-
Notifications
You must be signed in to change notification settings - Fork 10
Update dependency effect to v3.19.8 #138
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
+900
−1,091
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [@trpc/server](https://trpc.io) ([source](https://redirect.github.com/trpc/trpc/tree/HEAD/packages/server)) | [`11.1.2` -> `11.2.0`](https://renovatebot.com/diffs/npm/@trpc%2fserver/11.1.2/11.2.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/mmkal/trpc-cli). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMzMuNiIsInRhcmdldEJyYW5jaCI6ImRlcHMiLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [zod](https://zod.dev) ([source](https://redirect.github.com/colinhacks/zod)) | [`3.25.28` -> `3.25.49`](https://renovatebot.com/diffs/npm/zod/3.25.28/3.25.49) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/mmkal/trpc-cli). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMzMuNiIsInRhcmdldEJyYW5jaCI6ImRlcHMiLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
83e4f19 to
d64031c
Compare
d64031c to
ecc3195
Compare
ecc3195 to
40ff701
Compare
40ff701 to
2e922d7
Compare
053ef73 to
41ffb9b
Compare
41ffb9b to
806f069
Compare
806f069 to
26c2c05
Compare
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [valibot](https://valibot.dev) ([source](https://redirect.github.com/open-circle/valibot)) | [`1.1.0` -> `1.2.0`](https://renovatebot.com/diffs/npm/valibot/1.1.0/1.2.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2025-66020](https://redirect.github.com/open-circle/valibot/security/advisories/GHSA-vqpr-j7v3-hqw9) ### Summary The `EMOJI_REGEX` used in the `emoji` action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application. ### Details The ReDoS vulnerability stems from "catastrophic backtracking" in the `EMOJI_REGEX`. This is caused by ambiguity in the regex pattern due to overlapping character classes. Specifically, the class `\p{Emoji_Presentation}` overlaps with more specific classes used in the same alternation, such as `[\u{1F1E6}-\u{1F1FF}]` (regional indicator symbols used for flags) and `\p{Emoji_Modifier_Base}`. When the regex engine attempts to match a string that almost matches but ultimately fails (like the one in the PoC), this ambiguity forces it to explore an exponential number of possible paths. The matching time increases exponentially with the length of the crafted input, rather than linearly. ### PoC The following code demonstrates the vulnerability. ```javascript import * as v from 'valibot'; const schema = v.object({ x: v.pipe(v.string(), v.emoji()), }); const attackString = '\u{1F1E6}'.repeat(49) + '0'; console.log(`Input length: ${attackString.length}`); console.log('Starting parse... (This will take a long time)'); // On my machine, a length of 99 takes approximately 2 minutes. console.time(); try { v.parse(schema, {x: attackString }); } catch (e) {} console.timeEnd(); ``` ### Impact Any project using Valibot's `emoji` validation on user-controllable input is vulnerable to a Denial of Service attack. An attacker can block server resources (e.g., a web server's event loop) by submitting a short string to any endpoint that uses this validation. This is particularly dangerous because the attack string is short enough to bypass typical input length restrictions (e.g., maxLength(100)). ### Recommended Fix The root cause is the overlapping character classes. This can be resolved by making the alternatives mutually exclusive, typically by using negative lookaheads (`(?!...)`) to subtract the specific classes from the more general one. The following modified `EMOJI_REGEX` applies this principle: ```javascript export const EMOJI_REGEX: RegExp = // eslint-disable-next-line redos-detector/no-unsafe-regex, regexp/no-dupe-disjunctions -- false positives /^(?:[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|(?![\p{Emoji_Modifier_Base}\u{1F1E6}-\u{1F1FF}])\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|(?![\p{Emoji_Modifier_Base}\u{1F1E6}-\u{1F1FF}])\p{Emoji_Presentation}))*)+$/u; ``` --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/mmkal/trpc-cli). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4xOS45IiwidXBkYXRlZEluVmVyIjoiNDIuMTkuOSIsInRhcmdldEJyYW5jaCI6ImRlcHMiLCJsYWJlbHMiOltdfQ==--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Misha Kaletsky <[email protected]>
26c2c05 to
2c2d3fb
Compare
4ab64e8 to
a9cbb9e
Compare
Contributor
Author
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.16.12->3.19.8Release Notes
Effect-TS/effect (effect)
v3.19.8Compare Source
Patch Changes
f03b8e5Thanks @lokhmakov! - Prevent multiple iterations over the same Iterable in Array.intersectionWith and Array.differenceWithv3.19.7Compare Source
Patch Changes
7ef13d3Thanks @tim-smart! - fix SqlPersistedQueue batch sizev3.19.6Compare Source
Patch Changes
af7916aThanks @tim-smart! - add RcRef.invalidate apiv3.19.5Compare Source
Patch Changes
079975cThanks @tim-smart! - backport Effect.gen optimizationv3.19.4Compare Source
Patch Changes
#5752
f445b87Thanks @janglad! - Fix Types.DeepMutable mapping over functions#5757
d2b68acThanks @tim-smart! - add experimental PartitionedSemaphore moduleA
PartitionedSemaphoreis a concurrency primitive that can be used tocontrol concurrent access to a resource across multiple partitions identified
by keys.
The total number of permits is shared across all partitions, with waiting
permits equally distributed among partitions using a round-robin strategy.
This is useful when you want to limit the total number of concurrent accesses
to a resource, while still allowing for fair distribution of access across
different partitions.
v3.19.3Compare Source
Patch Changes
7d28a90Thanks @gcanti! - Use standard formatting function in Config error messages, closes #5709v3.19.2Compare Source
Patch Changes
#5703
374f58cThanks @tim-smart! - preserve Layer.mergeAll context order#5703
374f58cThanks @tim-smart! - ensure FiberHandle.run state transition is atomicv3.19.1Compare Source
Patch Changes
63f2bf3Thanks @tim-smart! - allow parallel finalization of merged layersv3.19.0Compare Source
Minor Changes
#5606
3863fa8Thanks @mikearnaldi! - Add Effect.fn.Return to allow typing returns on Effect.fn#5606
2a03c76Thanks @fubhy! - BackportGraphmodule updates#5606
24a1685Thanks @tim-smart! - add experimental HashRing modulePatch Changes
3c15d5fThanks @KhraksMamtsov! -Array.windowsignature has been improvedv3.18.5Compare Source
Patch Changes
#5669
a537469Thanks @fubhy! - Fix Graph.neighbors() returning self-loops in undirected graphs.Graph.neighbors() now correctly returns the other endpoint for undirected graphs instead of always returning edge.target, which caused nodes to appear as their own neighbors when queried from the target side of an edge.
#5628
52d5963Thanks @mikearnaldi! - Make sure AsEffect is computed#5671
463345dThanks @gcanti! - JSON Schema generation: addjsonSchema2020-12target and fix tuple output for:v3.18.4Compare Source
Patch Changes
#5617
6ae2f5dThanks @gcanti! - JSONSchema: Fix issue where invaliddefaults were included in the output.Now they are ignored, similar to invalid
examples.Before
After
v3.18.3Compare Source
Patch Changes
#5612
25fab81Thanks @gcanti! - Fix JSON Schema generation withtopLevelReferenceStrategy: "skip", closes #5611This patch fixes a bug that occurred when generating JSON Schemas with nested schemas that had identifiers, while using
topLevelReferenceStrategy: "skip".Previously, the generator would still output
$refentries even though references were supposed to be skipped, leaving unresolved definitions.Before
After
Now schemas are correctly inlined, and no leftover
$refentries or unused definitions remain.v3.18.2Compare Source
Patch Changes
8ba4757Thanks @cyberixae! - Fix Array Do documentationv3.18.1Compare Source
Patch Changes
07802f7Thanks @indietyp! - Enableconsole.groupuse inLogger.prettyFormatwhen using Bunv3.18.0Compare Source
Minor Changes
#5302
1c6ab74Thanks @schickling! - Add experimental Graph module with comprehensive graph data structure supportThis experimental module provides:
Example usage:
#5302
70fe803Thanks @mikearnaldi! - Automatically set otel parent when present as external span#5302
c296e32Thanks @tim-smart! - add Effect.Semaphore.resize#5302
a098ddfThanks @mikearnaldi! - Introduce ReadonlyTag as the covariant side of a tag, enables:v3.17.14Compare Source
Patch Changes
ea95998Thanks @IMax153! - Preserve the precision of histogram boundary valuesv3.17.13Compare Source
Patch Changes
51bfc78Thanks @tim-smart! - ensure tracerLogger does not drop message itemsv3.17.12Compare Source
Patch Changes
b359bdcThanks @tim-smart! - add preload options to LayerMapv3.17.11Compare Source
Patch Changes
#5449
fb5e414Thanks @tim-smart! - Simplify Effect.raceAll implementation, ensure children fibers are awaited#5451
018363bThanks @mikearnaldi! - Fix Predicate.isIterable to allow stringsv3.17.10Compare Source
Patch Changes
#5368
3b26094Thanks @gcanti! - ## Annotation BehaviorWhen you call
.annotationson a schema, any identifier annotations that were previously set will now be removed. Identifiers are now always tied to the schema'sastreference (this was the intended behavior).Example
v3.17.9Compare Source
Patch Changes
0271f14Thanks @gcanti! - backportformatUnknownfrom v4v3.17.8Compare Source
Patch Changes
84bc300Thanks @thewilkybarkid! - Fix Schema.Defect when seeing a null-prototype objectv3.17.7Compare Source
Patch Changes
a949539Thanks @tim-smart! - expose RcMap.has apiv3.17.6Compare Source
Patch Changes
f187941Thanks @beezee! - Use non-greedy matching for Schema.String in Schema.TemplateLiteralParserv3.17.5Compare Source
Patch Changes
5f98388Thanks @patroza! - improve provide/merge apis to support readonly array inputs.v3.17.4Compare Source
Patch Changes
7d7c55dThanks @leonitousconforti! - Align RcMap.keys return type with internal signaturev3.17.3Compare Source
Patch Changes
#5275
3504555Thanks @taylornz! - fix DateTime.makeZoned handling of DST transitions#5282
f6c7ca7Thanks @beezee! - Improve inference on Metric.trackSuccessWith for use in Effect.pipe(...)#5275
3504555Thanks @taylornz! - add DateTime.Disambiguation for handling DST edge casesAdded four disambiguation strategies to
DateTime.Zonedconstructors for handling DST edge cases:'compatible'- Maintains backward compatibility'earlier'- Choose earlier time during ambiguous periods (default)'later'- Choose later time during ambiguous periods'reject'- Throw error for ambiguous timesv3.17.2Compare Source
Patch Changes
6309e0aThanks @tim-smart! - Fix Layer.mock dual detectionv3.17.1Compare Source
Patch Changes
ea95998Thanks @IMax153! - Preserve the precision of histogram boundary valuesv3.17.0Compare Source
Minor Changes
#4949
40c3c87Thanks @fubhy! - AddedRandom.fixedto create a version of theRandomservice with fixedvalues for testing.
#4949
ed2c74aThanks @dmaretskyi! - AddStruct.entriesfunction#4949
073a1b8Thanks @f15u! - AddLayer.mockCreates a mock layer for testing purposes. You can provide a partial
implementation of the service, and any methods not provided will
throw an
UnimplementedErrordefect when called.#4949
f382e99Thanks @KhraksMamtsov! - Schedule output has been added intoCurrentIterationMetadata#4949
e8c7ba5Thanks @mikearnaldi! - Remove global state index by version, make version mismatch a warning message#4949
7e10415Thanks @devinjameson! - Array: add findFirstWithIndex function#4949
e9bdeceThanks @vinassefranche! - Add HashMap.countBy#4949
8d95eb0Thanks @tim-smart! - add Effect.ensure{Success,Error,Requirements}Type, for constraining Effect typesv3.16.17Compare Source
Patch Changes
#5246
aaa6ad0Thanks @mikearnaldi! - Copy over apply, bind, call into service proxy#5158
5b74ea5Thanks @cyberixae! - Clarify Tuple length requirementsv3.16.16Compare Source
Patch Changes
127e602Thanks @tim-smart! - prevent fiber leak when Stream.toAsyncIterable returns earlyv3.16.15Compare Source
Patch Changes
15df9bfThanks @gcanti! - Schema.attachPropertySignature: simplify signature and fix parameter type to use Schema instead of SchemaClassv3.16.14Compare Source
Patch Changes
#5213
f5dfabfThanks @gcanti! - Fix incorrect schema ID annotation inSchema.lessThanOrEqualToDate, closes #5212#5192
17a5ea8Thanks @nikelborm! - Updated deprecated OTel Resource attributes names and values.Many of the attributes have undergone the process of deprecation not once, but twice. Most of the constants holding attribute names have been renamed. These are minor changes.
Additionally, there were numerous changes to the attribute keys themselves. These changes can be considered major.
In the
@opentelemetry/semantic-conventionspackage, new attributes having ongoing discussion about them are going through a process called incubation, until a consensus about their necessity and form is reached. Otel team recommends devs to copy them directly into their code. Luckily, it's not necessary because all of the new attribute names and values came out of this process (some of them were changed again) and are now considered stable.v3.16.13Compare Source
Patch Changes
#5097
c1c05a8Thanks @tim-smart! - remove completion helper overload from Effect.catchTag, to fix Effect.fn inference#5157
81fe4a2Thanks @cyberixae! - Clarify Array rotate exampleConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.