chore(deps): bump effect from 3.17.7 to 3.20.0

[dependabot]

Bumps effect from 3.17.7 to 3.20.0.

Changelog

Sourced from effect's changelog.

3.20.0

Minor Changes

• #6124 8798a84 Thanks @​mikearnaldi! - Fix scheduler task draining to isolate AsyncLocalStorage across fibers.

Patch Changes

• #6107 fc82e81 Thanks @​gcanti! - Backport Types.VoidIfEmpty to 3.x

• #6088 82996bc Thanks @​taylorOntologize! - Schema: fix Schema.omit producing wrong result on Struct with optionalWith({ default }) and index signatures

  getIndexSignatures now handles Transformation AST nodes by delegating to ast.to, matching the existing behavior of getPropertyKeys and getPropertyKeyIndexedAccess. Previously, Schema.omit on a struct combining Schema.optionalWith (with { default }, { as: "Option" }, etc.) and Schema.Record would silently take the wrong code path, returning a Transformation with property signatures instead of a TypeLiteral with index signatures.

• #6086 4d97a61 Thanks @​taylorOntologize! - Schema: fix getPropertySignatures crash on Struct with optionalWith({ default }) and other Transformation-producing variants

  SchemaAST.getPropertyKeyIndexedAccess now handles Transformation AST nodes by delegating to ast.to, matching the existing behavior of getPropertyKeys. Previously, calling getPropertySignatures on a Schema.Struct containing Schema.optionalWith with { default }, { as: "Option" }, { nullable: true }, or similar options would throw "Unsupported schema (Transformation)".

• #6097 f6b0960 Thanks @​gcanti! - Fix TupleWithRest post-rest validation to check each tail index sequentially.

3.19.19

Patch Changes

• #6079 4eb5c00 Thanks @​tim-smart! - add short circuit to fiber.await internals

• #6079 4eb5c00 Thanks @​tim-smart! - build ManagedRuntime synchronously if possible

• #6081 2d2bb13 Thanks @​tim-smart! - fix semaphore race condition where permits could be leaked

3.19.18

Patch Changes

• #6062 12b1f1e Thanks @​tim-smart! - prevent Stream.changes from writing empty chunks

3.19.17

Patch Changes

• #6040 a8c436f Thanks @​jacobconley! - Fix Stream.decodeText to correctly handle multi-byte UTF-8 characters split across chunk boundaries.

3.19.16

Patch Changes

• #6018 e71889f Thanks @​codewithkenzo! - fix(Match): handle null/undefined in Match.tag and Match.tagStartsWith

  Added null checks to discriminator and discriminatorStartsWith predicates to prevent crashes when matching nullable union types.

... (truncated)

Commits

• aa47393 Version Packages (#6089)
• 8798a84 fix(effect): isolate scheduler runners per fiber (#6124)
• fc82e81 Backport Types.VoidIfEmpty to 3.x (#6107)
• f6b0960 Backport: Fix TupleWithRest post-rest index drift validation bug (#6097)
• 82996bc fix(Schema): handle Transformation in getIndexSignatures for correct omit beh...
• 4d97a61 Schema: fix getPropertySignatures crash on Struct with optionalWith({ default...
• ab3b64c Version Packages (#6080)
• 2d2bb13 fix semaphore race condition where permits could be leaked (#6081)
• 4eb5c00 build ManagedRuntime synchronously if possible (#6079)
• 4f21075 Version Packages (#6063)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for effect since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[sparkyfen]

Status as of 2026-08-19: leaving this open on purpose.

CI fails because uploadthing pins effect at exactly 3.17.7, so this bump creates two effect copies with incompatible types (Micro, Redacted). svelte-check reports 6 errors.

What we found upstream (pingdotgg/uploadthing):

• Their main branch already bumped effect to 3.21.0 in April 2026 (chore: update effect dependencies pingdotgg/uploadthing#1274), which is past the 3.20.0 advisory fix.
• Nothing has been published to npm since August 2025. uploadthing@7.7.4, the version we use, is still their latest release.
• Active work is a draft Effect v4 migration (feat!: upgrade to Effect v4 pingdotgg/uploadthing#1288), so the next release may be a major with no timeline.

Risk assessment: low. The advisory behind this bump (AsyncLocalStorage context contamination in effect fibers under concurrent RPC load, fixed in 3.20.0) doesn't match how we use effect. It only appears in src/lib/server/storage/uploadthing.ts, and we don't use effect RPC or fibers directly.

Options if we want this closed sooner:

1. Add an npm override forcing a single effect copy at >=3.20.0 despite uploadthing's exact pin, then let typecheck and the e2e upload tests judge it.
2. Ask upstream to cut a v7 patch release with the effect bump already on their main.

Until then: leave this PR open. Dependabot rebases it as new effect versions release, and CI flips green once uploadthing ships a compatible release.