This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [effect](https://effect.website) ([source](https://redirect.github.com/Effect-TS/effect/tree/HEAD/packages/effect)) | [`3.19.3` → `3.20.0`](https://renovatebot.com/diffs/npm/effect/3.19.3/3.20.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/effect/3.20.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/effect/3.19.3/3.20.0?slim=true) | --- ### Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC [CVE-2026-32887](https://nvd.nist.gov/vuln/detail/CVE-2026-32887) / [GHSA-38f7-945m-qr2g](https://redirect.github.com/advisories/GHSA-38f7-945m-qr2g)

More information

#### Details ##### Versions - `effect`: 3.19.15 - `@effect/rpc`: 0.72.1 - `@effect/platform`: 0.94.2 - Node.js: v22.20.0 - Vercel runtime with Fluid compute - Next.js: 16 (App Router) - `@clerk/nextjs`: 6.x ##### Root cause Effect's `MixedScheduler` batches fiber continuations and drains them inside a **single** microtask or timer callback. The `AsyncLocalStorage` context active during that callback belongs to whichever request first triggered the scheduler's drain cycle — **not** the request that owns the fiber being resumed. ##### Detailed mechanism ##### 1. Scheduler batching (`effect/src/Scheduler.ts`, `MixedScheduler`) ```typescript // MixedScheduler.starve() — called once when first task is scheduled private starve(depth = 0) { if (depth >= this.maxNextTickBeforeTimer) { setTimeout(() => this.starveInternal(0), 0) // timer queue } else { Promise.resolve(void 0).then(() => this.starveInternal(depth + 1)) // microtask queue } } // MixedScheduler.starveInternal() — drains ALL accumulated tasks in one call private starveInternal(depth: number) { const tasks = this.tasks.buckets this.tasks.buckets = [] for (const [_, toRun] of tasks) { for (let i = 0; i < toRun.length; i++) { toRun[i]() // ← Every fiber continuation runs in the SAME ALS context } } // ... } ``` `scheduleTask` only calls `starve()` when `running` is `false`. Subsequent tasks accumulate in `this.tasks` until `starveInternal` drains them all. The `Promise.then()` (or `setTimeout`) callback inherits the ALS context from whichever call site created it — i.e., whichever request's fiber first set `running = true`. **Result:** Under concurrent load, fiber continuations from Request A and Request B execute inside the same `starveInternal` call, sharing a single ALS context. If Request A triggered `starve()`, then Request B's fiber reads Request A's ALS context. ##### 2. `toWebHandlerRuntime` does not propagate ALS (`@effect/platform/src/HttpApp.ts:211-240`) ```typescript export const toWebHandlerRuntime = (runtime: Runtime.Runtime) => { const httpRuntime: Types.Mutable> = Runtime.make(runtime) const run = Runtime.runFork(httpRuntime) return (self: Default, middleware?) => { return (request: Request, context?): Promise => new Promise((resolve) => { // Per-request Effect context is correctly set via contextMap: const contextMap = new Map(runtime.context.unsafeMap) const httpServerRequest = ServerRequest.fromWeb(request) contextMap.set(ServerRequest.HttpServerRequest.key, httpServerRequest) httpRuntime.context = Context.unsafeMake(contextMap) // But the fiber is forked without any ALS propagation: const fiber = run(httpApp as any) // ← ALS context is NOT captured or restored }) } } ``` Effect's own `Context` (containing `HttpServerRequest`) is correctly set per-request. But the **Node.js ALS context** — which frameworks like Next.js, Clerk, and OpenTelemetry rely on — is not captured at fork time or restored when the fiber's continuations execute. ##### 3. The dangerous pattern this enables ```typescript // RPC handler — runs inside an Effect fiber const handler = Effect.gen(function*() { // This calls auth() from @clerk/nextjs/server, which reads from ALS const { userId } = yield* Effect.tryPromise({ try: async () => auth(), // ← may read WRONG user's session catch: () => new UnauthorizedError({ message: "Auth failed" }) }) return yield* repository.getUser(userId) }) ``` The `async () => auth()` thunk executes when the fiber continuation is scheduled by `MixedScheduler`. At that point, the ALS context belongs to an arbitrary concurrent request. ##### Reproduction scenario ``` Timeline (two concurrent requests to the same toWebHandler endpoint): T0: Request A arrives → POST handler → webHandler(requestA) → Promise executor runs synchronously → httpRuntime.context set to A's context → fiber A forked, runs first ops synchronously → fiber A yields (e.g., at Effect.tryPromise boundary) → scheduler.scheduleTask(fiberA_continuation) → running=false → starve() called → Promise.resolve().then(drain) ↑ ALS context captured = Request A's context T1: Request B arrives → POST handler → webHandler(requestB) → Promise executor runs synchronously → httpRuntime.context set to B's context → fiber B forked, runs first ops synchronously → fiber B yields → scheduler.scheduleTask(fiberB_continuation) → running=true → task queued, no new starve() T2: Microtask fires → starveInternal() runs → Drains fiberA_continuation → auth() reads ALS → gets A's context ✓ → Drains fiberB_continuation → auth() reads ALS → gets A's context ✗ ← WRONG USER ``` ##### Minimal reproduction ```typescript import { AsyncLocalStorage } from "node:async_hooks" import { Effect, Layer } from "effect" import { RpcServer, RpcSerialization, Rpc, RpcGroup } from "@effect/rpc" import { HttpServer } from "@effect/platform" import * as S from "effect/Schema" // Simulate a framework's ALS (like Next.js / Clerk) const requestStore = new AsyncLocalStorage<{ userId: string }>() class GetUser extends Rpc.make("GetUser", { success: S.Struct({ userId: S.String, alsUserId: S.String }), failure: S.Never, payload: {} }) {} const MyRpc = RpcGroup.make("MyRpc").add(GetUser) const MyRpcLive = MyRpc.toLayer( RpcGroup.toHandlers(MyRpc, { GetUser: () => Effect.gen(function*() { // Simulate calling an ALS-dependent API inside an Effect fiber const alsResult = yield* Effect.tryPromise({ try: async () => { const store = requestStore.getStore() return store?.userId ?? "NONE" }, catch: () => { throw new Error("impossible") } }) return { userId: "from-effect-context", alsUserId: alsResult } }) }) ) const RpcLayer = MyRpcLive.pipe( Layer.provideMerge(RpcSerialization.layerJson), Layer.provideMerge(HttpServer.layerContext) ) const { handler } = RpcServer.toWebHandler(MyRpc, { layer: RpcLayer }) // Simulate two concurrent requests with different ALS contexts async function main() { const results = await Promise.all([ requestStore.run({ userId: "user-A" }, () => handler(makeRpcRequest("GetUser"))), requestStore.run({ userId: "user-B" }, () => handler(makeRpcRequest("GetUser"))), ]) // Parse responses and check if alsUserId matches the expected user // Under the bug: both responses may show "user-A" (or one shows the other's) for (const res of results) { console.log(await res.json()) } } ``` ##### Impact | Symptom | Severity | |---------|----------| | `auth()` returns wrong user's session | **Critical** — authentication bypass | | `cookies()` / `headers()` from Next.js read wrong request | **High** — data leakage | | OpenTelemetry trace context crosses requests | **Medium** — incorrect traces | | Works locally, fails in production | Hard to diagnose — only manifests under concurrent load | ##### Workaround Capture ALS-dependent values **before** entering the Effect runtime and pass them via Effect's own context system: ```typescript // In the route handler — OUTSIDE the Effect fiber (ALS is correct here) export const POST = async (request: Request) => { const { userId } = await auth() // ← Safe: still in Next.js ALS context // Inject into request headers or use the `context` parameter const headers = new Headers(request.headers) headers.set("x-clerk-auth-user-id", userId ?? "") const enrichedRequest = new Request(request.url, { method: request.method, headers, body: request.body, duplex: "half" as any, }) return webHandler(enrichedRequest) } // In Effect handlers — read from HttpServerRequest headers instead of calling auth() const getAuthenticatedUserId = Effect.gen(function*() { const req = yield* HttpServerRequest.HttpServerRequest const userId = req.headers["x-clerk-auth-user-id"] if (!userId) return yield* Effect.fail(new UnauthorizedError({ message: "Auth required" })) return userId }) ``` ##### Suggested fix (for Effect maintainers) ##### Option A: Propagate ALS context through the scheduler Capture the `AsyncLocalStorage` snapshot when a fiber continuation is scheduled, and restore it when the continuation executes: ```typescript // In MixedScheduler or the fiber runtime import { AsyncLocalStorage } from "node:async_hooks" scheduleTask(task: Task, priority: number) { // Capture current ALS context const snapshot = AsyncLocalStorage.snapshot() this.tasks.scheduleTask(() => snapshot(task), priority) // ... } ``` `AsyncLocalStorage.snapshot()` (Node.js 20.5+) returns a function that, when called, restores the ALS context from the point of capture. This ensures each fiber continuation runs with its originating request's ALS context. **Trade-off:** Adds one closure allocation per scheduled task. Could be opt-in via a `FiberRef` or scheduler option. ##### Option B: Capture ALS at `runFork` and restore per fiber step When `Runtime.runFork` is called, capture the ALS snapshot and associate it with the fiber. Before each fiber step (in the fiber runtime's `evaluateEffect` loop), restore the snapshot. **Trade-off:** More invasive but provides correct ALS propagation for the fiber's entire lifetime, including across `flatMap` chains and `Effect.tryPromise` thunks. ##### Option C: Document the limitation and provide a `context` injection API If ALS propagation is intentionally not supported, document this prominently and provide a first-class API for `toWebHandler` to accept per-request context. The existing `context?: Context.Context` parameter on the handler function partially addresses this, but it requires callers to know about the issue and manually extract values before entering Effect. ##### Related - Node.js `AsyncLocalStorage` docs: https://nodejs.org/api/async_context.html - `AsyncLocalStorage.snapshot()`: https://nodejs.org/api/async_context.html#static-method-asynclocalstoragesnapshot - Next.js uses ALS for `cookies()`, `headers()`, `auth()` in App Router - Similar issue pattern in other fiber-based runtimes (e.g., ZIO has `FiberRef` propagation for this) ##### POC replica of my setup ``` // Create web handler from Effect RPC // sharedMemoMap ensures all RPC routes share the same connection pool const { handler: webHandler, dispose } = RpcServer.toWebHandler(DemoRpc, { layer: RpcLayer, memoMap: sharedMemoMap, }); /** * POST /api/rpc/demo */ export const POST = async (request: Request) => { return webHandler(request); }; registerDispose(dispose); ``` ##### Used util functions ``` /** * Creates a dispose registry that collects dispose callbacks and runs them * when `runAll` is invoked. Handles both sync and async dispose functions, * catching errors to prevent one failing dispose from breaking others. * * @internal Exported for testing — use `registerDispose` in application code. */ export const makeDisposeRegistry = () => { const disposeFns: Array<() => void | Promise> = [] const runAll = () => { for (const fn of disposeFns) { try { const result = fn() if (result && typeof result.then === "function") { result.then(undefined, (err: unknown) => console.error("Dispose error:", err)) } } catch (err) { console.error("Dispose error:", err) } } } const register = (dispose: () => void | Promise) => { disposeFns.push(dispose) } return { register, runAll } } export const registerDispose: (dispose: () => void | Promise) => void = globalValue( Symbol.for("@global/RegisterDispose"), () => { const registry = makeDisposeRegistry() if (typeof process !== "undefined") { process.once("beforeExit", registry.runAll) } return registry.register } ) ``` ##### The actual effect that was run within the RPC context that the bug was found ``` export const getAuthenticatedUserId: Effect.Effect = Effect.gen(function*() { const authResult = yield* Effect.tryPromise({ try: async () => auth(), catch: () => new UnauthorizedError({ message: "Failed to get auth session" }) }) if (!authResult.userId) { return yield* Effect.fail( new UnauthorizedError({ message: "Authentication required" }) ) } return authResult.userId }) ``` #### Severity - CVSS Score: 7.4 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` #### References - [https://github.com/Effect-TS/effect/security/advisories/GHSA-38f7-945m-qr2g](https://redirect.github.com/Effect-TS/effect/security/advisories/GHSA-38f7-945m-qr2g) - [https://nvd.nist.gov/vuln/detail/CVE-2026-32887](https://nvd.nist.gov/vuln/detail/CVE-2026-32887) - [https://github.com/advisories/GHSA-38f7-945m-qr2g](https://redirect.github.com/advisories/GHSA-38f7-945m-qr2g) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-38f7-945m-qr2g) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).

--- ### Release Notes

Effect-TS/effect (effect)

### [`v3.20.0`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3200) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.19...effect@3.20.0) ##### Minor Changes - [#6124](https://redirect.github.com/Effect-TS/effect/pull/6124) [`8798a84`](https://redirect.github.com/Effect-TS/effect/commit/8798a843218e6c0c0d3a8eee83360880e370b4da) Thanks [@mikearnaldi](https://redirect.github.com/mikearnaldi)! - Fix scheduler task draining to isolate `AsyncLocalStorage` across fibers. ##### Patch Changes - [#6107](https://redirect.github.com/Effect-TS/effect/pull/6107) [`fc82e81`](https://redirect.github.com/Effect-TS/effect/commit/fc82e81448bd9136a37580139ce46a2c61b11b54) Thanks [@gcanti](https://redirect.github.com/gcanti)! - Backport `Types.VoidIfEmpty` to 3.x - [#6088](https://redirect.github.com/Effect-TS/effect/pull/6088) [`82996bc`](https://redirect.github.com/Effect-TS/effect/commit/82996bce8debffcb44feb98bb862cf2662bd56b7) Thanks [@taylorOntologize](https://redirect.github.com/taylorOntologize)! - Schema: fix `Schema.omit` producing wrong result on Struct with `optionalWith({ default })` and index signatures `getIndexSignatures` now handles `Transformation` AST nodes by delegating to `ast.to`, matching the existing behavior of `getPropertyKeys` and `getPropertyKeyIndexedAccess`. Previously, `Schema.omit` on a struct combining `Schema.optionalWith` (with `{ default }`, `{ as: "Option" }`, etc.) and `Schema.Record` would silently take the wrong code path, returning a Transformation with property signatures instead of a TypeLiteral with index signatures. - [#6086](https://redirect.github.com/Effect-TS/effect/pull/6086) [`4d97a61`](https://redirect.github.com/Effect-TS/effect/commit/4d97a61a15b9dd6a0eece65b8f0c035e16d42ada) Thanks [@taylorOntologize](https://redirect.github.com/taylorOntologize)! - Schema: fix `getPropertySignatures` crash on Struct with `optionalWith({ default })` and other Transformation-producing variants `SchemaAST.getPropertyKeyIndexedAccess` now handles `Transformation` AST nodes by delegating to `ast.to`, matching the existing behavior of `getPropertyKeys`. Previously, calling `getPropertySignatures` on a `Schema.Struct` containing `Schema.optionalWith` with `{ default }`, `{ as: "Option" }`, `{ nullable: true }`, or similar options would throw `"Unsupported schema (Transformation)"`. - [#6097](https://redirect.github.com/Effect-TS/effect/pull/6097) [`f6b0960`](https://redirect.github.com/Effect-TS/effect/commit/f6b0960bf3184109920dfed16ee7dfd7d67bc0f2) Thanks [@gcanti](https://redirect.github.com/gcanti)! - Fix TupleWithRest post-rest validation to check each tail index sequentially. ### [`v3.19.19`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31919) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.18...effect@3.19.19) ##### Patch Changes - [#6079](https://redirect.github.com/Effect-TS/effect/pull/6079) [`4eb5c00`](https://redirect.github.com/Effect-TS/effect/commit/4eb5c008dfc7d2a97b191ca608948d994a2cce4c) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - add short circuit to fiber.await internals - [#6079](https://redirect.github.com/Effect-TS/effect/pull/6079) [`4eb5c00`](https://redirect.github.com/Effect-TS/effect/commit/4eb5c008dfc7d2a97b191ca608948d994a2cce4c) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - build ManagedRuntime synchronously if possible - [#6081](https://redirect.github.com/Effect-TS/effect/pull/6081) [`2d2bb13`](https://redirect.github.com/Effect-TS/effect/commit/2d2bb1364a906bd44800c6387b9575fddccdaf53) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - fix semaphore race condition where permits could be leaked ### [`v3.19.18`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31918) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.17...effect@3.19.18) ##### Patch Changes - [#6062](https://redirect.github.com/Effect-TS/effect/pull/6062) [`12b1f1e`](https://redirect.github.com/Effect-TS/effect/commit/12b1f1eadf649e30dec581b7351ba3abb12f8004) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - prevent Stream.changes from writing empty chunks ### [`v3.19.17`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31917) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.16...effect@3.19.17) ##### Patch Changes - [#6040](https://redirect.github.com/Effect-TS/effect/pull/6040) [`a8c436f`](https://redirect.github.com/Effect-TS/effect/commit/a8c436f7004cc2a8ce2daec589ea7256b91c324f) Thanks [@jacobconley](https://redirect.github.com/jacobconley)! - Fix `Stream.decodeText` to correctly handle multi-byte UTF-8 characters split across chunk boundaries. ### [`v3.19.16`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31916) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.15...effect@3.19.16) ##### Patch Changes - [#6018](https://redirect.github.com/Effect-TS/effect/pull/6018) [`e71889f`](https://redirect.github.com/Effect-TS/effect/commit/e71889f35b081d13b7da2c04d2f81d6933056b49) Thanks [@codewithkenzo](https://redirect.github.com/codewithkenzo)! - fix(Match): handle null/undefined in `Match.tag` and `Match.tagStartsWith` Added null checks to `discriminator` and `discriminatorStartsWith` predicates to prevent crashes when matching nullable union types. Fixes [#6017](https://redirect.github.com/Effect-TS/effect/issues/6017) ### [`v3.19.15`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31915) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.14...effect@3.19.15) ##### Patch Changes - [#5981](https://redirect.github.com/Effect-TS/effect/pull/5981) [`7e925ea`](https://redirect.github.com/Effect-TS/effect/commit/7e925eae4a9db556bcbf7e8b6a762ccf8588aa3b) Thanks [@bxff](https://redirect.github.com/bxff)! - Fix type inference loss in `Array.flatten` for complex nested structures like unions of Effects with contravariant requirements. Uses distributive indexed access (`T[number][number]`) in the `Flatten` type utility and adds `const` to the `flatten` generic parameter. - [#5970](https://redirect.github.com/Effect-TS/effect/pull/5970) [`d7e75d6`](https://redirect.github.com/Effect-TS/effect/commit/d7e75d6d15294bbcd7ac49a0e9005848379ea86f) Thanks [@KhraksMamtsov](https://redirect.github.com/KhraksMamtsov)! - fix Config.orElseIf signature - [#5996](https://redirect.github.com/Effect-TS/effect/pull/5996) [`4860d1e`](https://redirect.github.com/Effect-TS/effect/commit/4860d1e09b436061ea4aeca07605a669793560fc) Thanks [@parischap](https://redirect.github.com/parischap)! - fix Equal.equals plain object comparisons in structural mode ### [`v3.19.14`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31914) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.13...effect@3.19.14) ##### Patch Changes - [#5924](https://redirect.github.com/Effect-TS/effect/pull/5924) [`488d6e8`](https://redirect.github.com/Effect-TS/effect/commit/488d6e870eda3dfc137f4940bb69416f61ed8fe3) Thanks [@mikearnaldi](https://redirect.github.com/mikearnaldi)! - Fix `Effect.retry` to respect `times: 0` option by using explicit undefined check instead of truthy check. ### [`v3.19.13`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31913) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.12...effect@3.19.13) ##### Patch Changes - [#5911](https://redirect.github.com/Effect-TS/effect/pull/5911) [`77eeb86`](https://redirect.github.com/Effect-TS/effect/commit/77eeb86ddf208e51ec25932af83d52d3b4700371) Thanks [@mattiamanzati](https://redirect.github.com/mattiamanzati)! - Add test for ensuring typeConstructor is attached - [#5910](https://redirect.github.com/Effect-TS/effect/pull/5910) [`287c32c`](https://redirect.github.com/Effect-TS/effect/commit/287c32c9f10da8e96f2b9ef8424316189d9ad4b3) Thanks [@mattiamanzati](https://redirect.github.com/mattiamanzati)! - Add typeConstructor annotation for Schema ### [`v3.19.12`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31912) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.11...effect@3.19.12) ##### Patch Changes - [#5897](https://redirect.github.com/Effect-TS/effect/pull/5897) [`a6dfca9`](https://redirect.github.com/Effect-TS/effect/commit/a6dfca93b676eeffe4db64945b01e2004b395cb8) Thanks [@fubhy](https://redirect.github.com/fubhy)! - Ensure `performance.now` is only used if it's available ### [`v3.19.11`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31911) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.10...effect@3.19.11) ##### Patch Changes - [#5888](https://redirect.github.com/Effect-TS/effect/pull/5888) [`38abd67`](https://redirect.github.com/Effect-TS/effect/commit/38abd67998f676893866a72cb41bbd5edd07b169) Thanks [@gcanti](https://redirect.github.com/gcanti)! - filter non-JSON values from schema examples and defaults, closes [#5884](https://redirect.github.com/Effect-TS/effect/issues/5884) Introduce JsonValue type and update JsonSchemaAnnotations to use it for type safety. Add validation to filter invalid values (BigInt, cyclic refs) from examples and defaults, preventing infinite recursion on cycles. - [#5885](https://redirect.github.com/Effect-TS/effect/pull/5885) [`44e0b04`](https://redirect.github.com/Effect-TS/effect/commit/44e0b044480c5d8ab17fbdaf1c528f06796fa681) Thanks [@gcanti](https://redirect.github.com/gcanti)! - feat(JSONSchema): add missing options for target JSON Schema version in make function, closes [#5883](https://redirect.github.com/Effect-TS/effect/issues/5883) ### [`v3.19.10`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#31910) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.9...effect@3.19.10) ##### Patch Changes - [#5874](https://redirect.github.com/Effect-TS/effect/pull/5874) [`bd08028`](https://redirect.github.com/Effect-TS/effect/commit/bd080284febb620e7e71f661bf9d850c402bb87f) Thanks [@mattiamanzati](https://redirect.github.com/mattiamanzati)! - Fix NoSuchElementException instantiation in fastPath and add corresponding test case - [#5878](https://redirect.github.com/Effect-TS/effect/pull/5878) [`6c5c2ba`](https://redirect.github.com/Effect-TS/effect/commit/6c5c2ba50ce49386e8d1e657230492ee900a6ec7) Thanks [@Hoishin](https://redirect.github.com/Hoishin)! - prevent crash from Hash and Equal with invalid Date object ### [`v3.19.9`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3199) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.8...effect@3.19.9) ##### Patch Changes - [#5875](https://redirect.github.com/Effect-TS/effect/pull/5875) [`3f9bbfe`](https://redirect.github.com/Effect-TS/effect/commit/3f9bbfe9ef78303ecc6817b68ec9671f4d42d249) Thanks [@gcanti](https://redirect.github.com/gcanti)! - Fix the arbitrary generator for BigDecimal to allow negative scales. ### [`v3.19.8`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3198) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.7...effect@3.19.8) ##### Patch Changes - [#5815](https://redirect.github.com/Effect-TS/effect/pull/5815) [`f03b8e5`](https://redirect.github.com/Effect-TS/effect/commit/f03b8e55f12019cc855a1306e9cbfc7611a9e281) Thanks [@lokhmakov](https://redirect.github.com/lokhmakov)! - Prevent multiple iterations over the same Iterable in Array.intersectionWith and Array.differenceWith ### [`v3.19.7`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3197) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.6...effect@3.19.7) ##### Patch Changes - [#5813](https://redirect.github.com/Effect-TS/effect/pull/5813) [`7ef13d3`](https://redirect.github.com/Effect-TS/effect/commit/7ef13d30147dd50eae1cdbb67a1978141751cad5) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - fix SqlPersistedQueue batch size ### [`v3.19.6`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3196) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.5...effect@3.19.6) ##### Patch Changes - [#5778](https://redirect.github.com/Effect-TS/effect/pull/5778) [`af7916a`](https://redirect.github.com/Effect-TS/effect/commit/af7916a3f00acdfc8ce451eabd3f5fb02914d0bb) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - add RcRef.invalidate api ### [`v3.19.5`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3195) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.4...effect@3.19.5) ##### Patch Changes - [#5772](https://redirect.github.com/Effect-TS/effect/pull/5772) [`079975c`](https://redirect.github.com/Effect-TS/effect/commit/079975c69d80c62461da5c51fe89e02c44dfa2ea) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - backport Effect.gen optimization ### [`v3.19.4`](https://redirect.github.com/Effect-TS/effect/blob/HEAD/packages/effect/CHANGELOG.md#3194) [Compare Source](https://redirect.github.com/Effect-TS/effect/compare/effect@3.19.3...effect@3.19.4) ##### Patch Changes - [#5752](https://redirect.github.com/Effect-TS/effect/pull/5752) [`f445b87`](https://redirect.github.com/Effect-TS/effect/commit/f445b87bab342188a5c223cfc76c697d65594d1d) Thanks [@janglad](https://redirect.github.com/janglad)! - Fix Types.DeepMutable mapping over functions - [#5757](https://redirect.github.com/Effect-TS/effect/pull/5757) [`d2b68ac`](https://redirect.github.com/Effect-TS/effect/commit/d2b68ac9e1ac1d58d7387715843c448195f14675) Thanks [@tim-smart](https://redirect.github.com/tim-smart)! - add experimental PartitionedSemaphore module A `PartitionedSemaphore` is a concurrency primitive that can be used to control concurrent access to a resource across multiple partitions identified by keys. The total number of permits is shared across all partitions, with waiting permits equally distributed among partitions using a round-robin strategy. This is useful when you want to limit the total number of concurrent accesses to a resource, while still allowing for fair distribution of access across different partitions. ```ts import { Effect, PartitionedSemaphore } from "effect" Effect.gen(function* () { const semaphore = yield* PartitionedSemaphore.make({ permits: 5 }) // Take the first 5 permits with key "A", then the following permits will be // equally distributed between all the keys using a round-robin strategy yield* Effect.log("A").pipe( Effect.delay(1000), semaphore.withPermits("A", 1), Effect.replicateEffect(15, { concurrency: "unbounded" }), Effect.fork ) yield* Effect.log("B").pipe( Effect.delay(1000), semaphore.withPermits("B", 1), Effect.replicateEffect(10, { concurrency: "unbounded" }), Effect.fork ) yield* Effect.log("C").pipe( Effect.delay(1000), semaphore.withPermits("C", 1), Effect.replicateEffect(10, { concurrency: "unbounded" }), Effect.fork ) return yield* Effect.never }).pipe(Effect.runFork) ```

--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/ForgeRock/ping-javascript-sdk).