[cowboyd]

Motivation

CodSpeed benchmark dependency installation fails silently with npm auditing enabled. The pinned Effect versions also carry known vulnerabilities: Effect v3 has an AsyncLocalStorage context isolation advisory, and the Effect v4 beta depends on a vulnerable TOML parser.

Approach

Update the pinned comparison libraries from Effect 3.14.0 to 3.22.4 and from Effect 4.0.0-beta.64 to 4.1.1. Both fixes are available upstream; no dependency overrides are needed. Keep npm auditing enabled and remove the redundant second install.

These updates change the Effect comparison baselines, while preserving their benchmark names.

Validation:

• Fresh temporary dependency installation succeeds with auditing enabled and reports zero vulnerabilities.
• Explicit npm audit --json reports zero vulnerabilities.
• All four Effect scenarios pass at the configured benchmark depths (recursion 100, events 10).
• Formatted both changed files with Deno and ran git diff --check. No TypeScript files changed.

The temporary validation uses an existing local Effection npm build; the GitHub workflow rebuilds the package from the checkout.

[codspeed]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing fix/codspeed-no-audit (7f45da3) with v4 (b1e1f5f)}

[github-actions]

🚀 Deploy Preview Ready!

• Stable Review Link: https://pr-1262--effection.netlify.app
• Latest Commit Snapshot: https://6ae7a7bdd43ffcf3a1996620--effection.netlify.app

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/effection@1262

commit: 7f45da3