[dependabot]

Bumps the dependencies group with 3 updates in the / directory: effect, @types/node and knip.

Updates effect from 4.0.4 to 4.1.0

Release notes

Sourced from effect's releases.

effect@4.1.0

Minor Changes

• #8829 631d4f4 Thanks @​harrysolovay! - Add Schema.isAscii, a check that accepts only ASCII strings, and the matching SchemaRepresentation.isAsciiReviver.

• #8829 7ea1ea2 Thanks @​wmaurer! - Add an optional cause to the AI NetworkError. It holds the HttpClientError the request failed with, stored unchanged and not redacted, so the reason a request failed is no longer lost. The new NetworkError.fromHttpClientError sets it, and all AI providers now use it. NetworkError.fromRequestError is unchanged.

• #8829 a2ccc14 Thanks @​fubhy! - Fix Atom.Serializable to encode to and decode from Schema.Json, matching the JSON codec used by Atom.serializable. Encoded results may now require narrowing; runtime behavior is unchanged.

• #8829 c4d298d Thanks @​okarin1511! - Render inherited CLI flags in a separate INHERITED FLAGS section and add "full", "summary", and "none" modes for inherited and global flags in CliOutput.defaultFormatter. HelpDoc adds inheritedFlags, commandPath, and globalFlagsScope provenance so summaries can point to the appropriate help, with globals always listed on their declaring command. Custom formatters must read ancestor shared flags from HelpDoc.inheritedFlags instead of HelpDoc.flags.

• #10087 ac10e55 Thanks @​effect-bot! - Add runnerJoinDebounce to ShardingConfig. When set, a runner joining the cluster is only added to shard assignments once the healthy runners have stayed unchanged for that duration, or at most four times that duration after the first pending join. A scale-up or a deployment with a large surge then hands each shard off once instead of once per join. Runners that already hold shards and leave or become unhealthy are still published immediately; a pending runner that leaves only restarts the quiet period. While joins are pending, runners take no new shards, so a shard can stay unlocked briefly until each runner publishes. Defaults to 0, which keeps the current behavior.

• #8829 df8dce5 Thanks @​tim-smart! - Add trim and keepEmptyValues options to SchemaGetter.splitKeyValue, SchemaTransformation.splitKeyValue and Config.Record. Both default to false, so existing callers are unaffected.

  OtlpResource.fromConfig now trims OTEL_RESOURCE_ATTRIBUTES keys and values and keeps entries with an empty value as "".

• #8829 0c24a8f Thanks @​sledorze! - Add a maxDepth option to Context.makeUnsafe, controlling how many Context.add calls are kept as overlays before the context is rebased into a flat map. Defaults to 8.

• #8829 2d1fcd4 Thanks @​effect-bot! - Add an onDstOverlap option to Cron and Schedule.cron that chooses which occurrences of local times repeated when clocks fall back are included: "earlier" (default), "later" or "both". It applies to every repeated local time, including ones not caused by daylight saving time.

  Cron.prev now returns the latest matching instant before its input when starting inside a repeated hour. Near a spring-forward gap it no longer throws or returns an instant at or after its input.

• #8829 8f23668 Thanks @​fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

  Breaking changes

  • Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
  • Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
  • Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

  Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

  Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

  UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

• #8829 3f8f359 Thanks @​jem-computer! - Declare decision images as input fields with Decision.Image, and add Decision.locate, which answers with a bounding box around one target in an image field.

  • DecideOptions.images is removed. Add Decision.Image fields to the input schema and refer to each image by its path in instructions:

    // Before
    DecisionModel.decide(Triage, { input: "Checkout error", images: [screenshot] })
    // After
    const Triage = Decision.make({
      input: Schema.Struct({ report: Schema.String, screenshot: Decision.Image }),
      decisions
    })
    DecisionModel.decide(Triage, { input: { report: "Checkout error", screenshot } })

... (truncated)

Changelog

Sourced from effect's changelog.

4.1.0

Minor Changes

• #8829 631d4f4 Thanks @​harrysolovay! - Add Schema.isAscii, a check that accepts only ASCII strings, and the matching SchemaRepresentation.isAsciiReviver.

• #8829 7ea1ea2 Thanks @​wmaurer! - Add an optional cause to the AI NetworkError. It holds the HttpClientError the request failed with, stored unchanged and not redacted, so the reason a request failed is no longer lost. The new NetworkError.fromHttpClientError sets it, and all AI providers now use it. NetworkError.fromRequestError is unchanged.

• #8829 a2ccc14 Thanks @​fubhy! - Fix Atom.Serializable to encode to and decode from Schema.Json, matching the JSON codec used by Atom.serializable. Encoded results may now require narrowing; runtime behavior is unchanged.

• #8829 c4d298d Thanks @​okarin1511! - Render inherited CLI flags in a separate INHERITED FLAGS section and add "full", "summary", and "none" modes for inherited and global flags in CliOutput.defaultFormatter. HelpDoc adds inheritedFlags, commandPath, and globalFlagsScope provenance so summaries can point to the appropriate help, with globals always listed on their declaring command. Custom formatters must read ancestor shared flags from HelpDoc.inheritedFlags instead of HelpDoc.flags.

• #10087 ac10e55 Thanks @​effect-bot! - Add runnerJoinDebounce to ShardingConfig. When set, a runner joining the cluster is only added to shard assignments once the healthy runners have stayed unchanged for that duration, or at most four times that duration after the first pending join. A scale-up or a deployment with a large surge then hands each shard off once instead of once per join. Runners that already hold shards and leave or become unhealthy are still published immediately; a pending runner that leaves only restarts the quiet period. While joins are pending, runners take no new shards, so a shard can stay unlocked briefly until each runner publishes. Defaults to 0, which keeps the current behavior.

• #8829 df8dce5 Thanks @​tim-smart! - Add trim and keepEmptyValues options to SchemaGetter.splitKeyValue, SchemaTransformation.splitKeyValue and Config.Record. Both default to false, so existing callers are unaffected.

  OtlpResource.fromConfig now trims OTEL_RESOURCE_ATTRIBUTES keys and values and keeps entries with an empty value as "".

• #8829 0c24a8f Thanks @​sledorze! - Add a maxDepth option to Context.makeUnsafe, controlling how many Context.add calls are kept as overlays before the context is rebased into a flat map. Defaults to 8.

• #8829 2d1fcd4 Thanks @​effect-bot! - Add an onDstOverlap option to Cron and Schedule.cron that chooses which occurrences of local times repeated when clocks fall back are included: "earlier" (default), "later" or "both". It applies to every repeated local time, including ones not caused by daylight saving time.

  Cron.prev now returns the latest matching instant before its input when starting inside a repeated hour. Near a spring-forward gap it no longer throws or returns an instant at or after its input.

• #8829 8f23668 Thanks @​fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

  Breaking changes

  • Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
  • Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
  • Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

  Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

  Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

  UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

• #8829 3f8f359 Thanks @​jem-computer! - Declare decision images as input fields with Decision.Image, and add Decision.locate, which answers with a bounding box around one target in an image field.

  • DecideOptions.images is removed. Add Decision.Image fields to the input schema and refer to each image by its path in instructions:

    // Before
    DecisionModel.decide(Triage, { input: "Checkout error", images: [screenshot] })
    // After
    const Triage = Decision.make({
      input: Schema.Struct({ report: Schema.String, screenshot: Decision.Image }),
      decisions
    })

... (truncated)

Commits

• 9a91b19 Version Packages (#10038)
• ac10e55 Debounce runner joins in shard assignments (#10073)
• 89b99d2 Document showing an introduction before CLI fallback prompts (#10074)
• 472c469 Require Node 22.19 and use the global WebSocket for Node clients (#10084)
• fb5dbee Release a frozen runner's MySQL shard locks after shardLockExpiration (#10093)
• 8309b94 Restore idle_session_timeout before returning the PostgreSQL shard-lock conne...
• 58713b3 Remove redundant ScopedCache tests (#10092)
• c4a00fc Reject malformed W3C trace flags (#10085)
• a8e5e6c Reject misplaced signs in BigDecimal strings (#10083)
• 7890077 Reject uppercase HTTP trace identifiers (#10086)
• Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates knip from 6.41.0 to 6.44.0

Release notes

Sourced from knip's releases.

Release 6.44.0

• Clarify that custom entry still adds entry files from package.json (#2206) (4099ddeef28406ed8c9b798cf5ce525241818642) - thanks @​MannXo!
• Resolve expanded package scripts against the directory of their manifest (#2209) (9d8464dd7335b9898a17a0db59c3c33a7ae460f4) - thanks @​fixfon!
• Track exports through namespace member chains of any depth (#2210) (75697027e89e176c16e3d567cff3d6e016d0e9f0) - thanks @​fixfon!
• Do not treat Windows drive letters as package names (#2217) (d412c5be3a5c2d69583ce54b32e033813c1d2972) - thanks @​Cherry!
• Generate built-in compilers list from source (#2216) (d6f594cc767fa41c6f94cf49bfa0302be4b9de40) - thanks @​abrahamguo!
• Update to pnpm@^11 + pnpm dedupe (ef5b819eddbb0b4ff92804524aca590797a199fc)
• Stop growing and rewriting the analysis cache on warm runs (close #2213) (54b02dd84181867f41f98a6c80209dad32fa3da6)
• Use entry in plugins that do not resolve their config files (0b0e3285e3a440650b86a776b5e2a1fc1816bca8)
• Reuse graph reachability for incremental sessions (#2190) (38d926a652e820a375fe59d04ba0980393882153) - thanks @​jakeleventhal!
• fix: reload discovered configuration in watch sessions (#2211) (cefef30891c4428635e5cfc7b147faa42857247d) - thanks @​jakeleventhal!
• Keep editor sessions and views current (#2215) (cfe91abb5e6064230a71926f0d7565fce94486c0) - thanks @​jakeleventhal!
• Add Lingui plugin (#2212) (611e7dbe1c6675612e457324aae411bf4cda5b11) - thanks @​clean99!
• Update dependency bun to v1.4.4 (#2219) (3f35bbdf863057f69f237ab507053271019fc315) - thanks @​renovate[bot]!
• Read CSpell configuration from package.json (#2228) (86ab963cf3cd279a8b8af3a3f0098d24762c59cb) - thanks @​clean99!
• Ignore file discovery order in session configuration test (51a8d33dbe04e76da8f2e2ed24d8943d0e9e15fe)
• Fix strict mode for caught optional peer imports (#2218) (e535f40b8cacea80c830282544975f0be2191323) - thanks @​jay23606!
• Add kysely-codegen plugin (#2223) (a50e8423d28406bd20c213334d3aac4857c1cce0) - thanks @​clean99!
• Add PurgeCSS plugin (#2224) (668aea696a217d7c537791771be6044fc5ae375b) - thanks @​clean99!
• Document plugin args and path bases, issue key order and real-world fixes (8e48df60c4502c66d9daba87d5f436898ae60116)
• Add Mastra plugin (#2227) (dd4e1f72de127eb8328dd941fa4492034f29d69d) - thanks @​ashokram-si!
• Count findPackageJSON() bare specifiers as dependencies (#2235) (d4e387b31235d49fe755acb79553b385aa0de4c9) - thanks @​abrahamguo!
• Add universal hooks file to SvelteKit entries (#2237) (f286584f168d27255769bd9529b49a3518e4f788) - thanks @​APX403!
• Attribute extended tsconfig plugins correctly (#2230) (8d1d1d1e54204287b8321a0a5d50cbfa4562759e) - thanks @​gioboa!
• Resolve reporter in the Mocha plugin (#2232) (c413715a334be72094a02af0dbb37e36e878e262) - thanks @​X-Guardian!
• Read nyc.config.cjs and nyc.config.mjs in the nyc plugin (#2240) (724c3c9bd44d9919f35fa5b5be955fa3b6c9339d) - thanks @​SwastikTripathi!
• Read hidden .biome.json and .biome.jsonc in the Biome plugin (#2239) (dde22a754d9cd7a4e98aaeef6b0ad8b22b14040d) - thanks @​SwastikTripathi!
• fix: narrow Remix plugin enabler to @​remix-run/dev (#2242) (5e10c52abfe21839dc9bd515fd900ff035fac170) - thanks @​gioboa!
• Document alsoReferenceOwner on Input (387e97f0988da93d74df53ad46a906db3d29dba8)
• Document path bases and the dir option per input type (98180d375b154663d8c9b967c9b8b54c0de06927)
• Emit the Gatsby production entries from resolveConfig (c224f16c629cec5ec56ce06b8bcf9207255ba69f)
• Emit the TanStack Router entry files from resolveConfig (c2598a3dae1e9616191d88d81eafcde6ab0f5b82)
• Discover Marko tag files when only marko-tag.json files exist (c264697fab8c0783f2e23c983aacb1d4178953fc)
• Remove the static public/sw.js production entry from the vite-plugin-pwa plugin (b3f9a56216195e279ec73935f0de1e6ff490230c)
• Keep absolute build.lib.entry paths in the Vitest plugin (5d974fa1bdfe3bbc696645139cc04bb963d5f9d9)
• Resolve Vite alias targets from the workspace without prefixing absolute paths (8f93e9d3425e47d9933baec078d1cdf9ad8a49ca)
• Keep absolute testDir paths in the Playwright plugin (4e3e6b3d8b978a7f4a99438c661a86a93c73745d)
• Keep absolute stories paths in the Storybook plugin (321decc499e3ec15b75c4abace3a58a0cd8f6b50)
• Resolve an absolute basePath in the Karma plugin (64e8b1bbe28e0c0f9f80112683b5c5f51f7d4512)
• Keep absolute local plugin paths in the Docusaurus plugin (058930d9eb30490c796af1ee8bab3682e852dae2)
• Keep absolute local plugin paths in the Serverless Framework plugin (0176d78dec4cd8ba9204c61c3c0ec7385a02ae9c)
• Resolve Nx run-commands cwd from the workspace root (39c08aab2149cf11f74c60195b3fdf0bcadc29f2)
• Resolve package specifiers in Marko tag definitions (168ee52857cf646ac0f1b18528bf6867fdd10c4f)
• Keep absolute include paths in the Taskfile plugin (7945ec15a327bd65ad6ed00809ba4f12b3f3d814)
• Resolve Lefthook root from the repository root (f28fae68d56c527f9c6388d983344e5694e5a906)
• Pass specifiers with dir instead of absolutizing them in the webpack, Nx and textlint plugins (1ad804d6f24f55c28ffd9d306b1bb43175064429)
• Drop redundant relative calls on entry patterns in the rstest and Marko plugins (9096f254bade552cdd556255157dd440ee634b27)
• Use toAbsolute in the Jasmine, Lunaria and electron-vite plugins (b4266efef59359dcb2632b97a7c6335f9d47251d)
• Mark inputs from the start script as production (2fb10243bb1385060d8f94204081f750405460ec)
• Mark inputs from scripts in production files as production (af469e9c88bd87e3b71b8d010abf069115cf2a19)

... (truncated)

Commits

• 0d14731 Release knip@6.44.0
• 153ba1e Escape pipes in symbols in the markdown reporter (#2254)
• 624da93 Detect SWC plugins in options set directly on a webpack rule (#2252)
• acbbbf5 Support pnpm workspace config includes (#2238)
• e118ef4 Treat packageExtensions peers as optional (#2246)
• 1a58eb5 Add --output-file option to write reporter output to a file (#2243)
• 5d10668 Let core resolve script entries from dir in the Playwright, Railway and mis...
• 381e3e3 Parse MCP server commands against their cwd
• 98d0b98 Parse GitHub Actions step scripts against their working directory
• 2070464 Pin the scope of negations and workspace exclusions for plugin entry patterns...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions