Cascade v0.8.0 — Effect 4 and Node 24

Cascade v0.8.0 upgrades Cascade to Effect 4.1.4 and Node.js 24+.

Upgrade requirements

• Running from source and developing Cascade now require Node.js 24 or newer and TypeScript 5.9+. Bun is used for the frozen dependency installation and standalone build.
• Library consumers and custom registry modules must migrate to Effect 4. Effect 3 values are incompatible with this runtime. Keep effect and @effect/platform-node aligned at 4.1.4; the separate @effect/platform dependency has been removed.
• Pipeline YAML configuration and component delivery contracts are unchanged. See the Effect 4 migration guide for API changes and custom-component guidance.
• The downloadable executable is standalone: it requires neither Node.js nor Bun, and includes the QuickJS WASM payload for JavaScript processors.

Changes since v0.7.1

• Migrate Schema, Result, Cause, Stream, Queue, context, fibers, logging and HTTP APIs to Effect 4 (#174).
• Preserve queue draining, acknowledgements, backpressure, shutdown and HTTP cancellation behavior across the migration.
• Wait for Redis Pub/Sub connection readiness before subscribing, with regression coverage.
• Align CI, development dependencies and the HTTP E2E container with Node.js 24.
• Authorize the exact dependency transition in RT-2 policy (#173), preserving the test collection and enforcement modes.

Distribution

Linux x86-64 with glibc compatibility. The cascade asset is the raw executable used by install.sh. Other operating systems and architectures are not included. SHA256SUMS, LICENSE and build-info.json accompany it.

The migration passed 986 unit tests, 22 YAML cases, 20 real Redis/SQS E2E scenarios and 130 grading-tool tests. The release metadata and executable are validated separately before publication. Checksums and build provenance identify the final merged source revision.

Full changelog.

Release verification

The final merged source was built with Bun 1.4.4 for bun-linux-x64-baseline. The exact executable passed version/help, configuration validation, all 22 YAML cases and JavaScript/WASM execution in a Debian container with no network, Node.js or Bun.

Source commit: 65cf6c759766035ad84893e86c63c5ce7ea99712.

Release metadata: #175; independent Argon approval; passing PR CI.

Binary SHA-256: 17c24130078da15d751822664cb04a57d4b24fab5f3ee65c0335580e27a14fe8. SHA256SUMS also covers the license and build provenance.

Cascade v0.7.1

Cascade v0.7.1 ships a standalone Linux x86-64 executable, including the QuickJS WASM payload required by JavaScript processors.

Changes since v0.7.0:

• Fix JavaScript processors in the compiled executable by embedding the official QuickJS release-sync WASM variant. No external WASM file, Node.js, Bun installation or runtime download is required.
• Replay Redis Streams pending messages owned by the configured consumer before reading new messages (#167).
• Bound fatal-output DLQ archival by the shutdown budget (#168).
• Release Redis clients when graceful QUIT fails (#169).
• Include the intervening pipeline cleanup, SQS shutdown, HTTP body serialization and Redis-list delivery corrections already merged into main.

Distribution: Linux x86-64 with glibc compatibility. The asset cascade is the raw standalone executable expected by install.sh. SHA256SUMS, LICENSE and build provenance accompany it. Other operating systems and architectures are not included in this release.

Validation: frozen dependency installation, type checks, TypeScript compilation, unused-code checks, RT-2 integrity and 985 unit tests pass. Executable tests cover version/help, configuration validation, stdin/stdout, JavaScript/WASM and YAML fixtures. The executable also runs in a clean Debian container with no Node/Bun or network.

Checksums and provenance are generated from the final merged source revision before upload. Public download and the actual installer are verified after publication.

Source commit: b686fb81a7211ebefc3b43702991dc8e69a611de.

Source correction: #172. Independent Argon review and all blocking CI checks passed on the delivered content.

Binary SHA-256: 5a6c3c4876ffb42d8e86ac775790ef5d03b0ea65fedd59254b27ecf180eebdf9.

Full changelog.

v0.7.0

⚠️ Breaking changes

• createHttpInput returns an Effect. Its signature changed from Input<HttpInputError> to
  Effect<Input<HttpInputError>, HttpInputError> (#122). It is re-exported from the package root, so
  programmatic callers must run the Effect. The factory no longer hands back a ready input, because
  it does not resolve until the server has actually bound — that is the point of the fix.

  - const input = createHttpInput({ port: 8080 })
  + const input = yield* createHttpInput({ port: 8080 })

• HTTP input bodies are bounded by default. max_body_bytes now defaults to 1048576 (1 MiB);
  it was previously unbounded (#117). Deployments accepting larger webhook bodies must set it
  explicitly, or those requests receive 413 Payload Too Large and the connection closes.

  input:
    http:
      port: 8080
      max_body_bytes: 10485760  # raise if you accept bodies above 1 MiB

Security

• CVE-2026-52746 / GHSA-86vw-mfpg-wwv9 — jsonata 2.1.0 → 2.2.2 (#121). Versions below 2.2.0
  backtrack superlinearly in $toMillis ISO-8601 validation, and Cascade evaluates configured
  JSONata expressions against externally sourced message content. A crafted 48 KiB timestamp took
  741 ms on 2.1.0 and is sub-millisecond on 2.2.2. Reachable from mapping, filter, switch, HTTP, and
  testing expression paths.
• Unbounded request buffering — HTTP input appended every chunk to memory with only a time
  limit, so one remote client could make allocation proportional to an arbitrary body (#117). Both
  declared Content-Length and streamed/chunked bodies are now rejected before the limit is
  exceeded.

Correctness and delivery

• File input no longer reports success after a failed read (#119). A one-shot open/stat/read
  failure was logged but converted into normal completion, so a pipeline could not tell an unread
  source from an empty file. Accepted records now drain in order, then the stream fails with
  FileInputError.
• HTTP input bind failures are typed (#122). An occupied or forbidden port emitted an unhandled
  event that crashed the process after falsely logging readiness. It now fails through
  HttpInputError / BuildError with host, port, and reason, releases the server on failure and
  interruption, and logs readiness only after a confirmed bind.
• Branch processor preserves value types (#120). Content was copied via JSON.parse(JSON.stringify(...)),
  which turned undefined, bigint, and circular graphs into unrecoverable defects and silently
  coerced Date to a string. It now uses structuredClone, and genuinely uncloneable values fail as
  a typed BranchProcessorError that DLQ handling can route.

Also in this release

Pipeline output-permit deadlocks (#107), diagnostic retention bounds (#108), file-input restat before
chunk reads (#109), assert construction failure containment (#110), bounded file-input disk reads
(#102), pipeline-wide max_concurrent_outputs enforcement (#100), typed stdin stream failures (#98),
documented SQS message attributes (#96), atomic dedupe admission (#90), and the Dox AGENTS tree
(#111).

Verification

lint, build, and knip clean · 926 unit tests · 19 test:e2e · 14/14 e2e:all ·
dist/cascade --version → cascade v0.7.0

Full Changelog: v0.6.1...v0.7.0

v0.6.1

What's Changed

• fix(sqs): resume polling after retries by @marcelsud in #84

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's Changed

• Add file and stdin inputs by @marcelsud in #1
• Wire pipeline backpressure configuration by @marcelsud in #2
• Validate pipeline component selection by @marcelsud in #3
• Wire DLQ pipeline configuration by @marcelsud in #4
• Add pluggable component registry by @marcelsud in #5
• Make SQS input delivery at least once by @marcelsud in #6
• Add graceful pipeline shutdown by @marcelsud in #7
• Bound queue-backed inputs by @marcelsud in #8
• Configure DLQ retry schedules by @marcelsud in #9
• Add CLI registry loading and config validation by @marcelsud in #10
• Surface component metrics in pipeline results by @marcelsud in #11
• Surface DLQ destination metrics by @marcelsud in #13
• Harden Redis reconnects and HTTP input errors by @marcelsud in #12
• Add infrastructure-backed e2e harness by @marcelsud in #14
• Verify SQS at-least-once delivery end to end by @marcelsud in #15
• Verify DLQ delivery under failure end to end by @marcelsud in #16
• Verify Redis overflow and reconnect behavior by @marcelsud in #18
• Make file rotation reads identity-safe by @marcelsud in #19
• Land approved graceful-drain and Redis resilience changes by @marcelsud in #22
• fix(sqs): gate batch acknowledgements on delivery by @marcelsud in #24
• feat: add alpha stdout output by @marcelsud in #25
• feat(outputs): add alpha file output with CSV-ready internals by @marcelsud in #27
• feat(processors): add composable JSONata filter by @marcelsud in #28
• chore: adopt grading methodology 1.0.1 by @marcelsud in #36
• fix: make YAML test runner complete its suite by @marcelsud in #37
• fix(redis): defer stream acknowledgements by @marcelsud in #38
• docs: add multi-model issue delivery workflow by @marcelsud in #40
• fix(processors): isolate JSONata bindings by @marcelsud in #49
• fix(redis): retain newest capped list entries by @marcelsud in #50
• Fix E2E release gate reliability by @marcelsud in #51
• fix(core): enforce error category semantics by @marcelsud in #52
• fix(config): wire reliability settings by @marcelsud in #53
• fix(test): fail closed on invalid test runs by @marcelsud in #54
• fix(redis): reject malformed streams URLs by @marcelsud in #55
• fix(http): route processor failures to DLQ by @marcelsud in #56
• test(http): lock documented template context by @marcelsud in #57
• fix(http): retry server error responses by @marcelsud in #58
• fix(http): enforce input body timeout by @marcelsud in #59
• fix(config): fail on missing environment variables by @marcelsud in #60
• fix(sqs): preserve zero polling wait by @marcelsud in #61
• chore(quality): add Knip gate by @marcelsud in #63

Full Changelog: v0.5.1...v0.6.0

v0.5.1

Bug Fix

• fix: Use NodeHttpClient.layer instead of layerUndici to fix compiled binary crash

The standalone binary crashed with ReferenceError: exports_Undici is not defined when the HTTP output attempted to send requests. Switched to Node.js built-in HTTP client, which bundles correctly with Bun's compiler.

Assets

• cascade — standalone Linux binary (no runtime dependencies)

Cascade v0.5.0

Cascade v0.5.0

First release under the Cascade brand — a declarative streaming library for building type-safe data pipelines with YAML configuration.

Highlights

• Rebrand: Project renamed from effect-connect to Cascade with updated CLI, repo, and documentation
• Standalone binary: Single compiled binary (cascade) — no Node.js runtime required
• Dedupe processor: New processor for deduplicating messages in the pipeline
• Branch & Switch processors: Control flow primitives for conditional routing and pattern-matching within pipelines

Installation

Download the cascade binary from this release and make it executable:

chmod +x cascade
./cascade run pipeline.yaml

Usage

# Run a pipeline
./cascade run config.yaml

# Run with debug logging
./cascade run config.yaml --debug

# Show version
./cascade --version