[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@effect/platform-node (source)	4.0.5 → 4.0.6
@effect/vitest (source)	4.0.5 → 4.0.6
effect (source)	4.0.5 → 4.0.6

---

Release Notes

Effect-TS/effect (@​effect/platform-node)

v4.0.6

Compare Source

Patch Changes

• #​9506 679f956 Thanks @​tim-smart! - Use Effect.fnUntraced for internal functions that returned Effect.gen.

• #​9262 51930c0 Thanks @​effect-bot! - Return a typed multipart parse error instead of a defect when a multipart request is missing its boundary.

• #​9402 d1201f0 Thanks @​effect-bot! - Release writables created by NodeSink.fromWritable and fromWritableChannel when upstream fails or the sink is interrupted, preserving the original exit cause. Writables using endOnDone: false remain open. Preserve stream body encoding errors in the Node HTTP client instead of reporting transport errors caused by request cleanup.

• #​9575 c29ddd8 Thanks @​tim-smart! - Add streaming request payloads to HttpApi. An endpoint can declare HttpApiSchema.StreamUint8Array or the new HttpApiSchema.StreamNdjson({ schema }) as its payload, and the handler receives a lazy Stream that reads the body as it pulls. Bad NDJSON lines fail the stream with HttpApiSchemaError (400). The new maxBytes and maxElementBytes limits fail it with the new HttpApiPayloadTooLarge (413), and a content-length over maxBytes is rejected before the handler runs. StreamNdjson also works as a success response.

  HttpApiClient sends a Stream payload without buffering it and infers the stream's requirements. HttpApiTest passes stream payloads through unbuffered. OpenApi.fromApi marks streaming request bodies with x-effect-stream, and openapi-generator maps them, and NDJSON or JSON Lines bodies with an itemSchema, back to StreamUint8Array and StreamNdjson.

  The Node server drains up to 256 KiB of a body the handler left unread, then closes the connection, instead of reading the whole upload or leaving the socket stuck.

• 3934c0c Thanks @​tim-smart! - Return 413 instead of 400 when buffered or decompressed request bodies exceed their size limit, while preserving 400 for other parse failures. Node HTTP servers drain oversized bodies so the response can reach the client without destroying the socket. Node stream readers expose MaxBytesError and an optional destroyOnOverflow setting; their default destruction behavior is unchanged.

• #​9339 9a680d6 Thanks @​fubhy! - Add raw HTTP/1.1 upgrades through HttpClientRequest.upgrade, HttpClientResponse.upgrade, the Node HTTP server, and HttpApiSchema.Upgrade. Node clients expose the upgraded connection as a Socket; HttpApi clients return { headers, socket } and OpenAPI documents the 101 response.

  Custom HttpClientResponse implementations must add upgrade. Fetch and XMLHttpRequest reject upgrade requests with a TransportError before anything is sent; Bun and Deno servers still support only WebSocket upgrades.

• #​9417 7f823c1 Thanks @​fubhy! - Fix HTTP response framing: omit bodies for 204, 205 and 304, and remove content-length for 204 and 205. Node now aborts responses whose bodies do not match content-length. Deno and Bun preserve raw Web Response objects when merging headers, and Deno preserves their status and headers for HEAD requests.

• #​9415 6e614e6 Thanks @​fubhy! - - Fix HTTPS detection in HttpServerRequest.toURL and tracing. An exact http or https in x-forwarded-proto takes precedence; otherwise, infer HTTPS from originalUrl. Paths starting with // preserve the request host.

  • Node server requests now expose an absolute originalUrl when a Host header is present, fixing HttpMiddleware.searchParamsParser. Use url instead of originalUrl to read the path. Hostless requests are unchanged.
  • For absolute-form Node requests, derive url and headers.host from the request target, ignoring a conflicting Host header.

• #​9375 5a2d19f Thanks @​fubhy! - Use HTTP/2 authority for the exposed host header and request URL, even when Host is missing or conflicting. In Deno, also use the target authority for HTTP/1.1 absolute-form requests.

• #​9566 9972b4f Thanks @​tim-smart! - Keep streaming request bodies uploading after NodeHttpClient.layerNodeHttp receives response headers, allowing bidirectional request and response streaming. Stop unfinished uploads when the response is consumed, the connection closes or the request is cancelled, including with keep-alive agents.

• #​9413 29bee6f Thanks @​fubhy! - Fix NodeHttpClient.layerUndici hanging when sending HttpBody.formData request bodies.

• #​9564 ab0f384 Thanks @​tim-smart! - Defer 100 Continue responses until the application starts reading the request body, so early rejections of Expect: 100-continue requests do not prompt clients to upload.

• #​9710 bb49b9a Thanks @​effect-bot! - Support HTTP/2 servers in NodeHttpServer. make, layerServer, layer and layerConfig accept Http2.createServer() and Http2.createSecureServer(), including allowHTTP1, without a cast. HTTP/2 requests no longer expose pseudo-headers, so HttpServerRequest.toWeb works, and toURL uses the request's :scheme and :authority. Responses drop the connection-specific headers HTTP/2 forbids instead of being lost, a body that fails after the headers were sent resets the stream with INTERNAL_ERROR instead of ending cleanly, and shutdown closes idle HTTP/2 sessions, so it no longer waits for the graceful timeout on Node 22.

  Breaking (types only): NodeHttpServerRequest.toIncomingMessage and toServerResponse now return Http.IncomingMessage | Http2.Http2ServerRequest and Http.ServerResponse | Http2.Http2ServerResponse. Code that uses members only the HTTP/1.1 objects have needs to narrow first, for example on httpVersionMajor.

• #​9412 0317f20 Thanks @​fubhy! - NodeHttpServer now responds with a 500 when a handler returns a status outside 200-599. Previously a 1xx status left the client without a final response, and statuses above 599 were sent as is.

• #​9380 5a13d9d Thanks @​fubhy! - Fix NodeHttpServer requests hanging when Node rejects the response headers. The server now sends a fallback error response, or destroys the response if that also fails.

• #​9255 e24cd76 Thanks @​jayhemnani9910! - Abort the connection when a streamed response body fails after headers are sent. Previously the response ended normally, so clients treated the truncated body as complete.

• #​9458 26de861 Thanks @​tim-smart! - Avoid loading Node's internal undici on cold start when importing effect/Schema or starting a Node HTTP server before any web API is used. Schema.FormData resolves the global constructor during validation, and @effect/platform-node loads node:http and node:https without evaluating their lazy web API exports.

• #​9701 e618f10 Thanks @​effect-bot! - Require an explicit trusted proxy policy before applying forwarded headers.

  HttpMiddleware.xForwardedHeaders now takes { trustedProxies } and only applies X-Forwarded-* headers when the connecting peer is trusted. X-Forwarded-For is read from the right, skipping trusted proxies, and X-Forwarded-Host / X-Forwarded-Proto are only used when they line up with it.

  HttpServerRequest.toURL no longer reads x-forwarded-proto directly. It uses the new request.protocol, set by the trusted proxy middleware, before the transport scheme. The connecting peer stays available as request.peerAddress.

  import { HttpMiddleware } from "effect/http"
  import { IpNetwork } from "effect/net"
  
  // before
  HttpMiddleware.xForwardedHeaders
  
  // after
  HttpMiddleware.xForwardedHeaders({
    trustedProxies: [IpNetwork.fromStringUnsafe("10.0.0.0/8")]
  })

• #​9503 74532b6 Thanks @​tim-smart! - Update repository dependencies to their latest compatible releases.

• #​9280 da91aae Thanks @​okarin1511! - Keep the thrown error as the cause when a Browser or Deno worker runner receives an error event, and fix the grammar of the messageerror failure message.

• Updated dependencies [ce13a48, f3bbbb4, 5547315, 6093cfb, 30319d5, 74a7596, bfb32a3, f8bf7f4, 7f3d3df, db1046d, 3c4f88a, 916e709, 916f843, 66ec757, daac06f, c2552ec, b02c1cd, 1855f1d, 683ed2c, ac68940, 22a8401, c53c194, ca6d1cc, 47940c5, e8b24ef, 2e8aae0, ad7497b, 7f504a3, 99e365d, 954067d, 3e1a035, 41a1fe7, bcb3a86, 739d3d1, ed4da35, 3d84e19, cc00906, 09ba1f5, 9ff1a73, 06bc532, 97bfd84, 25efaef, c10335b, a808972, 20e844c, b9f73f3, 5739878, 28acdf3, 59b6396, 0bccc9c, fed70de, 82648a2, afb5f32, 28813f5, 0fae934, f260830, 19b63eb, 14db221, 679f956, b72707c, 44c8c1d, 1e7909b, 0611a65, 2fadc65, feb6ce5, 5a2ed53, c8d26a4, 0c8b446, 05c3409, b04191b, 05c3409, 4067e64, e04563d, 02d7fc5, 561d2a1, 8fe2dcc, a8086fa, 88a33b4, e77372a, 3dd4388, ba2b00c, a049d4a, 84aeede, 43e5e19, 77bbf16, 6af3a47, aac8d21, 84c8dc4, 78d1988, 5676a2a, 4b437bf, 1af11fd, 716f8df, ee27718, 4d86d1b, 5462ed7, 658837c, 00261cc, 7cccb93, 7c98228, 5a8e248, 8037a65, 25912db, 7f32606, 0386f88, 403298a, d1201f0, 5a3ebc0, fac2191, fdb12dc, 97909b8, c3983f4, 3a5e65e, 8b40fbc, 3f3e119, 7c7b8ed, d4f71bc, c66241e, f0e941e, 5f8a6e5, 2800a09, e9749b0, eaef09c, a3c56e5, bb61152, e9c842b, 6d8c8e2, 1f28187, 0b9842b, c29ddd8, 84c3405, 3934c0c, 048e7c8, 1121334, 9a680d6, 85e2aee, 34ec440, 343a149, 915117b, 7f823c1, 6e614e6, 9990b39, 22bf781, 41f08b7, e8482ca, 5ae85fa, c477a0a, 8fbb39e, 1c70828, 8207d1e, 7886b84, 4839c60, 2595d83, f5ae278, 7a8ce00, 688d302, c7072e4, 425cedb, 88bc680, 268e09c, 7e94505, afa5da3, c29ddd8, f30db15, a299341, 6250d31, 28b2931, ae9628d, 48102ac, 463eca3, e7162ea, 95752db, 4577a28, 973d599, 2f066a5, f0ccbb6, 2dda6ce, 3da7c0a, 5a67e0b, 73b3a6e, c6f9e4c, be02676, 26de861, 9313799, d5c1e5b, 11bb31f, 8c23e46, 9c96011, 0d50570, 9ed2bf1, 76ec912, af2756d, 3ec8100, 93abf02, 1e94993, 99a4616, 0a7978e, b4a060b, 274f4a4, 25f29be, 9036440, 415f005, 191308b, 4b96570, d84ec3f, 392aa1c, 99e9bd9, 6f6f45f, 13fc07e, a4b38dd, 8b18580, 0c477fe, 9a5331d, a706d73, c9a1e72, 89eaaf8, 8215811, ad69018, a733eba, 7282d5f, da33572, d9e2d12, dc923b8, 1b74086, 8a5507b, 23460fa, 0dbbea6, 70aad3f, 0909236, a9e66d8, ee5c0d5, 631c5d6, 7e60c1a, 4cddd3c, 8727e5d, 2bc97fa, f9a7f05, d978cca, b334ccf, 0b50cfc, 5b7d2b5, 6ee26b1, eab7e6a, e618f10, da14b1f, 3314fc3, 66db624, 41cf29b, 4b8a50d, 8d52668, 1de1055, db130e6, 5fa5fa5]:

  • effect@​4.0.6
  • @​effect/platform-node-shared@4.0.6

Effect-TS/effect (@​effect/vitest)

v4.0.6

Compare Source

Patch Changes

• #​9675 abcfc80 Thanks @​effect-bot! - Run Effects returned from beforeAll and beforeEach hooks, providing a Scope that closes when the suite or test finishes.

• #​9384 61a31f4 Thanks @​effect-bot! - Reject Effect and Promise returns from synchronous it.prop callbacks instead of silently passing. Callbacks must return a boolean or void; use it.effect.prop for Effect callbacks.

• Updated dependencies [ce13a48, f3bbbb4, 5547315, 6093cfb, 30319d5, 74a7596, bfb32a3, f8bf7f4, 7f3d3df, db1046d, 3c4f88a, 916e709, 916f843, 66ec757, daac06f, c2552ec, b02c1cd, 1855f1d, 683ed2c, ac68940, 22a8401, c53c194, ca6d1cc, 47940c5, e8b24ef, 2e8aae0, ad7497b, 7f504a3, 99e365d, 954067d, 3e1a035, 41a1fe7, bcb3a86, 739d3d1, ed4da35, 3d84e19, cc00906, 09ba1f5, 9ff1a73, 06bc532, 97bfd84, 25efaef, c10335b, a808972, 20e844c, b9f73f3, 5739878, 28acdf3, 59b6396, 0bccc9c, fed70de, 82648a2, afb5f32, 28813f5, 0fae934, f260830, 19b63eb, 14db221, 679f956, b72707c, 44c8c1d, 1e7909b, 0611a65, 2fadc65, feb6ce5, 5a2ed53, c8d26a4, 0c8b446, 05c3409, b04191b, 05c3409, 4067e64, e04563d, 02d7fc5, 561d2a1, 8fe2dcc, a8086fa, 88a33b4, e77372a, 3dd4388, ba2b00c, a049d4a, 84aeede, 43e5e19, 77bbf16, 6af3a47, aac8d21, 84c8dc4, 78d1988, 5676a2a, 4b437bf, 1af11fd, 716f8df, ee27718, 4d86d1b, 5462ed7, 658837c, 00261cc, 7cccb93, 7c98228, 5a8e248, 8037a65, 25912db, 7f32606, 0386f88, 403298a, 5a3ebc0, fac2191, fdb12dc, 97909b8, c3983f4, 3a5e65e, 8b40fbc, 3f3e119, 7c7b8ed, d4f71bc, c66241e, f0e941e, 5f8a6e5, 2800a09, e9749b0, eaef09c, a3c56e5, bb61152, e9c842b, 6d8c8e2, 1f28187, 0b9842b, c29ddd8, 84c3405, 3934c0c, 048e7c8, 1121334, 9a680d6, 85e2aee, 34ec440, 343a149, 915117b, 7f823c1, [6e614e6](https://re

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.