[dependabot]

Bumps the prod-patch-minor group in /services/management-panel with 10 updates:

Package	From	To
@supabase/supabase-js	2.117.3	2.118.0
@tauri-apps/api	2.12.2	2.12.4
@tauri-apps/plugin-fs	2.6.0	2.7.1
@tauri-apps/plugin-notification	2.5.1	2.7.0
@tauri-apps/plugin-shell	2.4.1	2.5.0
@tauri-apps/plugin-updater	2.13.2	2.14.0
effect	4.0.2	4.0.5
lucide-react	1.54.0	1.58.0
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1

Updates @supabase/supabase-js from 2.117.3 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

• postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
• storage: add content-encoding support for uploads (#1949)

🩹 Fixes

• ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

• Atharv Gaur @​Athaxv
• Ferhat Elmas
• Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

• postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

• ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

• Lukas Klingsbo

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

• postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

• Lukas Klingsbo

Commits

• b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
• 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
• aac9d32 chore(release): version 2.117.3 changelogs (#2744)
• See full diff in compare view

Updates @tauri-apps/api from 2.12.2 to 2.12.4

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.4

All found vulnerabilities were already reviewed and decided to be ignored
1 ignored: 1 high

[2.12.4]

What's Changed

• dc637db65 (#16260) Improve menu documentation.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m955ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.5s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/21//idtoken/c37ddb61-7d6d-84f8-af6e-d0b7e7d7955a/56cb7a72-c3b4-5319-90d2-88ed76ba30ee?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 128ms
📦 @tauri-apps/api@2.12.4 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/21//idtoken/c37ddb61-7d6d-84f8-af6e-d0b7e7d7955a/56cb7a72-c3b4-5319-90d2-88ed76ba30ee?api-version=2.0&audience=sigstore 200 58ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.4

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

... (truncated)

Commits

• 59b63ab Apply Version Updates From Current Changes (#16255)
• 55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
• 744ff2b chore(deps): bump rustls to 0.23.46
• c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
• dc637db chore: add missing api change file (#16260)
• b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
• 7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
• 5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
• 5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
• 141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.6.0 to 2.7.1

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-notification from 2.5.1 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-notification's releases.

fs-js v2.7.0

[2.7.0]

• a934743b (#3637) Added the scopeDroppedPaths plugin config option (plugins > fs > scopeDroppedPaths in tauri.conf.json). Set it to false to stop adding the paths dropped onto any window to the fs scope, which otherwise gives every webview with an fs permission access to them (directories recursively). Defaults to true, the current behaviour.
• 085a0283 (#3636) Fixed a panic on Android when a content provider returns no file descriptor for a content:// URI (e.g. virtual files). The fs command now fails with an error instead.
• f81f0447 (#3635) Fixed reading uncompressed Android assets ($RESOURCE files such as images or audio that are stored uncompressed in the APK) returning the bytes of the APK instead of the asset. Assets are now always read from a copy in the app cache, like compressed ones.
• e03dca60 (#3628) startAccessingSecurityScopedResource and stopAccessingSecurityScopedResource now accept absolute paths on iOS, as documented, instead of silently doing nothing unless given a file:// URL.
• 5de7ebfc (#3634) Security: the open command no longer accepts a customFlags option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary open(2) flags (e.g. O_TRUNC) to files it may only read. OpenOptionsExt::custom_flags still works from Rust.
• 5e6c023a (#3626) FileHandle.read no longer allocates a buffer of the requested size up front: the length is capped to the rest of the file (64 MiB for files of unknown size), an allocation failure is reported as an error instead of aborting the app, and only the bytes that were read are sent back to the webview.
• 3a900017 (#3627) Security: the fs scope check now resolves symlinks in the ancestors of paths that do not exist yet, and resolves relative symlink targets against the link's directory instead of the process working directory. Previously a new file created below a symlinked directory inside the scope (writeFile, mkdir, create, rename, copyFile, ...) was written outside of the scope. Deny patterns now also apply to the path as given, so they can name a symlink, and a path whose symlinks cannot be resolved (e.g. a loop) is rejected.
• 77d00a4f (#3633) FileHandle.seek now rejects a negative offset with SeekMode.Start instead of seeking to a huge position.
• 5c144e74 (#3631) Fixed readTextFileLines with a UTF-16 encoding splitting lines on a 0x0A 0x00 (LE) or 0x00 0x0A (BE) byte sequence that is not aligned on a code unit, e.g. ਗĀ, which garbled every following line.
• dcc8cb03 (#3629) Fixed writeFile with a ReadableStream leaving the end of the previous contents in place when the new data is shorter. The file is now truncated first unless append is set, like when writing a buffer.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 39.9kB dist-js/index.cjs
npm notice 41.1kB dist-js/index.d.ts
npm notice 39.2kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-fs-2.7.0.tgz
npm notice package size: 25.6 kB
npm notice unpacked size: 124.3 kB
npm notice shasum: e76d4d07b05063de6911fd1c42948ab0264ac20e
npm notice integrity: sha512-8RQbPkuYuLZ2r[...]GdKJVqDokyDgQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189606635
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-fs@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-shell from 2.4.1 to 2.5.0

Release notes

Sourced from @​tauri-apps/plugin-shell's releases.

shell-js v2.5.0

[2.5.0]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.
• a8acd178 (#3351) Add processGroup option to spawn commands in a new process group (POSIX) or job object (Windows), allowing the entire process tree to be killed when calling kill() on the child process.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-shell@2.5.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 21.8kB dist-js/index.cjs
npm notice 22.0kB dist-js/index.d.ts
npm notice 21.7kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 656B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-shell
npm notice version: 2.5.0
npm notice filename: tauri-apps-plugin-shell-2.5.0.tgz
npm notice package size: 8.0 kB
npm notice unpacked size: 69.6 kB
npm notice shasum: 16d0b1a1f5b02689777a01dc78b9d591eec3a3b7
npm notice integrity: sha512-FZ6RtcikCxJ35[...]DcLs7JIfuFkWw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189638540
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-shell@2.5.0

shell v2.5.0

[2.5.0]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.
• a8acd178 (#3351) Add processGroup option to spawn commands in a new process group (POSIX) or job object (Windows), allowing the entire process tree to be killed when calling kill() on the child process.

... (truncated)

Commits

• d6a3898 Publish New Versions (v2) (#3268)
• 2e5bcdf chore(deps): fix audits (#3373)
• 4374b4f chore(notification): remove unused dev-deps (#3372)
• f75d21d chore(deps): remove used of tauri-utils build feature (#3360)
• 4b95f5e chore(deps): update dependency eslint to v10.1.0 (#3357)
• 99c3e37 chore(deps): bump tar in /plugins/updater/tests/updater-migration/v1-app (#3352)
• eaac19a chore(deps): update rust crate tar to v0.4.45 [security] (#3353)
• 5183e31 chore(deps): update dependency typescript-eslint to v8.57.1 (#3344)
• 2c0883e chore(deps): update dependency vite to v8 (#3346)
• 024ec0c fix(deep-link): ChromeOS deep link calls filtered and ignored by plugin (fix ...
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-updater from 2.13.2 to 2.14.0

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.14.0

[2.14.0]

• b6f39cc5 (#3688 by @​followdarko) On Linux, installing an AppImage update no longer fails with Invalid cross-device link (os error 18) when the temp or cache directory is a separate mount of the AppImage's file system, such as a bind-mounted or private /tmp. The backup now moves on to the next location, ending with the AppImage's own directory.

• f2af373b (#3696 by @​lucasfernog) On Linux, reject an AppImage update that is neither an AppImage nor a compressed AppImage (or a compressed AppImage when the zip feature is disabled) before touching the installed app. Such payloads were written over the AppImage as-is, corrupting the app.

• 24e6451b (#3693 by @​lucasfernog) On Linux, try the next temporary directory location (the user cache directory, then the directory holding the AppImage) when a temporary directory cannot be created in the previous one, instead of failing the AppImage update right away. Also avoids a panic when the app path has no parent directory.

• a819187e (#3690 by @​lucasfernog) check(), Update.download() and Update.downloadAndInstall() no longer replace the headers of the options object they are given with an array.

• 7b7c7c62 (#3691 by @​lucasfernog) Calling Update.download() again now releases the bytes of the previous download instead of keeping them in memory until the webview is destroyed.

• 4b1ba079 (#3695 by @​lucasfernog) On Android and iOS, Update::install now returns Error::UnsupportedOs instead of reporting success without installing anything.

• fce235c3 (#3640 by @​t8y2) Add Updater::restore_update to restore an update from cached release metadata, and Update::verify to verify package bytes using the configured signing key and signed-version policy. Restored updates always require the signature to bind the announced version.

  Update::install now verifies the package bytes before installing them, and Updater::check resolves to None instead of a target error when the release is not an update and has no entry for the current target.

• d057ec47 (#3694 by @​lucasfernog) Log a warning when the download URL of an update does not use https and dangerousInsecureTransportProtocol is not enabled.

• 21ebe1f5 (#3692 by @​lucasfernog) On Windows, report why launching the installer failed from the ShellExecuteW return value (for example "Access is denied" when the user declines the UAC prompt) instead of an unrelated GetLastError message.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.14.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 6.9kB dist-js/index.cjs
npm notice 7.1kB dist-js/index.d.ts
npm notice 6.8kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.14.0
npm notice filename: tauri-apps-plugin-updater-2.14.0.tgz
npm notice package size: 4.9 kB
npm notice unpacked size: 25.5 kB
npm notice shasum: 212adc6dc62e7c9bda0c216f12b3eee0824f6908
npm notice integrity: sha512-gdylJ9tger4hk[...]nALfrqIPSzh7Q==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3253707095
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-updater@2.14.0

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates effect from 4.0.2 to 4.0.5

Release notes

Sourced from effect's releases.

effect@4.0.5

Patch Changes

• #9055 f665607 Thanks @​Tyagiquamar! - Pass a NonEmptyArray to the onNonEmpty callback of Array.match when the input is a mutable array.

• #9110 dbf442b Thanks @​petar-omni! - Fix AsyncResult.all failures carrying a single input's previousSuccess instead of the combined record or tuple.

• #9105 74d1930 Thanks @​tim-smart! - Fix infinite atom rebuilds caused by late reads of uninitialized dependencies.

• #9145 a03afb6 Thanks @​jayhemnani9910! - Add Flag.withOptionalValue for GNU-style flags with an optional value, like --color[=WHEN]. A bare flag uses the given value; an explicit value must be attached with =.

• #9131 f159284 Thanks @​tim-smart! - Fix lost deferred callback wakes in cluster workflows when an activity suspends while a parallel activity is still running.

• #9094 5d301cc Thanks @​okxint! - Name cluster entity RPC server spans by entity type only (e.g. WorkflowEntity.Run) so span names stay low-cardinality. The entity ID is still recorded in the entity.id span attribute.

• #9176 cd74ea2 Thanks @​effect-bot! - Recover persisted local cluster replies from storage to prevent requests hanging when replies arrive before handler registration. Retain local reply notifications as storage-reader wakeups for low-latency streaming.

  Defer terminal in-memory reply publication until the successful outer transaction completes, preserving the commit boundary for reply readers.

• #9095 925cf64 Thanks @​jayhemnani9910! - Fix ConfigProvider.fromDotEnv and fromDotEnvContents rescanning expanded values when expandVariables is enabled. Self and circular references no longer overflow the stack, escaped \$NAME stays literal, and defaults apply when a reference expands to an empty value.

• #9109 54c51d9 Thanks @​devangpratap! - Fix Duration conversions throwing for very large millisecond values, and make those durations equal to their nanosecond equivalents.

• #9161 995c104 Thanks @​devangpratap! - Fix Duration conversions losing nanosecond precision for large integer millisecond values.

• #9112 816575e Thanks @​effect-bot! - Use bigint for 64-bit FileSystem.File.Info metadata. dev is now a bigint, and ino, rdev, nlink, and blocks are Option<bigint>, so file stats no longer fail or drop values outside the safe integer range. Node and Bun read dev, ino, rdev, and nlink as unsigned 64-bit integers. Deno reports these fields as numbers, so values above Number.MAX_SAFE_INTEGER are rounded by Deno before conversion.

• #9150 0df6e06 Thanks @​tim-smart! - Support per-request URLs in GraphQLProtocol.layerHttp and makeHttp, as a function of the context and operation or as an Effect<string>. GraphQLResolver batches lookups by URL.

• #9137 52a7d3c Thanks @​tim-smart! - Add HttpClientRequest.compressBody for gzip and deflate request body compression.

• #9160 ec831c3 Thanks @​fubhy! - Accept Redacted values as URL parameters in UrlParams and HttpClientRequest.

• #9138 3abc63e Thanks @​tim-smart! - Add HttpMiddleware.decompression, which decompresses gzip and deflate request bodies, limits the decompressed size, and rejects other codings with 415.

• #9113 a841b8b Thanks @​effect-bot! - Fix interruption calling Math.random and hashing defects, which made deterministic hosts that forbid randomness loop forever or overflow the stack.

• #9098 91efea7 Thanks @​armancharan! - Narrow only the matched prefix when a Match tuple pattern is applied to an array or variadic tuple, so the remaining elements keep their original type.

• #9151 e271997 Thanks @​tim-smart! - Fix McpServer types to require schema services for resource templates and encoding services for prompt parameters with completion handlers. Missing services are now caught at compile time.

• #9117 7719bda Thanks @​jayhemnani9910! - Pad 64-bit trace ids to 128 bits in OTLP exports and traceparent headers.

• #9139 563397f Thanks @​tim-smart! - Add opt-in gzip compression to built-in OTLP JSON and protobuf exporters via the compression option or OTEL_EXPORTER_OTLP_COMPRESSION and per-signal environment variables. Compress batches once before retries using HttpClientRequest.compressBody, retaining its default 1KB threshold and uncompressed defaults.

• #9127 65b04f8 Thanks @​effect-bot! - Add Path.resolveWithin(root, input), which resolves a relative path beneath a root and returns Option.none() for traversal escapes and rooted inputs, using the platform's path rules.

• #9143 c2859bf Thanks @​danieljvdm! - Collect tool approvals once per LanguageModel request instead of twice.

• #9134 c462214 Thanks @​effect-bot! - Reduce SQLite statement overhead by borrowing the shared connection while preserving semaphore exclusion and failed-COMMIT recovery.

... (truncated)

Changelog

Sourced from effect's changelog.

4.0.5

Patch Changes

• #9055 f665607 Thanks @​Tyagiquamar! - Pass a NonEmptyArray to the onNonEmpty callback of Array.match when the input is a mutable array.

• #9110 dbf442b Thanks @​petar-omni! - Fix AsyncResult.all failures carrying a single input's previousSuccess instead of the combined record or tuple.

• #9105 74d1930 Thanks @​tim-smart! - Fix infinite atom rebuilds caused by late reads of uninitialized dependencies.

• #9145 a03afb6 Thanks @​jayhemnani9910! - Add Flag.withOptionalValue for GNU-style flags with an optional value, like --color[=WHEN]. A bare flag uses the given value; an explicit value must be attached with =.

• #9131 f159284 Thanks @​tim-smart! - Fix lost deferred callback wakes in cluster workflows when an activity suspends while a parallel activity is still running.

• #9094 5d301cc Thanks @​okxint! - Name cluster entity RPC server spans by entity type only (e.g. WorkflowEntity.Run) so span names stay low-cardinality. The entity ID is still recorded in the entity.id span attribute.

• #9176 cd74ea2 Thanks @​effect-bot! - Recover persisted local cluster replies from storage to prevent requests hanging when replies arrive before handler registration. Retain local reply notifications as storage-reader wakeups for low-latency streaming.

  Defer terminal in-memory reply publication until the successful outer transaction completes, preserving the commit boundary for reply readers.

• #9095 925cf64 Thanks @​jayhemnani9910! - Fix ConfigProvider.fromDotEnv and fromDotEnvContents rescanning expanded values when expandVariables is enabled. Self and circular references no longer overflow the stack, escaped \$NAME stays literal, and defaults apply when a reference expands to an empty value.

• #9109 54c51d9 Thanks @​devangpratap! - Fix Duration conversions throwing for very large millisecond values, and make those durations equal to their nanosecond equivalents.

• #9161 995c104 Thanks @​devangpratap! - Fix Duration conversions losing nanosecond precision for large integer millisecond values.

• #9112 816575e Thanks @​effect-bot! - Use bigint for 64-bit FileSystem.File.Info metadata. dev is now a bigint, and ino, rdev, nlink, and blocks are Option<bigint>, so file stats no longer fail or drop values outside the safe integer range. Node and Bun read dev, ino, rdev, and nlink as unsigned 64-bit integers. Deno reports these fields as numbers, so values above Number.MAX_SAFE_INTEGER are rounded by Deno before conversion.

• #9150 0df6e06 Thanks @​tim-smart! - Support per-request URLs in GraphQLProtocol.layerHttp and makeHttp, as a function of the context and operation or as an Effect<string>. GraphQLResolver batches lookups by URL.

• #9137 52a7d3c Thanks @​tim-smart! - Add HttpClientRequest.compressBody for gzip and deflate request body compression.

• #9160 ec831c3 Thanks @​fubhy! - Accept Redacted values as URL parameters in UrlParams and HttpClientRequest.

• #9138 3abc63e Thanks @​tim-smart! - Add HttpMiddleware.decompression, which decompresses gzip and deflate request bodies, limits the decompressed size, and rejects other codings with 415.

• #9113 a841b8b Thanks @​effect-bot! - Fix interruption calling Math.random and hashing defects, which made deterministic hosts that forbid randomness loop forever or overflow the stack.

• #9098 91efea7 Thanks @​armancharan! - Narrow only the matched prefix when a Match tuple pattern is applied to an array or variadic tuple, so the remaining elements keep their original type.

• #9151 e271997 Thanks @​tim-smart! - Fix McpServer types to require schema services for resource templates and encoding services for prompt parameters with completion handlers. Missing services are now caught at compile time.

• #9117 7719bda Thanks @​jayhemnani9910! - Pad 64-bit trace ids to 128 bits in OTLP exports and traceparent headers.

• #9139 563397f Thanks @​tim-smart! - Add opt-in gzip compression to built-in OTLP JSON and protobuf exporters via the compression option or OTEL_EXPORTER_OTLP_COMPRESSION and per-signal environment variables. Compress batches once before retries using HttpClientRequest.compressBody, retaining its default 1KB threshold and uncompressed defaults.

• #9127 65b04f8 Thanks @​effect-bot! - Add Path.resolveWithin(root, input), which resolves a relative path beneath a root and returns Option.none() for traversal escapes and rooted inputs, using the platform's path rules.

• #9143 c2859bf Thanks @​danieljvdm! - Collect tool approvals once per LanguageModel request instead of twice.

... (truncated)

Commits

• 7f524e2 Version Packages (Description has been truncated