fix(deps): update npm

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@uiw/react-json-view (source)	2.0.0-alpha.43 → 2.0.0-alpha.44
effect (source)	4.0.4 → 4.0.5
js-yaml	5.4.2 → 5.4.3
jsonpath-plus	11.1.0 → 11.2.1
react (source)	19.3.0 → 19.3.1
react-dom (source)	19.3.0 → 19.3.1

---

Release Notes

uiwjs/react-json-view (@​uiw/react-json-view)

v2.0.0-alpha.44

Compare Source

Documentation v2.0.0-alpha.44: https://raw.githack.com/uiwjs/react-json-view/33d3582/index.html
Or Doc Website: https://htmlpreview.github.io/?https://github.com/uiwjs/react-json-view/33d3582/index.html
Comparing Changes: uiwjs/react-json-view@v2.0.0-alpha.43...v2.0.0-alpha.44

npm i @uiw/[email protected]

• 🐞 fix: export public section element types (#​94) edc293a @​Tabisharaza
• 💢 ci: update .github/workflows/ci.yml. 2222953 @​jaywcjlove

Effect-TS/effect (effect)

v4.0.5

Compare Source

Patch Changes

• #​9055 f665607 Thanks @​Tyagiquamar! - Pass a NonEmptyArray to the onNonEmpty callback of Array.match when the input is a mutable array.

• #​9110 dbf442b Thanks @​petar-omni! - Fix AsyncResult.all failures carrying a single input's previousSuccess instead of the combined record or tuple.

• #​9105 74d1930 Thanks @​tim-smart! - Fix infinite atom rebuilds caused by late reads of uninitialized dependencies.

• #​9145 a03afb6 Thanks @​jayhemnani9910! - Add Flag.withOptionalValue for GNU-style flags with an optional value, like --color[=WHEN]. A bare flag uses the given value; an explicit value must be attached with =.

• #​9131 f159284 Thanks @​tim-smart! - Fix lost deferred callback wakes in cluster workflows when an activity suspends while a parallel activity is still running.

• #​9094 5d301cc Thanks @​okxint! - Name cluster entity RPC server spans by entity type only (e.g. WorkflowEntity.Run) so span names stay low-cardinality. The entity ID is still recorded in the entity.id span attribute.

• #​9176 cd74ea2 Thanks @​effect-bot! - Recover persisted local cluster replies from storage to prevent requests hanging when replies arrive before handler registration. Retain local reply notifications as storage-reader wakeups for low-latency streaming.

  Defer terminal in-memory reply publication until the successful outer transaction completes, preserving the commit boundary for reply readers.

• #​9095 925cf64 Thanks @​jayhemnani9910! - Fix ConfigProvider.fromDotEnv and fromDotEnvContents rescanning expanded values when expandVariables is enabled. Self and circular references no longer overflow the stack, escaped \$NAME stays literal, and defaults apply when a reference expands to an empty value.

• #​9109 54c51d9 Thanks @​devangpratap! - Fix Duration conversions throwing for very large millisecond values, and make those durations equal to their nanosecond equivalents.

• #​9161 995c104 Thanks @​devangpratap! - Fix Duration conversions losing nanosecond precision for large integer millisecond values.

• #​9112 816575e Thanks @​effect-bot! - Use bigint for 64-bit FileSystem.File.Info metadata. dev is now a bigint, and ino, rdev, nlink, and blocks are Option<bigint>, so file stats no longer fail or drop values outside the safe integer range. Node and Bun read dev, ino, rdev, and nlink as unsigned 64-bit integers. Deno reports these fields as numbers, so values above Number.MAX_SAFE_INTEGER are rounded by Deno before conversion.

• #​9150 0df6e06 Thanks @​tim-smart! - Support per-request URLs in GraphQLProtocol.layerHttp and makeHttp, as a function of the context and operation or as an Effect<string>. GraphQLResolver batches lookups by URL.

• #​9137 52a7d3c Thanks @​tim-smart! - Add HttpClientRequest.compressBody for gzip and deflate request body compression.

• #​9160 ec831c3 Thanks @​fubhy! - Accept Redacted values as URL parameters in UrlParams and HttpClientRequest.

• #​9138 3abc63e Thanks @​tim-smart! - Add HttpMiddleware.decompression, which decompresses gzip and deflate request bodies, limits the decompressed size, and rejects other codings with 415.

• #​9113 a841b8b Thanks @​effect-bot! - Fix interruption calling Math.random and hashing defects, which made deterministic hosts that forbid randomness loop forever or overflow the stack.

• #​9098 91efea7 Thanks @​armancharan! - Narrow only the matched prefix when a Match tuple pattern is applied to an array or variadic tuple, so the remaining elements keep their original type.

• #​9151 e271997 Thanks @​tim-smart! - Fix McpServer types to require schema services for resource templates and encoding services for prompt parameters with completion handlers. Missing services are now caught at compile time.

• #​9117 7719bda Thanks @​jayhemnani9910! - Pad 64-bit trace ids to 128 bits in OTLP exports and traceparent headers.

• #​9139 563397f Thanks @​tim-smart! - Add opt-in gzip compression to built-in OTLP JSON and protobuf exporters via the compression option or OTEL_EXPORTER_OTLP_COMPRESSION and per-signal environment variables. Compress batches once before retries using HttpClientRequest.compressBody, retaining its default 1KB threshold and uncompressed defaults.

• #​9127 65b04f8 Thanks @​effect-bot! - Add Path.resolveWithin(root, input), which resolves a relative path beneath a root and returns Option.none() for traversal escapes and rooted inputs, using the platform's path rules.

• #​9143 c2859bf Thanks @​danieljvdm! - Collect tool approvals once per LanguageModel request instead of twice.

• #​9134 c462214 Thanks @​effect-bot! - Reduce SQLite statement overhead by borrowing the shared connection while preserving semaphore exclusion and failed-COMMIT recovery.

• #​9169 d1ad2c7 Thanks @​danieljvdm! - Cache the last response decoder for each language model response kind, keyed by validation mode and ordered tool schema identities.

• #​9136 12be65e Thanks @​tim-smart! - Redact sensitive query values in HTTP spans, request inspection and error messages. Also redact URL credentials in client spans, request inspection and errors. Request URLs sent over the wire are unchanged.

  Move AWSAccessKeyId, Signature, sig and X-Goog-Signature from Headers.CurrentRedactedNames to the new UrlParams.CurrentRedactedNames. A custom list replaces these defaults. Add UrlParams.isRedactedName, UrlParams.redact and UrlParams.redactUrl for explicit redaction.

• #​9088 352618a Thanks @​armancharan! - Match.when, Match.whenOr, Match.whenAnd, and Match.not now reject object patterns with keys the input type does not have.

• #​9166 2a8ec8b Thanks @​danieljvdm! - Keep Schema decoding synchronous when a decoding default is an already-successful effect, such as Effect.succeed(...).

• #​9135 8dec89d Thanks @​tim-smart! - Preserve completion-handler service requirements in McpServer.registerResource and McpServer.resource URI templates when handlers take a context argument.

• #​9118 f05642f Thanks @​jayhemnani9910! - Fix handler-local request.url for parameterized and percent-encoded HttpRouter prefixes, respecting duplicate-slash configuration.

• #​9187 3ad9a0c Thanks @​effect-bot! - Fix RPC socket clients closing healthy connections before sending a ping when a ping tick runs late. Slow requests now stay connected while the server responds to pings.

• #​9103 dba4e52 Thanks @​gcanti! - Reject duplicate discriminants at compile time in Schema.toTaggedUnion, including duplicates in nested unions and numeric/string property-key collisions such as 1 and "1".

• #​9096 7ca8224 Thanks @​jayhemnani9910! - Fix Sse.encoder dropping event data after a lone \r. CR and CRLF line endings in event data now start a new data: line, like LF.

• #​9133 65d20dd Thanks @​tim-smart! - Add filesystem watcher installation notifications and wait for all GraphQL watch subscriptions, including nested directories, before generating. This prevents edits during startup from being missed.

• #​9106 e3ff963 Thanks @​armancharan! - Fix Stream.timeout and Stream.timeoutOrElse hanging when an async iterator's pending next() never settles.

• #​9183 bc454a3 Thanks @​Marve10s! - Fix String.snakeToCamel and String.snakeToPascal throwing on a trailing underscore or an even-length run of underscores, such as "foo_" or "__". A trailing underscore is now dropped and an even-length run of underscores returns ""; inputs that converted before give the same result.

  String.noCase no longer calls a custom transform for input without words, such as "" or "---".

• #​9124 793d89e Thanks @​jem-computer! - Support structured decision instructions, descriptions, and score legends in TypeSafe, Cloudflare, and OpenRouter. Decision.rate accepts labeled descriptions; Rate.criteria entries are now { label, description } objects instead of strings.

• #​9173 ec9332b Thanks @​effect-bot! - Remove interrupted sleeps from TestClock and insert new sleeps in order instead of re-sorting the queue.

• #​9172 f2b3d8a Thanks @​effect-bot! - Fix TestClock.adjust and TestClock.setTime skipping sleeps that a woken fiber registers after more than one scheduler hop, such as after Effect.yieldNow or forking and joining a child.

• #​8166 cb2cf5f Thanks @​KhraksMamtsov! - Effect.Transaction now stores attempt metadata, analogous to Schedule.CurrentMetadata. Yield it inside a transaction body to read attempt, retryReason, and the same timing fields as a schedule (start, now, elapsed, elapsedSincePrevious).

• #​9092 b8c201d Thanks @​effect-bot! - Add a detached option for discarded child workflows. Detached children neither wake their parent on completion nor get interrupted with it.

• #​9091 118c9c4 Thanks @​effect-bot! - Keep workflows suspended by Workflow.SuspendOnFailure from retrying failed activities until explicitly resumed. Interrupting a failure-suspended workflow now completes it as interrupted without re-running the failed activity.

nodeca/js-yaml (js-yaml)

v5.4.3

Compare Source

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented
  line, #​802.

s3u/JSONPath (jsonpath-plus)

v11.2.1

Compare Source

• fix(safe eval): support the ?? and ** operators

v11.2.0

Compare Source

• feat: allow arg to other type callbacks
• feat: add @​symbol, @​Promise, @​jsonReference other types
• feat: add separate optional imports for structuredCloning and extra javascript types

v11.1.1

Compare Source

• fix: avoid treating at sign within regex as current context; fixes #​280

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for angry-raman-7c44f6 canceled.

Name	Link
🔨 Latest commit	606c91a
🔍 Latest deploy log	https://app.netlify.com/projects/angry-raman-7c44f6/deploys/6ad0d4eb1674c78bfe87f8bb