[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@effect/platform-node (source)	4.0.1 → 4.0.6

---

Release Notes

Effect-TS/effect (@​effect/platform-node)

v4.0.6

Compare Source

Patch Changes

• #​9506 679f956 Thanks @​tim-smart! - Use Effect.fnUntraced for internal functions that returned Effect.gen.

• #​9262 51930c0 Thanks @​effect-bot! - Return a typed multipart parse error instead of a defect when a multipart request is missing its boundary.

• #​9402 d1201f0 Thanks @​effect-bot! - Release writables created by NodeSink.fromWritable and fromWritableChannel when upstream fails or the sink is interrupted, preserving the original exit cause. Writables using endOnDone: false remain open. Preserve stream body encoding errors in the Node HTTP client instead of reporting transport errors caused by request cleanup.

• #​9575 c29ddd8 Thanks @​tim-smart! - Add streaming request payloads to HttpApi. An endpoint can declare HttpApiSchema.StreamUint8Array or the new HttpApiSchema.StreamNdjson({ schema }) as its payload, and the handler receives a lazy Stream that reads the body as it pulls. Bad NDJSON lines fail the stream with HttpApiSchemaError (400). The new maxBytes and maxElementBytes limits fail it with the new HttpApiPayloadTooLarge (413), and a content-length over maxBytes is rejected before the handler runs. StreamNdjson also works as a success response.

  HttpApiClient sends a Stream payload without buffering it and infers the stream's requirements. HttpApiTest passes stream payloads through unbuffered. OpenApi.fromApi marks streaming request bodies with x-effect-stream, and openapi-generator maps them, and NDJSON or JSON Lines bodies with an itemSchema, back to StreamUint8Array and StreamNdjson.

  The Node server drains up to 256 KiB of a body the handler left unread, then closes the connection, instead of reading the whole upload or leaving the socket stuck.

• 3934c0c Thanks @​tim-smart! - Return 413 instead of 400 when buffered or decompressed request bodies exceed their size limit, while preserving 400 for other parse failures. Node HTTP servers drain oversized bodies so the response can reach the client without destroying the socket. Node stream readers expose MaxBytesError and an optional destroyOnOverflow setting; their default destruction behavior is unchanged.

• #​9339 9a680d6 Thanks @​fubhy! - Add raw HTTP/1.1 upgrades through HttpClientRequest.upgrade, HttpClientResponse.upgrade, the Node HTTP server, and HttpApiSchema.Upgrade. Node clients expose the upgraded connection as a Socket; HttpApi clients return { headers, socket } and OpenAPI documents the 101 response.

  Custom HttpClientResponse implementations must add upgrade. Fetch and XMLHttpRequest reject upgrade requests with a TransportError before anything is sent; Bun and Deno servers still support only WebSocket upgrades.

• #​9417 7f823c1 Thanks @​fubhy! - Fix HTTP response framing: omit bodies for 204, 205 and 304, and remove content-length for 204 and 205. Node now aborts responses whose bodies do not match content-length. Deno and Bun preserve raw Web Response objects when merging headers, and Deno preserves their status and headers for HEAD requests.

• #​9415 6e614e6 Thanks @​fubhy! - - Fix HTTPS detection in HttpServerRequest.toURL and tracing. An exact http or https in x-forwarded-proto takes precedence; otherwise, infer HTTPS from originalUrl. Paths starting with // preserve the request host.

  • Node server requests now expose an absolute originalUrl when a Host header is present, fixing HttpMiddleware.searchParamsParser. Use url instead of originalUrl to read the path. Hostless requests are unchanged.
  • For absolute-form Node requests, derive url and headers.host from the request target, ignoring a conflicting Host header.

• #​9375 5a2d19f Thanks @​fubhy! - Use HTTP/2 authority for the exposed host header and request URL, even when Host is missing or conflicting. In Deno, also use the target authority for HTTP/1.1 absolute-form requests.

• #​9566 9972b4f Thanks @​tim-smart! - Keep streaming request bodies uploading after NodeHttpClient.layerNodeHttp receives response headers, allowing bidirectional request and response streaming. Stop unfinished uploads when the response is consumed, the connection closes or the request is cancelled, including with keep-alive agents.

• #​9413 29bee6f Thanks @​fubhy! - Fix NodeHttpClient.layerUndici hanging when sending HttpBody.formData request bodies.

• #​9564 ab0f384 Thanks @​tim-smart! - Defer 100 Continue responses until the application starts reading the request body, so early rejections of Expect: 100-continue requests do not prompt clients to upload.

• #​9710 bb49b9a Thanks @​effect-bot! - Support HTTP/2 servers in NodeHttpServer. make, layerServer, layer and layerConfig accept Http2.createServer() and Http2.createSecureServer(), including allowHTTP1, without a cast. HTTP/2 requests no longer expose pseudo-headers, so HttpServerRequest.toWeb works, and toURL uses the request's :scheme and :authority. Responses drop the connection-specific headers HTTP/2 forbids instead of being lost, a body that fails after the headers were sent resets the stream with INTERNAL_ERROR instead of ending cleanly, and shutdown closes idle HTTP/2 sessions, so it no longer waits for the graceful timeout on Node 22.

  Breaking (types only): NodeHttpServerRequest.toIncomingMessage and toServerResponse now return Http.IncomingMessage | Http2.Http2ServerRequest and Http.ServerResponse | Http2.Http2ServerResponse. Code that uses members only the HTTP/1.1 objects have needs to narrow first, for example on httpVersionMajor.

• #​9412 0317f20 Thanks @​fubhy! - NodeHttpServer now responds with a 500 when a handler returns a status outside 200-599. Previously a 1xx status left the client without a final response, and statuses above 599 were sent as is.

• #​9380 5a13d9d Thanks @​fubhy! - Fix NodeHttpServer requests hanging when Node rejects the response headers. The server now sends a fallback error response, or destroys the response if that also fails.

• #​9255 e24cd76 Thanks @​jayhemnani9910! - Abort the connection when a streamed response body fails after headers are sent. Previously the response ended normally, so clients treated the truncated body as complete.

• #​9458 26de861 Thanks @​tim-smart! - Avoid loading Node's internal undici on cold start when importing effect/Schema or starting a Node HTTP server before any web API is used. Schema.FormData resolves the global constructor during validation, and @effect/platform-node loads node:http and node:https without evaluating their lazy web API exports.

• #​9701 e618f10 Thanks @​effect-bot! - Require an explicit trusted proxy policy before applying forwarded headers.

  HttpMiddleware.xForwardedHeaders now takes { trustedProxies } and only applies X-Forwarded-* headers when the connecting peer is trusted. X-Forwarded-For is read from the right, skipping trusted proxies, and X-Forwarded-Host / X-Forwarded-Proto are only used when they line up with it.

  HttpServerRequest.toURL no longer reads x-forwarded-proto directly. It uses the new request.protocol, set by the trusted proxy middleware, before the transport scheme. The connecting peer stays available as request.peerAddress.

  import { HttpMiddleware } from "effect/http"
  import { IpNetwork } from "effect/net"
  
  // before
  HttpMiddleware.xForwardedHeaders
  
  // after
  HttpMiddleware.xForwardedHeaders({
    trustedProxies: [IpNetwork.fromStringUnsafe("10.0.0.0/8")]
  })

• #​9503 74532b6 Thanks @​tim-smart! - Update repository dependencies to their latest compatible releases.

• #​9280 da91aae Thanks @​okarin1511! - Keep the thrown error as the cause when a Browser or Deno worker runner receives an error event, and fix the grammar of the messageerror failure message.

• Updated dependencies [ce13a48, f3bbbb4, 5547315, 6093cfb, 30319d5, 74a7596, bfb32a3, f8bf7f4, 7f3d3df, db1046d, 3c4f88a, 916e709, 916f843, 66ec757, daac06f, c2552ec, b02c1cd, 1855f1d, 683ed2c, ac68940, 22a8401, c53c194, ca6d1cc, 47940c5, e8b24ef, 2e8aae0, ad7497b, 7f504a3, 99e365d, 954067d, 3e1a035, 41a1fe7, bcb3a86, 739d3d1, ed4da35, 3d84e19, cc00906, 09ba1f5, 9ff1a73, 06bc532, 97bfd84, 25efaef, c10335b, a808972, 20e844c, b9f73f3, 5739878, 28acdf3, 59b6396, 0bccc9c, fed70de, 82648a2, afb5f32, 28813f5, 0fae934, f260830, 19b63eb, 14db221, 679f956, b72707c, 44c8c1d, 1e7909b, 0611a65, 2fadc65, feb6ce5, 5a2ed53, c8d26a4, 0c8b446, 05c3409, b04191b, 05c3409, 4067e64, e04563d, 02d7fc5, 561d2a1, 8fe2dcc, a8086fa, 88a33b4, e77372a, 3dd4388, ba2b00c, a049d4a, 84aeede, 43e5e19, 77bbf16, 6af3a47, aac8d21, 84c8dc4, 78d1988, 5676a2a, 4b437bf, 1af11fd, 716f8df, ee27718, 4d86d1b, 5462ed7, 658837c, 00261cc, 7cccb93, 7c98228, 5a8e248, 8037a65, 25912db, 7f32606, 0386f88, 403298a, d1201f0, 5a3ebc0, fac2191, fdb12dc, 97909b8, c3983f4, 3a5e65e, 8b40fbc, 3f3e119, 7c7b8ed, d4f71bc, c66241e, f0e941e, 5f8a6e5, 2800a09, e9749b0, eaef09c, a3c56e5, bb61152, e9c842b, 6d8c8e2, 1f28187, 0b9842b, c29ddd8, 84c3405, 3934c0c, 048e7c8, 1121334, 9a680d6, 85e2aee, 34ec440, 343a149, 915117b, 7f823c1, 6e614e6, 9990b39, 22bf781, 41f08b7, e8482ca, 5ae85fa, c477a0a, 8fbb39e, 1c70828, 8207d1e, 7886b84, 4839c60, 2595d83, f5ae278, 7a8ce00, 688d302, c7072e4, 425cedb, 88bc680, 268e09c, 7e94505, afa5da3, c29ddd8, f30db15, a299341, 6250d31, 28b2931, ae9628d, 48102ac, 463eca3, e7162ea, 95752db, 4577a28, 973d599, 2f066a5, f0ccbb6, 2dda6ce, 3da7c0a, 5a67e0b, 73b3a6e, c6f9e4c, be02676, 26de861, 9313799, d5c1e5b, 11bb31f, 8c23e46, 9c96011, 0d50570, 9ed2bf1, 76ec912, af2756d, 3ec8100, 93abf02, 1e94993, 99a4616, 0a7978e, b4a060b, 274f4a4, 25f29be, 9036440, 415f005, 191308b, 4b96570, d84ec3f, 392aa1c, 99e9bd9, 6f6f45f, 13fc07e, a4b38dd, 8b18580, 0c477fe, 9a5331d, a706d73, c9a1e72, 89eaaf8, 8215811, ad69018, a733eba, 7282d5f, da33572, d9e2d12, dc923b8, 1b74086, 8a5507b, 23460fa, 0dbbea6, 70aad3f, 0909236, a9e66d8, ee5c0d5, 631c5d6, 7e60c1a, 4cddd3c, 8727e5d, 2bc97fa, f9a7f05, d978cca, b334ccf, 0b50cfc, 5b7d2b5, 6ee26b1, eab7e6a, e618f10, da14b1f, 3314fc3, 66db624, 41cf29b, 4b8a50d, 8d52668, 1de1055, db130e6, 5fa5fa5]:

  • effect@​4.0.6
  • @​effect/platform-node-shared@4.0.6

v4.0.5

Compare Source

Patch Changes

• #​9158 5951ac0 Thanks @​fubhy! - Add typed connection options to NodeHttpClient for unix sockets and mutual TLS.

• #​9136 12be65e Thanks @​tim-smart! - Redact sensitive query values in HTTP spans, request inspection and error messages. Also redact URL credentials in client spans, request inspection and errors. Request URLs sent over the wire are unchanged.

  Move AWSAccessKeyId, Signature, sig and X-Goog-Signature from Headers.CurrentRedactedNames to the new UrlParams.CurrentRedactedNames. A custom list replaces these defaults. Add UrlParams.isRedactedName, UrlParams.redact and UrlParams.redactUrl for explicit redaction.

• Updated dependencies [f665607, dbf442b, 74d1930, a03afb6, f159284, 5d301cc, cd74ea2, 925cf64, 54c51d9, 995c104, 816575e, acc7860, 0df6e06, 52a7d3c, ec831c3, 3abc63e, a841b8b, 91efea7, e271997, 7719bda, 563397f, 65b04f8, c2859bf, c462214, d1ad2c7, 12be65e, 352618a, 2a8ec8b, 8dec89d, f05642f, 3ad9a0c, dba4e52, 7ca8224, 65d20dd, e3ff963, bc454a3, 793d89e, ec9332b, f2b3d8a, cb2cf5f, b8c201d, 118c9c4]:

  • effect@​4.0.5
  • @​effect/platform-node-shared@4.0.5

v4.0.4

Compare Source

Patch Changes

• #​9014 95a3ab7 Thanks @​jayhemnani9910! - Ignore a leading UTF-8 BOM when decoding Node HTTP request and response text, so json no longer fails on BOM-prefixed bodies.
• Updated dependencies [7547a99, 711719d, 251f849, 8f1ea52, c93485e, 37e088f, 9314666, a0a26b7, cc843ea, ab90be9, a59b971, fccf660, 1bfd8fd, 78e4c43, fde67a1, 118deef, cea74c9, b7c1ac6, f837966, 09738f4, 22e7129, fdcb47e, fc349a1, ab90be9, 892d14d, 077c557, 4a999a3, 797696a, cf5179b, e1c6053, 5726c65]:
  • effect@​4.0.4
  • @​effect/platform-node-shared@4.0.4

v4.0.3

Compare Source

Patch Changes

• #​8973 9dbd07e Thanks @​fubhy! - Accept address inputs in Dns.reverse and name server inputs in the platform Dns services, and add Dns.nameServerFromInput.

• #​8880 a9b5148 Thanks @​fubhy! - Add experimental Host, Dns, and AddressResolver modules to effect/net for host parsing, DNS queries, and endpoint resolution, with Node, Bun, and Deno services. DNS operations accept and normalize domain-name strings; endpoint resolution also accepts host:port strings. Add scoped IPv6 literals and host and DNS record schemas, including JSON codecs for records.

  Provide the services explicitly; they are not included in the platform *Services layers. Use NodeAddressResolver.layer.pipe(Layer.provideMerge(NodeDns.layer)) to provide both Node services.

• #​8409 b9e7821 Thanks @​tim-smart! - Add DatagramSocket for UDP on Node, Bun, and Deno, and NetAddress.inetAddressFromNativeUnsafe for runtime-reported addresses.

• #​8934 8e5ab22 Thanks @​tim-smart! - Esc now ends terminal key input by default, cancelling CLI prompts with Terminal.QuitError. To keep Esc non-cancelling, pass a shouldQuit predicate to make, such as (input) => input.key.ctrl && (input.key.name === "c" || input.key.name === "d") to quit only on Ctrl+C or Ctrl+D.

• #​8978 0b17b9e Thanks @​tim-smart! - Allow WebSocket clients on Node and Bun to send handshake headers alongside subprotocols through socket constructors, channels, and layers. Preserve browser-compatible constructor calls when headers are not supplied.

• Updated dependencies [b4e5af8, b8d6e7a, 89d5c88, 66257d2, cd2ab19, ca068ce, f686000, e052f1b, c755b69, ebe487f, 63bfad8, 8598157, 76a03f7, 182e26d, a46592a, 1d3419e, e00eaae, 133ceb2, a494a64, d6082a2, ee3a350, 7ba976c, 9dbd07e, d4f7dc3, a9b5148, e7d84e4, 0e2b988, 84f48df, 48ed32f, 59e58a6, b9e7821, aa811e4, bfc5742, f9f7a5a, 73fa287, 7ff5048, 7803e51, [93410da](https://redire

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
@effect/platform-node @ 4.0.6 packages/cli/package.json pnpm-lock.yaml				🔗
@effect/platform-node-shared @ 4.0.6 pnpm-lock.yaml				🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}