Skip to content

chore(deps): bump the npm group across 1 directory with 10 updates - #398

Merged
EskiMojo14 merged 3 commits into
mainfrom
dependabot/npm_and_yarn/npm-7969b391c9
Nov 1, 2026
Merged

chore(deps): bump the npm group across 1 directory with 10 updates#398
EskiMojo14 merged 3 commits into
mainfrom
dependabot/npm_and_yarn/npm-7969b391c9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 10 updates in the / directory:

Package From To
knip 6.43.0 6.44.0
@tanstack/react-devtools 0.10.13 0.10.14
@tanstack/devtools-vite 0.8.5 0.8.6
ansi-regex 6.4.0 6.5.0
eslint 10.13.0 10.14.0
@cfworker/json-schema 4.1.1 4.1.4
effect 4.1.0 4.1.1
typia 15.2.1 15.2.2
@ttsc/unplugin 0.34.2 0.34.3
ttsc 0.34.2 0.34.3

Updates knip from 6.43.0 to 6.44.0

Release notes

Sourced from knip's releases.

Release 6.44.0

  • Clarify that custom entry still adds entry files from package.json (#2206) (4099ddeef28406ed8c9b798cf5ce525241818642) - thanks @​MannXo!
  • Resolve expanded package scripts against the directory of their manifest (#2209) (9d8464dd7335b9898a17a0db59c3c33a7ae460f4) - thanks @​fixfon!
  • Track exports through namespace member chains of any depth (#2210) (75697027e89e176c16e3d567cff3d6e016d0e9f0) - thanks @​fixfon!
  • Do not treat Windows drive letters as package names (#2217) (d412c5be3a5c2d69583ce54b32e033813c1d2972) - thanks @​Cherry!
  • Generate built-in compilers list from source (#2216) (d6f594cc767fa41c6f94cf49bfa0302be4b9de40) - thanks @​abrahamguo!
  • Update to pnpm@^11 + pnpm dedupe (ef5b819eddbb0b4ff92804524aca590797a199fc)
  • Stop growing and rewriting the analysis cache on warm runs (close #2213) (54b02dd84181867f41f98a6c80209dad32fa3da6)
  • Use entry in plugins that do not resolve their config files (0b0e3285e3a440650b86a776b5e2a1fc1816bca8)
  • Reuse graph reachability for incremental sessions (#2190) (38d926a652e820a375fe59d04ba0980393882153) - thanks @​jakeleventhal!
  • fix: reload discovered configuration in watch sessions (#2211) (cefef30891c4428635e5cfc7b147faa42857247d) - thanks @​jakeleventhal!
  • Keep editor sessions and views current (#2215) (cfe91abb5e6064230a71926f0d7565fce94486c0) - thanks @​jakeleventhal!
  • Add Lingui plugin (#2212) (611e7dbe1c6675612e457324aae411bf4cda5b11) - thanks @​clean99!
  • Update dependency bun to v1.4.4 (#2219) (3f35bbdf863057f69f237ab507053271019fc315) - thanks @​renovate[bot]!
  • Read CSpell configuration from package.json (#2228) (86ab963cf3cd279a8b8af3a3f0098d24762c59cb) - thanks @​clean99!
  • Ignore file discovery order in session configuration test (51a8d33dbe04e76da8f2e2ed24d8943d0e9e15fe)
  • Fix strict mode for caught optional peer imports (#2218) (e535f40b8cacea80c830282544975f0be2191323) - thanks @​jay23606!
  • Add kysely-codegen plugin (#2223) (a50e8423d28406bd20c213334d3aac4857c1cce0) - thanks @​clean99!
  • Add PurgeCSS plugin (#2224) (668aea696a217d7c537791771be6044fc5ae375b) - thanks @​clean99!
  • Document plugin args and path bases, issue key order and real-world fixes (8e48df60c4502c66d9daba87d5f436898ae60116)
  • Add Mastra plugin (#2227) (dd4e1f72de127eb8328dd941fa4492034f29d69d) - thanks @​ashokram-si!
  • Count findPackageJSON() bare specifiers as dependencies (#2235) (d4e387b31235d49fe755acb79553b385aa0de4c9) - thanks @​abrahamguo!
  • Add universal hooks file to SvelteKit entries (#2237) (f286584f168d27255769bd9529b49a3518e4f788) - thanks @​APX403!
  • Attribute extended tsconfig plugins correctly (#2230) (8d1d1d1e54204287b8321a0a5d50cbfa4562759e) - thanks @​gioboa!
  • Resolve reporter in the Mocha plugin (#2232) (c413715a334be72094a02af0dbb37e36e878e262) - thanks @​X-Guardian!
  • Read nyc.config.cjs and nyc.config.mjs in the nyc plugin (#2240) (724c3c9bd44d9919f35fa5b5be955fa3b6c9339d) - thanks @​SwastikTripathi!
  • Read hidden .biome.json and .biome.jsonc in the Biome plugin (#2239) (dde22a754d9cd7a4e98aaeef6b0ad8b22b14040d) - thanks @​SwastikTripathi!
  • fix: narrow Remix plugin enabler to @​remix-run/dev (#2242) (5e10c52abfe21839dc9bd515fd900ff035fac170) - thanks @​gioboa!
  • Document alsoReferenceOwner on Input (387e97f0988da93d74df53ad46a906db3d29dba8)
  • Document path bases and the dir option per input type (98180d375b154663d8c9b967c9b8b54c0de06927)
  • Emit the Gatsby production entries from resolveConfig (c224f16c629cec5ec56ce06b8bcf9207255ba69f)
  • Emit the TanStack Router entry files from resolveConfig (c2598a3dae1e9616191d88d81eafcde6ab0f5b82)
  • Discover Marko tag files when only marko-tag.json files exist (c264697fab8c0783f2e23c983aacb1d4178953fc)
  • Remove the static public/sw.js production entry from the vite-plugin-pwa plugin (b3f9a56216195e279ec73935f0de1e6ff490230c)
  • Keep absolute build.lib.entry paths in the Vitest plugin (5d974fa1bdfe3bbc696645139cc04bb963d5f9d9)
  • Resolve Vite alias targets from the workspace without prefixing absolute paths (8f93e9d3425e47d9933baec078d1cdf9ad8a49ca)
  • Keep absolute testDir paths in the Playwright plugin (4e3e6b3d8b978a7f4a99438c661a86a93c73745d)
  • Keep absolute stories paths in the Storybook plugin (321decc499e3ec15b75c4abace3a58a0cd8f6b50)
  • Resolve an absolute basePath in the Karma plugin (64e8b1bbe28e0c0f9f80112683b5c5f51f7d4512)
  • Keep absolute local plugin paths in the Docusaurus plugin (058930d9eb30490c796af1ee8bab3682e852dae2)
  • Keep absolute local plugin paths in the Serverless Framework plugin (0176d78dec4cd8ba9204c61c3c0ec7385a02ae9c)
  • Resolve Nx run-commands cwd from the workspace root (39c08aab2149cf11f74c60195b3fdf0bcadc29f2)
  • Resolve package specifiers in Marko tag definitions (168ee52857cf646ac0f1b18528bf6867fdd10c4f)
  • Keep absolute include paths in the Taskfile plugin (7945ec15a327bd65ad6ed00809ba4f12b3f3d814)
  • Resolve Lefthook root from the repository root (f28fae68d56c527f9c6388d983344e5694e5a906)
  • Pass specifiers with dir instead of absolutizing them in the webpack, Nx and textlint plugins (1ad804d6f24f55c28ffd9d306b1bb43175064429)
  • Drop redundant relative calls on entry patterns in the rstest and Marko plugins (9096f254bade552cdd556255157dd440ee634b27)
  • Use toAbsolute in the Jasmine, Lunaria and electron-vite plugins (b4266efef59359dcb2632b97a7c6335f9d47251d)
  • Mark inputs from the start script as production (2fb10243bb1385060d8f94204081f750405460ec)
  • Mark inputs from scripts in production files as production (af469e9c88bd87e3b71b8d010abf069115cf2a19)

... (truncated)

Commits
  • 0d14731 Release knip@6.44.0
  • 153ba1e Escape pipes in symbols in the markdown reporter (#2254)
  • 624da93 Detect SWC plugins in options set directly on a webpack rule (#2252)
  • acbbbf5 Support pnpm workspace config includes (#2238)
  • e118ef4 Treat packageExtensions peers as optional (#2246)
  • 1a58eb5 Add --output-file option to write reporter output to a file (#2243)
  • 5d10668 Let core resolve script entries from dir in the Playwright, Railway and mis...
  • 381e3e3 Parse MCP server commands against their cwd
  • 98d0b98 Parse GitHub Actions step scripts against their working directory
  • 2070464 Pin the scope of negations and workspace exclusions for plugin entry patterns...
  • Additional commits viewable in compare view

Updates @tanstack/react-devtools from 0.10.13 to 0.10.14

Release notes

Sourced from @​tanstack/react-devtools's releases.

@​tanstack/react-devtools@​0.10.14

Patch Changes

Changelog

Sourced from @​tanstack/react-devtools's changelog.

0.10.14

Patch Changes

Commits

Updates @tanstack/devtools-vite from 0.8.5 to 0.8.6

Release notes

Sourced from @​tanstack/devtools-vite's releases.

@​tanstack/devtools-vite@​0.8.6

Patch Changes

  • #539 ed8b314 - Source injection no longer stops after the dev server parses a regex literal. Before this fix, a regex literal cached value as a child key of Literal nodes. Every later file with a string literal then threw during the walk and got zero data-tsd-source attributes.

  • #540 012421f - Stop the console pipe feedback loop with Vite 8 server.forwardConsole. The server side of the pipe no longer sends browser logs that Vite printed in the terminal back to the browser.

  • #548 40f32e4 - Run source injection before the transforms of other plugins (unless they also use order: 'pre'), also when devtools() is not first in the plugins array. Before this fix, a framework plugin that changed the code of only one environment shifted the line numbers, so data-tsd-source differed between SSR and client and caused hydration warnings.

  • #541 df1464c - Fix "Go to Source" for files outside the current working directory, for example a package in a monorepo or Vite run from another directory. The editor got a path with the working directory added twice. Also answer a missing or malformed source with 400 instead of leaving the request pending.

  • #542 9c58288 - Remove the intent bin from the published packages. It took over node_modules/.bin/intent from @tanstack/intent and imported the removed @tanstack/intent/intent-library subpath. The packages now have the tanstack-intent keyword, which current @tanstack/intent uses to find their skills.

  • #545 d018c4c - Reject event bus requests to install a package when the name is not a valid npm package name. On macOS and Linux, run the package manager without a shell. Also reject a plugin import name that is not a JavaScript identifier, because it is written into your source file as code.

  • #538 7cb0a8d - Inject the event bus port, host, and protocol into Vite pre-bundled dependency chunks too. Before this fix, a client installed from npm kept the default port 4206 and could not connect when the server bus used another port.

  • Updated dependencies [ed8b314, 012421f, df1464c, d018c4c]:

    • @​tanstack/devtools-bundler-core@​0.1.4
Changelog

Sourced from @​tanstack/devtools-vite's changelog.

0.8.6

Patch Changes

  • #539 ed8b314 - Source injection no longer stops after the dev server parses a regex literal. Before this fix, a regex literal cached value as a child key of Literal nodes. Every later file with a string literal then threw during the walk and got zero data-tsd-source attributes.

  • #540 012421f - Stop the console pipe feedback loop with Vite 8 server.forwardConsole. The server side of the pipe no longer sends browser logs that Vite printed in the terminal back to the browser.

  • #548 40f32e4 - Run source injection before the transforms of other plugins (unless they also use order: 'pre'), also when devtools() is not first in the plugins array. Before this fix, a framework plugin that changed the code of only one environment shifted the line numbers, so data-tsd-source differed between SSR and client and caused hydration warnings.

  • #541 df1464c - Fix "Go to Source" for files outside the current working directory, for example a package in a monorepo or Vite run from another directory. The editor got a path with the working directory added twice. Also answer a missing or malformed source with 400 instead of leaving the request pending.

  • #542 9c58288 - Remove the intent bin from the published packages. It took over node_modules/.bin/intent from @tanstack/intent and imported the removed @tanstack/intent/intent-library subpath. The packages now have the tanstack-intent keyword, which current @tanstack/intent uses to find their skills.

  • #545 d018c4c - Reject event bus requests to install a package when the name is not a valid npm package name. On macOS and Linux, run the package manager without a shell. Also reject a plugin import name that is not a JavaScript identifier, because it is written into your source file as code.

  • #538 7cb0a8d - Inject the event bus port, host, and protocol into Vite pre-bundled dependency chunks too. Before this fix, a client installed from npm kept the default port 4206 and could not connect when the server bus used another port.

  • Updated dependencies [ed8b314, 012421f, df1464c, d018c4c]:

    • @​tanstack/devtools-bundler-core@​0.1.4
Commits
  • 8f62544 ci: Version Packages (#558)
  • 9c58288 fix: remove the intent bin that shadows @​tanstack/intent (#542)
  • 40f32e4 fix(devtools-vite): inject data-tsd-source before other plugins transform (#548)
  • 7cb0a8d fix(devtools-vite): inject the bus port into pre-bundled dependency chunks (#...
  • See full diff in compare view

Updates ansi-regex from 6.4.0 to 6.5.0

Release notes

Sourced from ansi-regex's releases.

v6.5.0

  • Strip a CSI with a private parameter marker as a whole f2b4c24
  • Never partially strip a sequence c8bbf69

chalk/ansi-regex@v6.4.0...v6.5.0

Commits

Updates eslint from 10.13.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

  • d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
  • 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
  • 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
  • cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
  • 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
  • dab466e docs: Update README (GitHub Actions Bot)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
  • 7697550 docs: Update README (GitHub Actions Bot)
  • 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
  • 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
  • e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
  • a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
  • 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
  • 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
  • 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
  • 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])
Commits
  • 12cbff4 10.14.0
  • 6b696e7 Build: changelog update for 10.14.0
  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
  • dab466e docs: Update README
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419)
  • Additional commits viewable in compare view

Updates @cfworker/json-schema from 4.1.1 to 4.1.4

Release notes

Sourced from @​cfworker/json-schema's releases.

@​cfworker/json-schema@​4.1.4

Patch Changes

  • 2ec889d: Remove obsolete declaration files that were shadowed by the TypeScript sources.

@​cfworker/json-schema@​4.1.3

Patch Changes

  • 4dbbcbc: A declared property (or one matching patternProperties) that fails its own schema is no longer also reported by additionalProperties. Fixes #336.

  • 72d2f31: Fix JSON Schema conformance for contains bounds, fractional multipleOf values, prototype-named properties, array/object equality, and dependentRequired schema traversal. Fixes #338.

  • 48962e9: Modernize the build and test toolchain for Node.js 26 and TypeScript 7. Packages are now checked with stricter optional-property and indexed-access rules, and library builds produce both ESM and CommonJS output through tshy.

    Refresh runtime dependencies and harden dynamic input handling. This includes migrating Web's safe JSON parsing to @hapi/bourne, adopting cookie 2, rejecting malformed JWT structures and unsupported verification algorithms, storing JWKS keys in prototype-safe maps, rejecting undersized UUID byte arrays, avoiding shared UUID fallback state, and making schema, routing, and session lookups safer.

Commits
  • e45acac Version Packages
  • f64729e fix(web): preserve repeated validation values
  • 2ec889d chore: remove obsolete files and scripts (#349)
  • d295094 Configure npm trusted publishing
  • 4acb0d8 Version Packages
  • 72d2f31 fix(json-schema): resolve conformance failures (#338)
  • 64ad18c fix(release): use renamed changesets publish-script input
  • 4dbbcbc Don't report declared properties under additionalProperties
  • aa38fa5 fix(json-schema): handle negative multipleOf remainders
  • f3dd816 fix: harden auth and runtime security
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cfworker/json-schema since your current version.


Updates effect from 4.1.0 to 4.1.1

Release notes

Sourced from effect's releases.

effect@4.1.1

Patch Changes

  • #10186 8567117 Thanks @​effect-bot! - Restore SchemaBinary.toCodec derivation for Prompt.FilePart and the AI response part schemas that include it.

  • #10119 3f5c6aa Thanks @​Marve10s! - Fix AtomRegistry.subscribe without immediate never notifying for an atom that has not been read yet. Subscribing now builds the atom, so the listener hears later changes. This also fixes get.subscribe, get.stream with withoutInitialValue, and useAtomSubscribe in @effect/atom-react.

    A failed build no longer makes subscribe throw: the next read reports the failure, and the listener hears the recovery. An error thrown by a failed build's finalizer no longer aborts the next build; it is reported once that build has its value.

  • #10189 29b89b6 Thanks @​tim-smart! - Speed up Base64Url.decode and Base64Url.decodeString by decoding the URL-safe alphabet directly, instead of transliterating the input and decoding it again as standard Base64.

  • #10188 0b4cfbc Thanks @​effect-bot! - Limit BigDecimal scales to prevent resource exhaustion.

    • BigDecimal.fromString and Schema.BigDecimalFromString reject strings whose scale, before or after removing trailing zeros, is outside ±10,000, such as "1e300000000", "10e10000" or more than 10,000 fractional digits. BigDecimal.fromStringUnsafe throws for them.
    • Operations that align scales (sum, subtract, remainder, scale, round, truncate, ceil, floor) throw a RangeError when the scales differ by more than 20,000.
    • round returns values already at or below the target scale unchanged.

  • #10192 088510f Thanks @​effect-bot! - Enforce MaxBodySize on buffered request body reads in BunHttpServer, DenoHttpServer, and HttpServerRequest.fromClientRequest.

  • #10142 ad62cd7 Thanks @​effect-bot! - Add onRejection to CircuitBreaker.execute. With "allow", a call the circuit would refuse with CircuitOpen or CircuitHalfOpen runs unrecorded instead, while a call the circuit admits, probe included, is recorded as usual. Calls that must always run can then still count towards the breaker's state. Defaults to "fail", which keeps the current behavior.

  • #10169 ba406a5 Thanks @​tim-smart! - Pass { probe } to CircuitBreaker classify callbacks, including HttpClient.withCircuitBreaker. probe is true when the call is the HalfOpen probe, so a classifier can count an outcome it otherwise ignores, such as a rate-limited response, as a failure that reopens the circuit. Existing one-argument classifiers are unchanged. The callback type is exported as CircuitBreaker.Classifier.

  • #10126 5e56eba Thanks @​baptisteArno! - Fix ClickhouseMigrator failing to create its migrations table or record applied migrations, by running those statements as ClickHouse commands instead of queries. Migrator.make accepts an optional transformWrites option for these statements, defaulting to identity.

  • #10206 6a95d51 Thanks @​effect-bot! - Retry transient PersistenceErrors when a cluster workflow sends an activity or reads its reply during a pending interrupt, instead of storing the failure as a workflow defect. A request whose save was committed but not acknowledged is deduplicated, so the activity still runs once.

    A cluster client request whose send fails is no longer retained by Sharding.

  • #10205 24d5acd Thanks @​effect-bot! - Fix local callers of persisted entity requests hanging when a reply save commits but reports a failure, for example when the connection drops before the COMMIT acknowledgement arrives. The runner now checks storage for the committed reply and lets the caller read it, without replaying the request.

  • #10163 c38dfa0 Thanks @​effect-bot! - Fix persisted success replies being stored after a ClusterSchema.WithTransaction request transaction rolled back. A failed save inside the request transaction is no longer retried, since a retry could autocommit the reply outside the aborted transaction (for example after a MySQL deadlock). The failed transaction now replays the request instead.

  • #10197 f2755e7 Thanks @​effect-bot! - Fix type-checking the effect crypto declarations with @types/node 22 or 24 and without the DOM library. The *FromCryptoKey constructors in Aead, Cipher, KeyAgreement, KeyWrap, Mac and Signature now accept the new structural WebCrypto.CryptoKey type instead of the global CryptoKey, and DOM and Node Web Crypto keys are both assignable to it. The WebCrypto reference and WebCrypto.layer now use the type of globalThis.crypto instead of the global Crypto type.

  • #10137 a40cb20 Thanks @​effect-bot! - Fix DateTime.Zoned exposing its adjustedEpochMilliseconds cache as an enumerable property after DateTime.toDate, which broke Object.keys, spread and deep equality.

  • #10174 bd6b9c2 Thanks @​effect-bot! - Speed up DateTime construction by creating the partsUtc, adjustedEpochMilliseconds and partsAdjusted cache properties on first use. Reading and writing these fields is unchanged, but Object.hasOwn, Object.getOwnPropertyNames and Object.getOwnPropertyDescriptor no longer report them before the caches are populated, or at all on instances sealed or frozen before first use. Reading the parts of, or writing these fields on, an instance frozen before first use no longer throws.

  • #10082 49d84d6 Thanks @​typedrat! - Fix Equal.equals and Hash.hash throwing on plain objects whose "~effect/Equal" or "~effect/Hash" key is not a function. Such values are now treated as data.

  • #10185 a8f77d5 Thanks @​effect-bot! - Verify the session authentication signature before an EventLog server binds a signing key to an identity, and reject a verified key that differs from the identity's existing binding. A request with an invalid signature no longer creates a binding.

    EventLogServerUnencrypted.EventLogServerAuthorization.authorizeIdentity and the authorizeIdentity option of EventLogServer.layerRpcHandlers now also receive the presented signing public key. Use the new EventLogSessionAuth.deriveSigningPublicKey to record an identity's signing key at provisioning time and reject any other key.

  • #10164 7a9c22f Thanks @​effect-bot! - Stop finished fibers from retaining their last span and stack frame. A finished fiber kept alive by a cache entry, observer or Deferred no longer keeps the ended span's parent chain, and the success values recorded on those spans, from being garbage collected.

  • #10145 efcb8cc Thanks @​jpowersdev! - Fix Host.domainNameFromString rejecting decomposed Unicode domain names.

  • #10125 378f5f0 Thanks @​pujitha24! - Fix Effect.request retaining completed requests and their async context in its batch pool.

... (truncated)

Changelog

Sourced from effect's changelog.

4.1.1

Patch Changes

  • #10186 8567117 Thanks @​effect-bot! - Restore SchemaBinary.toCodec derivation for Prompt.FilePart and the AI response part schemas that include it.

  • #10119 3f5c6aa Thanks @​Marve10s! - Fix AtomRegistry.subscribe without immediate never notifying for an atom that has not been read yet. Subscribing now builds the atom, so the listener hears later changes. This also fixes get.subscribe, get.stream with withoutInitialValue, and useAtomSubscribe in @effect/atom-react.

    A failed build no longer makes subscribe throw: the next read reports the failure, and the listener hears the recovery. An error thrown by a failed build's finalizer no longer aborts the next build; it is reported once that build has its value.

  • #10189 29b89b6 Thanks @​tim-smart! - Speed up Base64Url.decode and Base64Url.decodeString by decoding the URL-safe alphabet directly, instead of transliterating the input and decoding it again as standard Base64.

  • #10188 0b4cfbc Thanks @​effect-bot! - Limit BigDecimal scales to prevent resource exhaustion.

    • BigDecimal.fromString and Schema.BigDecimalFromString reject strings whose scale, before or after removing trailing zeros, is outside ±10,000, such as "1e300000000", "10e10000" or more than 10,000 fractional digits. BigDecimal.fromStringUnsafe throws for them.
    • Operations that align scales (sum, subtract, remainder, scale, round, truncate, ceil, floor) throw a RangeError when the scales differ by more than 20,000.
    • round returns values already at or below the target scale unchanged.

  • #10192 088510f Thanks @​effect-bot! - Enforce MaxBodySize on buffered request body reads in BunHttpServer, DenoHttpServer, and HttpServerRequest.fromClientRequest.

  • #10142 ad62cd7 Thanks @​effect-bot! - Add onRejection to CircuitBreaker.execute. With "allow", a call the circuit would refuse with CircuitOpen or CircuitHalfOpen runs unrecorded instead, while a call the circuit admits, probe included, is recorded as usual. Calls that must always run can then still count towards the breaker's state. Defaults to "fail", which keeps the current behavior.

  • #10169 ba406a5 Thanks @​tim-smart! - Pass { probe } to CircuitBreaker classify callbacks, including HttpClient.withCircuitBreaker. probe is true when the call is the HalfOpen probe, so a classifier can count an outcome it otherwise ignores, such as a rate-limited response, as a failure that reopens the circuit. Existing one-argument classifiers are unchanged. The callback type is exported as CircuitBreaker.Classifier.

  • #10126 5e56eba Thanks @​baptisteArno! - Fix ClickhouseMigrator failing to create its migrations table or record applied migrations, by running those statements as ClickHouse commands instead of queries. Migrator.make accepts an optional transformWrites option for these statements, defaulting to identity.

  • #10206 6a95d51 Thanks @​effect-bot! - Retry transient PersistenceErrors when a cluster workflow sends an activity or reads its reply during a pending interrupt, instead of storing the failure as a workflow defect. A request whose save was committed but not acknowledged is deduplicated, so the activity still runs once.

    A cluster client request whose send fails is no longer retained by Sharding.

  • #10205 24d5acd Thanks @​effect-bot! - Fix local callers of persisted entity requests hanging when a reply save commits but reports a failure, for example when the connection drops before the COMMIT acknowledgement arrives. The runner now checks storage for the committed reply and lets the caller read it, without replaying the request.

  • #10163 c38dfa0 Thanks @​effect-bot! - Fix persisted success replies being stored after a ClusterSchema.WithTransaction request transaction rolled back. A failed save inside the request transaction is no longer retried, since a retry could autocommit the reply outside the aborted transaction (for example after a MySQL deadlock). The failed transaction now replays the request instead.

  • #10197 f2755e7 Thanks @​effect-bot! - Fix type-checking the effect crypto declarations with @types/node 22 or 24 and without the DOM library. The *FromCryptoKey constructors in Aead, Cipher, KeyAgreement, KeyWrap, Mac and Signature now accept the new structural WebCrypto.CryptoKey type instead of the global CryptoKey, and DOM and Node Web Crypto keys are both assignable to it. The WebCrypto reference and WebCrypto.layer now use the type of globalThis.crypto instead of the global Crypto type.

  • #10137 a40cb20 Thanks @​effect-bot! - Fix DateTime.Zoned exposing its adjustedEpochMilliseconds cache as an enumerable property after DateTime.toDate, which broke Object.keys, spread and deep equality.

  • #10174 bd6b9c2 Thanks @​effect-bot! - Speed up DateTime construction by creating the partsUtc, adjustedEpochMilliseconds and partsAdjusted cache ...

    Description has been truncated

@dependabot
chore(deps): bump the npm group across 1 directory with 10 updates
7884e26 
Bumps the npm group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.43.0` | `6.44.0` |
| [@tanstack/react-devtools](https://github.com/TanStack/devtools/tree/HEAD/packages/react-devtools) | `0.10.13` | `0.10.14` |
| [@tanstack/devtools-vite](https://github.com/TanStack/devtools/tree/HEAD/packages/devtools-vite) | `0.8.5` | `0.8.6` |
| [ansi-regex](https://github.com/chalk/ansi-regex) | `6.4.0` | `6.5.0` |
| [eslint](https://github.com/eslint/eslint) | `10.13.0` | `10.14.0` |
| [@cfworker/json-schema](https://github.com/cfworker/cfworker) | `4.1.1` | `4.1.4` |
| [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `4.1.0` | `4.1.1` |
| [typia](https://github.com/samchon/typia) | `15.2.1` | `15.2.2` |
| [@ttsc/unplugin](https://github.com/samchon/ttsc) | `0.34.2` | `0.34.3` |
| [ttsc](https://github.com/samchon/ttsc) | `0.34.2` | `0.34.3` |



Updates `knip` from 6.43.0 to 6.44.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.44.0/packages/knip)

Updates `@tanstack/react-devtools` from 0.10.13 to 0.10.14
- [Release notes](https://github.com/TanStack/devtools/releases)
- [Changelog](https://github.com/TanStack/devtools/blob/main/packages/react-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/devtools/commits/@tanstack/react-devtools@0.10.14/packages/react-devtools)

Updates `@tanstack/devtools-vite` from 0.8.5 to 0.8.6
- [Release notes](https://github.com/TanStack/devtools/releases)
- [Changelog](https://github.com/TanStack/devtools/blob/main/packages/devtools-vite/CHANGELOG.md)
- [Commits](https://github.com/TanStack/devtools/commits/@tanstack/devtools-vite@0.8.6/packages/devtools-vite)

Updates `ansi-regex` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](chalk/ansi-regex@v6.4.0...v6.5.0)

Updates `eslint` from 10.13.0 to 10.14.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.13.0...v10.14.0)

Updates `@cfworker/json-schema` from 4.1.1 to 4.1.4
- [Release notes](https://github.com/cfworker/cfworker/releases)
- [Commits](https://github.com/cfworker/cfworker/compare/@cfworker/json-schema@4.1.1...@cfworker/json-schema@4.1.4)

Updates `effect` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/Effect-TS/effect/releases)
- [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md)
- [Commits](https://github.com/Effect-TS/effect/commits/effect@4.1.1/packages/effect)

Updates `typia` from 15.2.1 to 15.2.2
- [Release notes](https://github.com/samchon/typia/releases)
- [Commits](samchon/typia@v15.2.1...v15.2.2)

Updates `@ttsc/unplugin` from 0.34.2 to 0.34.3
- [Release notes](https://github.com/samchon/ttsc/releases)
- [Commits](samchon/ttsc@v0.34.2...v0.34.3)

Updates `ttsc` from 0.34.2 to 0.34.3
- [Release notes](https://github.com/samchon/ttsc/releases)
- [Commits](samchon/ttsc@v0.34.2...v0.34.3)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.44.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@tanstack/react-devtools"
  dependency-version: 0.10.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@tanstack/devtools-vite"
  dependency-version: 0.8.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: ansi-regex
  dependency-version: 6.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: eslint
  dependency-version: 10.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@cfworker/json-schema"
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: effect
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: typia
  dependency-version: 15.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@ttsc/unplugin"
  dependency-version: 0.34.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: ttsc
  dependency-version: 0.34.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@netlify

netlify Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for schemabenchmarks ready!

Name Link
🔨 Latest commit 10d4a80
🔍 Latest deploy log https://app.netlify.com/projects/schemabenchmarks/deploys/6ae7baf627673dc9cbe7367c
😎 Deploy Preview https://deploy-preview-398--schemabenchmarks.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@EskiMojo14
EskiMojo14 merged commit 6979543 into main Nov 1, 2026
9 of 10 checks passed
@EskiMojo14
EskiMojo14 deleted the dependabot/npm_and_yarn/npm-7969b391c9 branch November 1, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EskiMojo14