuitOpen or CircuitHalfOpen runs unrecorded instead, while a call the circuit admits, probe included, is recorded as usual. Calls that must always run can then still count towards the breaker's state. Defaults to "fail", which keeps the current behavior.

• #10169 ba406a5 Thanks @​tim-smart! - Pass { probe } to CircuitBreaker classify callbacks, including HttpClient.withCircuitBreaker. probe is true when the call is the HalfOpen probe, so a classifier can count an outcome it otherwise ignores, such as a rate-limited response, as a failure that reopens the circuit. Existing one-argument classifiers are unchanged. The callback type is exported as CircuitBreaker.Classifier.

• #10126 5e56eba Thanks @​baptisteArno! - Fix ClickhouseMigrator failing to create its migrations table or record applied migrations, by running those statements as ClickHouse commands instead of queries. Migrator.make accepts an optional transformWrites option for these statements, defaulting to identity.

• #10206 6a95d51 Thanks @​effect-bot! - Retry transient PersistenceErrors when a cluster workflow sends an activity or reads its reply during a pending interrupt, instead of storing the failure as a workflow defect. A request whose save was committed but not acknowledged is deduplicated, so the activity still runs once.

  A cluster client request whose send fails is no longer retained by Sharding.

• #10205 24d5acd Thanks @​effect-bot! - Fix local callers of persisted entity requests hanging when a reply save commits but reports a failure, for example when the connection drops before the COMMIT acknowledgement arrives. The runner now checks storage for the committed reply and lets the caller read it, without replaying the request.

• #10163 c38dfa0 Thanks @​effect-bot! - Fix persisted success replies being stored after a ClusterSchema.WithTransaction request transaction rolled back. A failed save inside the request transaction is no longer retried, since a retry could autocommit the reply outside the aborted transaction (for example after a MySQL deadlock). The failed transaction now replays the request instead.

• #10197 f2755e7 Thanks @​effect-bot! - Fix type-checking the effect crypto declarations with @types/node 22 or 24 and without the DOM library. The *FromCryptoKey constructors in Aead, Cipher, KeyAgreement, KeyWrap, Mac and Signature now accept the new structural WebCrypto.CryptoKey type instead of the global CryptoKey, and DOM and Node Web Crypto keys are both assignable to it. The WebCrypto reference and WebCrypto.layer now use the type of globalThis.crypto instead of the global Crypto type.

• #10137 a40cb20 Thanks @​effect-bot! - Fix DateTime.Zoned exposing its adjustedEpochMilliseconds cache as an enumerable property after DateTime.toDate, which broke Object.keys, spread and deep equality.

• #10174 bd6b9c2 Thanks @​effect-bot! - Speed up DateTime construction by creating the partsUtc, adjustedEpochMilliseconds and partsAdjusted cache properties on first use. Reading and writing these fields is unchanged, but Object.hasOwn, Object.getOwnPropertyNames and Object.getOwnPropertyDescriptor no longer report them before the caches are populated, or at all on instances sealed or frozen before first use. Reading the parts of, or writing these fields on, an instance frozen before first use no longer throws.

• #10082 49d84d6 Thanks @​typedrat! - Fix Equal.equals and Hash.hash throwing on plain objects whose "~effect/Equal" or "~effect/Hash" key is not a function. Such values are now treated as data.

• #10185 a8f77d5 Thanks @​effect-bot! - Verify the session authentication signature before an EventLog server binds a signing key to an identity, and reject a verified key that differs from the identity's existing binding. A request with an invalid signature no longer creates a binding.

  EventLogServerUnencrypted.EventLogServerAuthorization.authorizeIdentity and the authorizeIdentity option of EventLogServer.layerRpcHandlers now also receive the presented signing public key. Use the new EventLogSessionAuth.deriveSigningPublicKey to record an identity's signing key at provisioning time and reject any other key.

• #10164 7a9c22f Thanks @​effect-bot! - Stop finished fibers from retaining their last span and stack frame. A finished fiber kept alive by a cache entry, observer or Deferred no longer keeps the ended span's parent chain, and the success values recorded on those spans, from being garbage collected.

• #10145 efcb8cc Thanks @​jpowersdev! - Fix Host.domainNameFromString rejecting decomposed Unicode domain names.

... (truncated)

Commits

• bc492f0 Version Packages (#10144)
• 6a95d51 Retry transient activity persistence failures in ClusterWorkflowEngine (#10206)
• 7d6ead4 Add HttpClient.timeout (#10207)
• d4272bd Fail GraphQL calls on non-2xx HTTP responses (#10208)
• 24d5acd Recover local persisted replies after lost commit acknowledgements (#10205)
• 20cca92 Fix Ndjson ignoreEmptyLines handling of space/tab-only lines (#10204)
• f2755e7 Fix Node-only type-checking of crypto key declarations (#10197)
• 9394b6d Support object anyOf branches that redeclare enum properties (#10070)
• 0b4cfbc Bound BigDecimal scale parsing and alignment (#10188)
• 088510f Enforce MaxBodySize on Bun, Deno and fromClientRequest buffered reads (#10192)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps effect from 4.0.6 to 4.1.1 in the root package, updating package.json and bun.lock.

• The lock file keeps effect@4.0.6 for the @opencode/* workspace packages, so those still resolve the old version.

^{Written for commit c418767. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: c418767

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f37969f1-6067-41da-802f-d0081725e87a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	effect@​4.1.1

View full report