chore(deps): adopt effect 4.0.0-beta.93 by WomB0ComB0 · Pull Request #141 · resq-software/npm

WomB0ComB0 · 2026-07-07T03:44:16Z

Summary

Fully adopts effect 4.0.0-beta.93 across the workspace, superseding #130.

effect was deliberately pinned to beta.50 via the root overrides block (from #42, "fix test runner"), while dependabot had drifted the declarations to beta.78. #130 proposed bumping declarations to beta.93 but left the override at beta.50 — so its green CI was actually testing beta.50, not beta.93.

This PR moves the whole workspace forward and removes the drift:

Root overrides.effect: 4.0.0-beta.50 → 4.0.0-beta.93 (this is what actually forces the resolved version).
Pinned dev declarations aligned to beta.93: http, security, rate-limiting, dsa, and the react-dashboard example.
Peer ranges (effect: ">=3.0.0") left broad — consumers are unaffected.
@effect/platform-bun left to its own bump (chore(deps-dev): bump @effect/platform-bun from 4.0.0-beta.78 to 4.0.0-beta.93 #131).

Validation

bun run build — all packages build clean against beta.93 (dts included)
bun --filter @resq-sw/http --filter @resq-sw/security --filter @resq-sw/rate-limiting --filter @resq-sw/dsa test — all pass
CI green across the matrix

Closes #130.

Summary by CodeRabbit

Chores
- Updated the app and core packages to use a newer compatible runtime version.
- Added a patch release note for several packages to reflect the version update.
- Aligned the React dashboard example with the same dependency version for consistency.

coderabbitai · 2026-07-07T03:44:43Z

Warning

Review limit reached

@WomB0ComB0, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fc546100-c29d-4ff4-92a1-8c6bf100831f

📥 Commits

Reviewing files that changed from the base of the PR and between aa79436 and 525a2d4.

⛔ Files ignored due to path filters (1)

bun.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

.changeset/adopt-effect-beta93.md
examples/react-dashboard/package.json
package.json
packages/dsa/package.json
packages/dsa/tests/complexity/complexity.test.ts
packages/http/package.json
packages/rate-limiting/package.json
packages/security/package.json

📝 Walkthrough

Walkthrough

This PR bumps the effect dependency from beta.50 (root override) or beta.78 (package peer/dev dependencies) to 4.0.0-beta.93 across the root package.json, four workspace packages (dsa, http, rate-limiting, security), and an example app, plus adds a changeset for release tracking.

Changes

Effect version bump

Layer / File(s)	Summary
Root override and changeset `package.json`, `.changeset/adopt-effect-beta93.md`	Root `overrides.effect` bumped from `4.0.0-beta.50` to `4.0.0-beta.93`; changeset added marking `@resq-sw/http`, `@resq-sw/security`, `@resq-sw/rate-limiting`, `@resq-sw/dsa` for a patch release.
Workspace package dependency bumps `packages/dsa/package.json`, `packages/http/package.json`, `packages/rate-limiting/package.json`, `packages/security/package.json`	`effect` peer/dev dependency versions bumped from `4.0.0-beta.78` to `4.0.0-beta.93`.
Example app dependency update `examples/react-dashboard/package.json`	`effect` dependency bumped from `4.0.0-beta.78` to `4.0.0-beta.93`.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

resq-software/npm#42: Updates the same effect version pins across the same package.json files (dsa, http, security, rate-limiting, root).

Suggested labels: A-Effect

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: adopting effect 4.0.0-beta.93.
Linked Issues check	✅ Passed	The PR updates effect from 4.0.0-beta.50 to 4.0.0-beta.93 across the workspace as requested by issue `#130`.
Out of Scope Changes check	✅ Passed	The changes stay within the dependency bump scope, and the changeset/example updates support that adoption.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/adopt-effect-beta93

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-07T03:44:51Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	effect@4.0.0-beta.50 ⏵ 4.0.0-beta.93			⁺¹	⁺¹

View full report

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.changeset/adopt-effect-beta93.md:
- Around line 1-24: The .changeset file is not in the required format because
the license block appears before the frontmatter. Move the YAML frontmatter for
`@resq-sw/http`, `@resq-sw/security`, `@resq-sw/rate-limiting`, and `@resq-sw/dsa` to
the very top of the file, and place the license/comment block after it so the
changeset parser recognizes it. Use the existing changeset content as-is, just
reorder the top section to match the standard .changeset markdown structure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: aeffd970-996e-4bdd-9a07-c83edb9f9b58

📥 Commits

Reviewing files that changed from the base of the PR and between 3bf2f46 and aa79436.

⛔ Files ignored due to path filters (1)

bun.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

.changeset/adopt-effect-beta93.md
examples/react-dashboard/package.json
package.json
packages/dsa/package.json
packages/http/package.json
packages/rate-limiting/package.json
packages/security/package.json

gemini-code-assist · 2026-07-07T03:49:21Z

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

github-actions · 2026-07-07T03:50:01Z

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Audit Results: PASS

I have reviewed the changes in PR #141 and confirmed that the update to is implemented consistently across the workspace.

Audit Summary:

Dependency Alignment: Root and package-level for are correctly synchronized to .
Lockfile Integrity: has been appropriately updated to include the new versions and their transitive dependencies.
Intentional Drift: The decision to keep @effect/platform-bun at beta.78 is noted and currently satisfies the peer dependency requirements.
Validation: Changes are limited to version bumps and a changeset, with no regressions identified in the logic of the affected packages (http, security, rate-limiting, dsa).

No security vulnerabilities, logic bugs, or performance issues were found. The audit has passed.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #141 · ◷

github-actions · 2026-07-07T03:50:02Z

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Audit Results: PASS

I have reviewed the changes in PR #141 and confirmed that the update to effect@4.0.0-beta.93 is implemented consistently across the workspace.

Audit Summary:

Dependency Alignment: Root overrides and package-level devDependencies for effect are correctly synchronized to beta.93.
Lockfile Integrity: bun.lock has been appropriately updated to include the new versions and their transitive dependencies.
Intentional Drift: The decision to keep @effect/platform-bun at beta.78 is noted and currently satisfies the peer dependency requirements.
Validation: Changes are limited to version bumps and a changeset, with no regressions identified in the logic of the affected packages (http, security, rate-limiting, dsa).

No security vulnerabilities, logic bugs, or performance issues were found. The audit has passed.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #141 · ◷

Bump the root `effect` override from beta.50 to beta.93 and align the pinned dev declarations (http, security, rate-limiting, dsa, react-dashboard example) to match. effect was deliberately held at beta.50 (root override, from #42); this moves the whole workspace forward and removes the declaration/override drift. Validated: full `bun run build` (all packages) and the effect-using test suites (http, security, rate-limiting, dsa) pass against beta.93. @effect/platform-bun is left to its own bump (#131). Supersedes #130.

The Graph.findShortestPath (Dijkstra) empirical complexity test intermittently measures O(log n) on small chain graphs (constant factors dominate the loglinear curve), failing CI across unrelated PRs. Apply the same de-flake conventions the sibling assertions already use: tolerate O(log n) and add { retry: 2 }.

github-actions Bot added size/M C-Documentation Improvements or additions to documentation pkg:dsa @resq-sw/dsa pkg:http @resq-sw/http pkg:security @resq-sw/security pkg:rate-limiting @resq-sw/rate-limiting C-Chore Maintenance, deps, tooling A-Examples Example apps and demos labels Jul 7, 2026

WomB0ComB0 mentioned this pull request Jul 7, 2026

chore(deps): bump effect from 4.0.0-beta.50 to 4.0.0-beta.93 #130

Closed

coderabbitai Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread .changeset/adopt-effect-beta93.md

WomB0ComB0 added 2 commits July 6, 2026 23:59

WomB0ComB0 force-pushed the chore/adopt-effect-beta93 branch from aa79436 to 525a2d4 Compare July 7, 2026 04:01

github-actions Bot added size/L size/M C-Testing Test coverage or test infrastructure and removed size/M labels Jul 7, 2026

WomB0ComB0 merged commit 2a3c926 into master Jul 7, 2026
56 checks passed

github-actions Bot mentioned this pull request Jul 7, 2026

[Release] Version Packages #143

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): adopt effect 4.0.0-beta.93#141

chore(deps): adopt effect 4.0.0-beta.93#141
WomB0ComB0 merged 2 commits into
masterfrom
chore/adopt-effect-beta93

WomB0ComB0 commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

WomB0ComB0 commented Jul 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026

Audit Results: PASS

Uh oh!

github-actions Bot commented Jul 7, 2026

Audit Results: PASS

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

WomB0ComB0 commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

socket-security Bot commented Jul 7, 2026 •

edited

Loading