[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@effect/platform-node (source)	4.0.6 → 4.1.0
@effect/platform-node-shared (source)	4.0.6 → 4.1.0
@effect/vitest (source)	4.0.6 → 4.1.0
effect (source)	4.0.6 → 4.1.0

---

Release Notes

Effect-TS/effect (@​effect/platform-node)

v4.1.0

Compare Source

Minor Changes

• #​8829 8f23668 Thanks @​fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

Breaking changes

• Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
• Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
• Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

• #​10087 472c469 Thanks @​effect-bot! - Node.js 22.19.0 (required by undici 8) is now the minimum for @effect/platform-node, @effect/platform-node-shared, @effect/opentelemetry and @effect/docgen, up from 18.

  NodeSocket WebSocket clients now use Node's global WebSocket instead of ws, so client-only usage no longer bundles ws.

  Breaking: ws moved to a new NodeWS module.

  • NodeSocket.NodeWS and BunSocket.NodeWS are removed. Import NodeWS from @effect/platform-node or @effect/platform-node-shared (on Bun, import ws directly). Use NodeWS.WebSocket in place of NodeSocket.NodeWS.default.
  • NodeSocket.layerWebSocketConstructorWS is removed. Use NodeWS.layerWebSocketConstructor.

  Behaviour changes for clients that pass handshake headers, which previously used ws. Use NodeWS.layerWebSocketConstructor to keep the old behaviour:

  • Reads cannot be paused. Incoming frames are buffered without limit, and a configured highWaterMark fails the socket with a SocketReadError.
  • Connection errors are a generic ErrorEvent, so SocketOpenError causes lack the underlying error code.
  • The Socket.WebSocket service is a global WebSocket, so ws instanceof checks and ws-only methods such as terminate() and ping() no longer apply.
  • A custom Host header is ignored.
  • Outgoing messages are not compressed. Incoming permessage-deflate messages are still decompressed.
  • Connections use undici's global dispatcher instead of http.globalAgent / https.globalAgent.

Patch Changes

• #​10081 438ce72 Thanks @​effect-bot! - NodeHttpClient.layerNodeHttp now encodes FormData request bodies with the global Response, so it no longer loads the undici package. Bundles that use the node:http client no longer include undici. File contents are still streamed as the upload needs them, and a file that cannot be read still fails the request with a TransportError. The Undici-backed client is unchanged.

• #​10071 19d36b8 Thanks @​effect-bot! - Convert Node HTTP server request headers to Headers instead of casting them, so configured header redaction applies when request headers are logged or inspected.

• #​10065 8e668fe Thanks @​jpowersdev! - Preserve a leading UTF-8 BOM in URL-encoded body field names.

• #​10067 ce9e999 Thanks @​jpowersdev! - Preserve a leading ? in URL-encoded form field names. urlParamsBody previously dropped it as a query-string prefix, so ?name=value decoded to name.

• Updated dependencies [631d4f4, 7ea1ea2, a2ccc14, ed20129, 20795b9, a8e5e6c, 66c796a, c4d298d, fb5dbee, 8309b94, ac10e55, af23904, df8dce5, 0c24a8f, 468c6ee, 2d1fcd4, 8f23668, 3f8f359, fe6b748, 2a03584, 40e145e, 7217410, cf249fe, 4f0fad1, e75708c, 7890077, c4a00fc, f74db37, 069cf72, 9a07ebc, f40dc4e, fa516c6, ffd9237, 93895b9, 8938b19, e5a1479, 89e1e1e, eda0960, 65db606, 7c42335, cb21d14, 89e1e1e, c32eb78, be9895b, 472c469, 26b4bfe, e19c611, f97711f, 4f16778, d2b6bc7, 8e668fe, ce9e999, 3d88452, 3c42058, 2ae4045, e853fa1, 6dc3f7c, 1513bbd, c065ed7, 1194a4c, 2cb498e, 89e5443, 2a9a425, e710bbb, b0d6e75, 32b3570, 9f93f4f, 27370c7]:

  • effect@​4.1.0
  • @​effect/platform-node-shared@4.1.0

v4.0.7

Compare Source

Patch Changes

• #​9751 fb38ce6 Thanks @​effect-bot! - Allow buffered payloads and typed 101 response headers on HttpApiSchema.Upgrade endpoints.

  • HttpApiSchema.Upgrade({ protocol, headers }) declares 101 headers, encoded like WithHeaders headers. Clients decode them and return { headers, socket }, and OpenAPI lists them on the 101.
  • Upgrade endpoints can declare buffered payloads. Streaming payloads are still rejected.
  • Handlers receive an upgrade function instead of socket: upgrade(), or upgrade({ headers }) when headers are declared.
  • 426 Upgrade Required is returned before the payload is decoded.
  • HttpServerRequest gains upgradeWith({ headers }), and upgrade is upgradeWith({}). Third-party HttpServerRequest implementations must add it. WebSocket upgrades fail when headers are given.
  • NodeHttpServer waits for the request body to end before writing the 101. On Node 25 and older, which do not parse upgrade request bodies, it reads Content-Length bodies from the connection and answers chunked ones with 411 Length Required.
  • NodeMultipart fails with a MultipartError when its source stream errors, instead of waiting for more input.

• #​10004 4ee3a67 Thanks @​athammer! - Fix NodeHttpServer hanging or reporting a defect when an HTTP/1 client disconnects before the response is written.

• #​9978 07ca583 Thanks @​jpowersdev! - Fix NodeMultipart.stream hanging when the source closes early or is already destroyed, including any file part still being read, and remove its source listeners once parsing finishes.

• #​9828 45c467a Thanks @​tim-smart! - Add Redis.reserve, which leases a dedicated connection from a pool, so blocking commands like XREAD BLOCK and BLPOP no longer hold up other commands on the shared connection. NodeRedis, BunRedis and DenoRedis layers accept maxConnections, minConnections, idleTimeout and acquireTimeout to size the pool.

  Redis.make now requires a connect option, and hand-written Redis services need a reserve member.

• Updated dependencies [ac3485a, 3a4c691, 4f0600e, 110fd22, aa58cda, 8e257e7, e62a149, 958307b, dcd43a5, 5fbccf4, 3388cdd, 81b0e14, a046435, f6d8968, 5741c3a, 381d5c6, d47478a, 383716d, 46dc30a, 3d5c862, 93ebc4f, c7b161a, e55945d, 1a53d6a, 5e25cc9, 9503d5c, 13efb72, 8ca6abb, 4a09dd1, 346fc92, 20e5ba8, f4b237e, 1dd08ee, 940be42, 37be245, 563fde0, 938cecb, cf197c1, 7ca71bb, 1e73219, 4dd860d, 4d24a11, 6bbc5ac, 5fd25f4, a461561, 832b3c6, 837e906, cd1f2d4, fb38ce6, 446c7ac, b48b7d8, dc66d90, d5a3dc3, 482e0d5, d84f518, d34d399, 5bbd25e, 14eab6b, a3bd27a, ec19ab3, af8fcb3, 6b82a28, 3043aea, 785577e, a8dbbce, 65094ac, 113ec70, ad3126e, eedfb27, 45c467a, c983fc1, 58f164f, f6df1aa, c05355c, ae7805c, 9ffc621, c97b331, 15297e5, 41f6738, 53f9352, b72f6a2, 52e1716, 50c863a, f09dc43, c148d27, a11ecdd, 08e338e, 8450ad5, 39da87a, a2adb31, a6174d5, 96e6004, 3ebd645, 3c3c79b, 8c6d2fa, 1ff35d2, 2b100e9, e3938e5, f90101a, 306c9a1, 5b69c67, a12ffe3, f6cf0fd, 3541f65, d50aaa2, 3731ddb, 3b8090c, 137757a, a658477]:

  • effect@​4.0.7
  • @​effect/platform-node-shared@4.0.7

Effect-TS/effect (@​effect/platform-node-shared)

v4.1.0

Compare Source

Minor Changes

• #​8829 66c796a Thanks @​effect-bot! - Bound Node stream and socket pulls to at most chunkSize chunks (default 4096), preventing synchronously refilling sources from draining indefinitely in one pull. Add a chunkSize option to Node socket constructors and a separate readSize option for Node stream read(size) calls; callers previously using chunkSize for byte read sizes should use readSize instead. Set chunkSize: Infinity to opt into unbounded batching.

• #​8829 8f23668 Thanks @​fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

Breaking changes

• Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
• Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
• Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

• #​10087 472c469 Thanks @​effect-bot! - Node.js 22.19.0 (required by undici 8) is now the minimum for @effect/platform-node, @effect/platform-node-shared, @effect/opentelemetry and @effect/docgen, up from 18.

  NodeSocket WebSocket clients now use Node's global WebSocket instead of ws, so client-only usage no longer bundles ws.

  Breaking: ws moved to a new NodeWS module.

  • NodeSocket.NodeWS and BunSocket.NodeWS are removed. Import NodeWS from @effect/platform-node or @effect/platform-node-shared (on Bun, import ws directly). Use NodeWS.WebSocket in place of NodeSocket.NodeWS.default.
  • NodeSocket.layerWebSocketConstructorWS is removed. Use NodeWS.layerWebSocketConstructor.

  Behaviour changes for clients that pass handshake headers, which previously used ws. Use NodeWS.layerWebSocketConstructor to keep the old behaviour:

  • Reads cannot be paused. Incoming frames are buffered without limit, and a configured highWaterMark fails the socket with a SocketReadError.
  • Connection errors are a generic ErrorEvent, so SocketOpenError causes lack the underlying error code.
  • The Socket.WebSocket service is a global WebSocket, so ws instanceof checks and ws-only methods such as terminate() and ping() no longer apply.
  • A custom Host header is ignored.
  • Outgoing messages are not compressed. Incoming permessage-deflate messages are still decompressed.
  • Connections use undici's global dispatcher instead of http.globalAgent / https.globalAgent.

• #​8829 d2b6bc7 Thanks @​jpowersdev! - Add experimental Glob path matching and a shared FileSystem.glob implementation for Node, Bun, and Deno.

  • Breaking: custom FileSystem implementations, including inputs to FileSystem.make, must provide readDirectoryEntries; mapping readDirectory names to { name, type: "Unknown" } is supported. Wrappers must apply directory-listing changes to both methods.
  • FileSystem.make now derives glob instead of accepting it. Apply custom overrides afterward with FileSystem.of({ ...fs, glob: customGlob }).
  • Glob patterns use / separators and backslash escapes; Node extglobs no longer expand. Results use / separators and are relative to root unless the pattern is absolute. Deno wildcards now skip dotfiles unless explicitly named or dot: true; unreadable wildcard-reached directories are skipped, while read failures at the root or a leading literal directory propagate.

• #​8829 3d88452 Thanks @​fubhy! - Add CommandLine to effect/process for quoting and joining command lines, and support Redacted arguments and env values in ChildProcess.

  Migration:

  • ChildProcess.make templates keep quoted words together and throw a CommandLineError for shell syntax such as |, $HOME or *. Quote such characters or pass them with ${}.
  • With the shell option, templates cannot contain ${} values and extra arguments fail with BadArgument. Pass the whole script as the command, built with CommandLine.join.
  • StandardCommand.args and env values can be Redacted strings.
  • ChildProcess.TemplateExpression and ChildProcess.TemplateExpressionItem are removed. Use the CommandLine types of the same name.

• #​8829 89e5443 Thanks @​jpowersdev! - Add Terminal.size, a scoped queue that starts with the current terminal dimensions and receives each resize. Custom terminals passed to Terminal.make must now supply size.

Patch Changes

• #​8829 fe6b748 Thanks @​effect-bot! - Support duplex additionalFds through getInputFd and getOutputFd, preserving both directions when used with pipeTo.
• Updated dependencies [631d4f4, 7ea1ea2, a2ccc14, ed20129, 20795b9, a8e5e6c, c4d298d, fb5dbee, 8309b94, ac10e55, af23904, df8dce5, 0c24a8f, 468c6ee, 2d1fcd4, 8f23668, 3f8f359, fe6b748, 2a03584, 40e145e, 7217410, cf249fe, 4f0fad1, e75708c, 7890077, c4a00fc, f74db37, 069cf72, 9a07ebc, f40dc4e, fa516c6, ffd9237, 93895b9, 8938b19, e5a1479, 89e1e1e, eda0960, 65db606, 7c42335, cb21d14, 89e1e1e, c32eb78, be9895b, 26b4bfe, e19c611, f97711f, 4f16778, d2b6bc7, 8e668fe, ce9e999, 3d88452, 3c42058, 2ae4045, e853fa1, 6dc3f7c, 1513bbd, c065ed7, 1194a4c, 2cb498e, 89e5443, 2a9a425, e710bbb, b0d6e75, 32b3570, 9f93f4f, 27370c7]:
  • effect@​4.1.0

v4.0.7

Compare Source

Patch Changes

• #​9795 958307b Thanks @​effect-bot! - Fail ChildProcess exit codes when a stdin or additionalFds input stream fails, instead of reporting a successful exit after truncated input.

• #​9823 5fbccf4 Thanks @​effect-bot! - Keep waiting for a detached ChildProcess process group that still exists but cannot be signalled, such as on macOS when only zombie members remain, instead of treating it as gone once the leader exits.

• #​9977 a3bd27a Thanks @​jpowersdev! - Make NodeStream.toString enforce maxBytes on the bytes read instead of the decoded text, which rejected non-UTF-8 input at the limit and accepted oversized UTF-16 input.

• #​9798 ec19ab3 Thanks @​effect-bot! - Fix NodeChildProcessSpawner signalling a possibly reused process group after a non-detached child exits.

• #​10020 f09dc43 Thanks @​effect-bot! - Allow FileSystem.makeTempDirectoryScoped and FileSystem.makeTempFileScoped to finalize successfully when their temporary path has already been removed.

• Updated dependencies [ac3485a, 3a4c691, 4f0600e, 110fd22, aa58cda, 8e257e7, e62a149, dcd43a5, 3388cdd, 81b0e14, a046435, f6d8968, 5741c3a, 381d5c6, d47478a, 383716d, 46dc30a, 3d5c862, 93ebc4f, c7b161a, e55945d, 1a53d6a, 5e25cc9, 9503d5c, 13efb72, 8ca6abb, 4a09dd1, 346fc92, 20e5ba8, f4b237e, 1dd08ee, 940be42, 37be245, 563fde0, 938cecb, cf197c1, 7ca71bb, 1e73219, 4dd860d, 4d24a11, 6bbc5ac, 5fd25f4, a461561, 832b3c6, 837e906, cd1f2d4, fb38ce6, 446c7ac, b48b7d8, dc66d90, d5a3dc3, 482e0d5, d84f518, d34d399, 5bbd25e, 14eab6b, af8fcb3, 6b82a28, 3043aea, 785577e, a8dbbce, 65094ac, 113ec70, ad3126e, eedfb27, 45c467a, c983fc1, 58f164f, f6df1aa, c05355c, ae7805c, 9ffc621, c97b331, 15297e5, 41f6738, 53f9352, b72f6a2, 52e1716, 50c863a, c148d27, a11ecdd, 08e338e, 8450ad5, 39da87a, a2adb31, a6174d5, [96e6004](https:

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Istanbul)

• Branch creation
  • Between 12:00 AM and 05:59 AM (* 0-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.