[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@effect/platform-node (source)	4.0.5 → 4.0.6			devDependencies	patch	4.1.2 (+3)
@modelcontextprotocol/sdk (source)	1.32.1 → 1.32.2			pnpm-workspace.overrides	patch
@tanstack/router-plugin (source)	^1.168.48 → 1.168.48			devDependencies	pin
@types/node (source)	^26.6.6 → 26.6.6			devDependencies	pin
@types/react (source)	^19.3.0 → 19.3.0			devDependencies	pin
@types/react-dom (source)	^19.3.0 → 19.3.0			devDependencies	pin
@vitejs/plugin-react (source)	^6.1.2 → 6.1.2			devDependencies	pin
effect (source)	4.0.5 → 4.0.6			devDependencies	patch	4.1.2 (+3)
hono (source)	4.13.13 → 4.13.14			pnpm-workspace.overrides	patch	4.13.16 (+1)
ip-address	10.7.4 → 10.7.5			pnpm-workspace.overrides	patch
seroval (source)	1.7.1 → 1.7.2			pnpm-workspace.overrides	patch	1.7.6 (+3)
undici@7 (source)	7.30.1 → 8.12.3			pnpm-workspace.overrides	major

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

Effect-TS/effect (@​effect/platform-node)

v4.0.6

Compare Source

Patch Changes

• #​9506 679f956 Thanks @​tim-smart! - Use Effect.fnUntraced for internal functions that returned Effect.gen.

• #​9262 51930c0 Thanks @​effect-bot! - Return a typed multipart parse error instead of a defect when a multipart request is missing its boundary.

• #​9402 d1201f0 Thanks @​effect-bot! - Release writables created by NodeSink.fromWritable and fromWritableChannel when upstream fails or the sink is interrupted, preserving the original exit cause. Writables using endOnDone: false remain open. Preserve stream body encoding errors in the Node HTTP client instead of reporting transport errors caused by request cleanup.

• #​9575 c29ddd8 Thanks @​tim-smart! - Add streaming request payloads to HttpApi. An endpoint can declare HttpApiSchema.StreamUint8Array or the new HttpApiSchema.StreamNdjson({ schema }) as its payload, and the handler receives a lazy Stream that reads the body as it pulls. Bad NDJSON lines fail the stream with HttpApiSchemaError (400). The new maxBytes and maxElementBytes limits fail it with the new HttpApiPayloadTooLarge (413), and a content-length over maxBytes is rejected before the handler runs. StreamNdjson also works as a success response.

  HttpApiClient sends a Stream payload without buffering it and infers the stream's requirements. HttpApiTest passes stream payloads through unbuffered. OpenApi.fromApi marks streaming request bodies with x-effect-stream, and openapi-generator maps them, and NDJSON or JSON Lines bodies with an itemSchema, back to StreamUint8Array and StreamNdjson.

  The Node server drains up to 256 KiB of a body the handler left unread, then closes the connection, instead of reading the whole upload or leaving the socket stuck.

• 3934c0c Thanks @​tim-smart! - Return 413 instead of 400 when buffered or decompressed request bodies exceed their size limit, while preserving 400 for other parse failures. Node HTTP servers drain oversized bodies so the response can reach the client without destroying the socket. Node stream readers expose MaxBytesError and an optional destroyOnOverflow setting; their default destruction behavior is unchanged.

• #​9339 9a680d6 Thanks @​fubhy! - Add raw HTTP/1.1 upgrades through HttpClientRequest.upgrade, HttpClientResponse.upgrade, the Node HTTP server, and HttpApiSchema.Upgrade. Node clients expose the upgraded connection as a Socket; HttpApi clients return { headers, socket } and OpenAPI documents the 101 response.

  Custom HttpClientResponse implementations must add upgrade. Fetch and XMLHttpRequest reject upgrade requests with a TransportError before anything is sent; Bun and Deno servers still support only WebSocket upgrades.

• #​9417 7f823c1 Thanks @​fubhy! - Fix HTTP response framing: omit bodies for 204, 205 and 304, and remove content-length for 204 and 205. Node now aborts responses whose bodies do not match content-length. Deno and Bun preserve raw Web Response objects when merging headers, and Deno preserves their status and headers for HEAD requests.

• #​9415 6e614e6 Thanks @​fubhy! - - Fix HTTPS detection in HttpServerRequest.toURL and tracing. An exact http or https in x-forwarded-proto takes precedence; otherwise, infer HTTPS from originalUrl. Paths starting with // preserve the request host.

  • Node server requests now expose an absolute originalUrl when a Host header is present, fixing HttpMiddleware.searchParamsParser. Use url instead of originalUrl to read the path. Hostless requests are unchanged.
  • For absolute-form Node requests, derive url and headers.host from the request target, ignoring a conflicting Host header.

• #​9375 5a2d19f Thanks @​fubhy! - Use HTTP/2 authority for the exposed host header and request URL, even when Host is missing or conflicting. In Deno, also use the target authority for HTTP/1.1 absolute-form requests.

• #​9566 9972b4f Thanks @​tim-smart! - Keep streaming request bodies uploading after NodeHttpClient.layerNodeHttp receives response headers, allowing bidirectional request and response streaming. Stop unfinished uploads when the response is consumed, the connection closes or the request is cancelled, including with keep-alive agents.

• #​9413 29bee6f Thanks @​fubhy! - Fix NodeHttpClient.layerUndici hanging when sending HttpBody.formData request bodies.

• #​9564 ab0f384 Thanks @​tim-smart! - Defer 100 Continue responses until the application starts reading the request body, so early rejections of Expect: 100-continue requests do not prompt clients to upload.

• #​9710 bb49b9a Thanks @​effect-bot! - Support HTTP/2 servers in NodeHttpServer. make, layerServer, layer and layerConfig accept Http2.createServer() and Http2.createSecureServer(), including allowHTTP1, without a cast. HTTP/2 requests no longer expose pseudo-headers, so HttpServerRequest.toWeb works, and toURL uses the request's :scheme and :authority. Responses drop the connection-specific headers HTTP/2 forbids instead of being lost, a body that fails after the headers were sent resets the stream with INTERNAL_ERROR instead of ending cleanly, and shutdown closes idle HTTP/2 sessions, so it no longer waits for the graceful timeout on Node 22.

  Breaking (types only): NodeHttpServerRequest.toIncomingMessage and toServerResponse now return Http.IncomingMessage | Http2.Http2ServerRequest and Http.ServerResponse | Http2.Http2ServerResponse. Code that uses members only the HTTP/1.1 objects have needs to narrow first, for example on httpVersionMajor.

• #​9412 0317f20 Thanks @​fubhy! - NodeHttpServer now responds with a 500 when a handler returns a status outside 200-599. Previously a 1xx status left the client without a final response, and statuses above 599 were sent as is.

• #​9380 5a13d9d Thanks @​fubhy! - Fix NodeHttpServer requests hanging when Node rejects the response headers. The server now sends a fallback error response, or destroys the response if that also fails.

• #​9255 e24cd76 Thanks @​jayhemnani9910! - Abort the connection when a streamed response body fails after headers are sent. Previously the response ended normally, so clients treated the truncated body as complete.

• #​9458 26de861 Thanks @​tim-smart! - Avoid loading Node's internal undici on cold start when importing effect/Schema or starting a Node HTTP server before any web API is used. Schema.FormData resolves the global constructor during validation, and @effect/platform-node loads node:http and node:https without evaluating their lazy web API exports.

• #​9701 e618f10 Thanks @​effect-bot! - Require an explicit trusted proxy policy before applying forwarded headers.

  HttpMiddleware.xForwardedHeaders now takes { trustedProxies } and only applies X-Forwarded-* headers when the connecting peer is trusted. X-Forwarded-For is read from the right, skipping trusted proxies, and X-Forwarded-Host / X-Forwarded-Proto are only used when they line up with it.

  HttpServerRequest.toURL no longer reads x-forwarded-proto directly. It uses the new request.protocol, set by the trusted proxy middleware, before the transport scheme. The connecting peer stays available as request.peerAddress.

  import { HttpMiddleware } from "effect/http"
  import { IpNetwork } from "effect/net"
  
  // before
  HttpMiddleware.xForwardedHeaders
  
  // after
  HttpMiddleware.xForwardedHeaders({
    trustedProxies: [IpNetwork.fromStringUnsafe("10.0.0.0/8")]
  })

• #​9503 74532b6 Thanks @​tim-smart! - Update repository dependencies to their latest compatible releases.

• #​9280 da91aae Thanks @​okarin1511! - Keep the thrown error as the cause when a Browser or Deno worker runner receives an error event, and fix the grammar of the messageerror failure message.

• Updated dependencies [ce13a48, f3bbbb4, 5547315, 6093cfb, 30319d5, 74a7596, bfb32a3, f8bf7f4, 7f3d3df, db1046d, 3c4f88a, 916e709, 916f843, 66ec757, daac06f, c2552ec, b02c1cd, 1855f1d, 683ed2c, ac68940, 22a8401, c53c194, ca6d1cc, 47940c5, e8b24ef, 2e8aae0, ad7497b, 7f504a3, 99e365d, 954067d, 3e1a035, 41a1fe7, bcb3a86, 739d3d1, ed4da35, 3d84e19, cc00906, 09ba1f5, 9ff1a73, 06bc532, 97bfd84, 25efaef, c10335b, a808972, 20e844c, b9f73f3, 5739878, 28acdf3, 59b6396, 0bccc9c, fed70de, 82648a2, afb5f32, 28813f5, 0fae934, f260830, 19b63eb, 14db221, 679f956, b72707c, 44c8c1d, 1e7909b, 0611a65, 2fadc65, feb6ce5, 5a2ed53, c8d26a4, 0c8b446, 05c3409, b04191b, 05c3409, 4067e64, e04563d, 02d7fc5, 561d2a1, 8fe2dcc, a8086fa, 88a33b4, e77372a, 3dd4388, ba2b00c, a049d4a, 84aeede, 43e5e19, 77bbf16, 6af3a47, aac8d21, 84c8dc4, 78d1988, 5676a2a, 4b437bf, 1af11fd, 716f8df, ee27718, 4d86d1b, 5462ed7, 658837c, 00261cc, 7cccb93, 7c98228, 5a8e248, 8037a65, 25912db, 7f32606, 0386f88, 403298a, d1201f0, 5a3ebc0, fac2191, fdb12dc, 97909b8, c3983f4, 3a5e65e, 8b40fbc, 3f3e119, 7c7b8ed, d4f71bc, c66241e, f0e941e, 5f8a6e5, 2800a09, e9749b0, eaef09c, a3c56e5, bb61152, e9c842b, 6d8c8e2, 1f28187, 0b9842b, c29ddd8, 84c3405, 3934c0c, 048e7c8, 1121334, 9a680d6, 85e2aee, 34ec440, 343a149, 915117b, 7f823c1, 6e614e6, 9990b39, 22bf781, 41f08b7, e8482ca, 5ae85fa, c477a0a, 8fbb39e, 1c70828, 8207d1e, 7886b84, 4839c60, 2595d83, f5ae278, 7a8ce00, 688d302, c7072e4, 425cedb, 88bc680, 268e09c, 7e94505, afa5da3, c29ddd8, f30db15, a299341, 6250d31, 28b2931, ae9628d, 48102ac, 463eca3, e7162ea, 95752db, 4577a28, 973d599, 2f066a5, f0ccbb6, 2dda6ce, 3da7c0a, 5a67e0b, 73b3a6e, c6f9e4c, be02676, 26de861, 9313799, d5c1e5b, 11bb31f, 8c23e46, 9c96011, 0d50570, 9ed2bf1, 76ec912, af2756d, 3ec8100, 93abf02, 1e94993, 99a4616, 0a7978e, b4a060b, 274f4a4, 25f29be, 9036440, 415f005, 191308b, 4b96570, d84ec3f, 392aa1c, 99e9bd9, 6f6f45f, 13fc07e, a4b38dd, 8b18580, 0c477fe, 9a5331d, a706d73, c9a1e72, 89eaaf8, 8215811, ad69018, a733eba, 7282d5f, da33572, d9e2d12, dc923b8, 1b74086, 8a5507b, 23460fa, 0dbbea6, 70aad3f, 0909236, a9e66d8, ee5c0d5, 631c5d6, 7e60c1a, 4cddd3c, 8727e5d, 2bc97fa, f9a7f05, d978cca, b334ccf, 0b50cfc, 5b7d2b5, 6ee26b1, eab7e6a, e618f10, da14b1f, 3314fc3, 66db624, 41cf29b, 4b8a50d, 8d52668, 1de1055, db130e6, 5fa5fa5]:

  • effect@​4.0.6
  • @​effect/platform-node-shared@4.0.6

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.2

Compare Source

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #​1766) by @​kishormorol in #​2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in #​2958
• chore: bump version to 1.32.2 by @​claude[bot] in #​3089

New Contributors

• @​kishormorol made their first contribution in #​2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Effect-TS/effect (effect)

v4.0.6

Compare Source

Patch Changes

• #​9674 ce13a48 Thanks @​effect-bot! - Allow Response.AllParts, Response.Part and Response.StreamPart to be called without a toolkit, decoding tool call and tool result parts for any tool name with unknown parameters and results.

• #​9696 f3bbbb4 Thanks @​gcanti! - Fix Array.unionWith calling custom equivalence callbacks with values from the wrong input or in the wrong order.

• #​9511 5547315 Thanks @​sledorze! - Speed up field copying in Data.Class, Data.Error, Request.Class and Persistable constructors.

• #​9743 6093cfb Thanks @​effect-bot! - Fix AsyncResult equality treating unrelated Equal values with a matching tag and hash as equal.

• #​9607 30319d5 Thanks @​effect-bot! - Fix Effect atoms dropping the latest exposed success when an asynchronous run fails, so an initialValue or a success published with get.setSelf remains available as the failure's previous success.

• #​9313 74a7596 Thanks @​effect-bot! - Preserve Reactivity and global layers when replacing an atom runtime layer through registry initial values, so injected test layers retain shared invalidation and global services.

• #​9190 bfb32a3 Thanks @​danieljvdm! - Log Atom scope finalizer failures at References.UnhandledLogLevel when an atom is disposed, using the atom runtime's logger. Interruption-only cleanup is not logged.

• #​9522 f8bf7f4 Thanks @​tim-smart! - Add a skipInitialRun option to Atom.serializable and Atom.initialValue. A seeded effect or stream atom then keeps its hydrated or initial value instead of running on mount, until it is refreshed or a dependency changes. Factory get(...) calls and withReactivity keys are still tracked; dependencies read inside the effect are tracked from its first real run.

• #​9718 7f3d3df Thanks @​fubhy! - Add Base64Url.encodePadded and a padding option to SchemaGetter.encodeBase64Url for consumers that require padded URL-safe Base64.

• #​9698 db1046d Thanks @​effect-bot! - Encode HttpClientRequest.basicAuth credentials as UTF-8 before base64 encoding, so non-ASCII usernames and passwords no longer throw or get mangled.

• #​9326 3c4f88a Thanks @​effect-bot! - Block imports of nested internal modules in the development and published package exports. These implementation details are not public APIs; public entry points remain available.

• #​9441 916e709 Thanks @​fubhy! - Add the unstable Bytes module with concat, Equivalence, and Order for Uint8Array values. Stream.mkUint8Array now returns Uint8Array<ArrayBuffer>. Browser HTTP clients collect streamed request bodies without repeatedly copying accumulated bytes.

• #​9470 916f843 Thanks @​tim-smart! - Reduce EventLog remote replay overhead by reusing decoded conflict payloads within each batch.

• #​9617 66ec757 Thanks @​Marve10s! - Fix Effect.cachedInvalidateWithTTL caching a stale result when invalidated while the effect is running.

• #​9499 daac06f Thanks @​schutzelaars! - Fix Effect.callback retaining completed suspension state, such as values received by Deferred.await or PubSub.take, until the next full GC.

• #​9727 c2552ec Thanks @​Marve10s! - Fix Cause.pretty, Cause.prettyErrors, loggers and runMain overflowing the stack when an error's cause chain is cyclic.

• #​9540 b02c1cd Thanks @​Marve10s! - Preserve falsy nested error causes (0, false, "", null) in Cause.prettyErrors and Cause.pretty.

• #​9418 1855f1d Thanks @​jpowersdev! - Fix Channel.fromTransformStream so an upstream failure is reported when a read is pending, instead of the error raised by aborting the transform stream.

• #​9602 683ed2c Thanks @​effect-bot! - Preserve Prompt.FilePart byte and URL data when chat history is exported or persisted as JSON. Encoding now produces tagged { _tag: "Uint8Array", base64 } and { _tag: "URL", href } objects that decode back to their original types, and Chat.Persistence reports undecodable stored history as a PersistenceError instead of a defect.

• #​9238 ac68940 Thanks @​effect-bot! - Fix child-process cleanup without forceKillAfter to give remaining process-group members up to one second to exit after the leader exits. Clarify that waiting for the leader has no time limit and never escalates to SIGKILL when forceKillAfter is omitted.

• #​9611 22a8401 Thanks @​itisrmk! - Fix Chunk.get and Chunk.getUnsafe throwing on in-range fractional indexes of one-element chunks, and treat NaN and infinite indexes as out of bounds.

• #​9287 c53c194 Thanks @​devangpratap! - Fix the CLI lexer treating a short option cluster with an inline value, such as -vn=3, as one unknown flag instead of -v -n=3. A single dash followed by a multi-character name, such as -num=3, is now also split into separate flags; use --num=3 instead.

• #​9655 [ca6d1cc](https://redirect.github.com/Effect-TS/effect/commit/ca6d1cc5f803cd501e85

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Chisinau)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}