Skip to content

fix: bump workflow from 4.8.9 to 5.2.3 - #2345

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/workflow-5.0.0
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/workflow-5.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

Bumps workflow from 4.8.9 to 5.2.3.

Release notes

Sourced from workflow's releases.

workflow@5.2.3

@​workflow/core@​5.2.3

  • #4335 91297ab @​pranaygp - Security: remove the nanoid dependency (pinned at 5.1.6, affected by GHSA-28wg-ghj8-5hjv). Default hook tokens now come from a built-in copy of the same generator, so tokens and seeded random values stay identical for runs recorded on earlier versions. Upgrading nanoid itself would have changed them, because nanoid@5.1.16 draws a different number of random bytes per id.
  • #4758 0bc17d7 @​pranaygp - Resolve a run's encryption key from metadata only, so Run#getReadable() and resuming a hook stored without a resume context no longer make the server resolve the run's whole input and output first.
  • #4916 42077f2 @​VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
  • #4870 59b76f8 @​TooTallNate - Stamp the default snapshot threshold into QuickJS runs at start() so they qualify for the event limit exemption, warn when a run approaches the event limit, and recommend WORKFLOW_VM=quickjs in MAX_EVENTS_EXCEEDED and REPLAY_TIMEOUT errors
  • #4866 73a7efa @​VaguelySerious - Read event logs where a step's creation is recorded on its step_started alone, with no separate step_created.
  • #4874 2163290 @​TooTallNate - Preserve workflowVm and snapshotThreshold from executionContext in hydrateResourceIO for observability UIs
  • #4895 0d434fc @​karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.
  • #4819 cd2f917 @​VaguelySerious - Ignore events a step or hook writes after its outcome during replay instead of failing the run

@​workflow/cli@​5.0.6

  • #4758 0bc17d7 @​pranaygp - Resolve a run's encryption key from metadata only when decrypting in workflow inspect --decrypt and the web UI, instead of making the server resolve the run's whole input and output for each lookup.

@​workflow/world@​5.0.5

  • #4916 42077f2 @​VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
  • #4870 59b76f8 @​TooTallNate - Exempt QuickJS runs with a positive snapshot threshold from the default per-run event limit, matching the Vercel World
  • #4895 0d434fc @​karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.

@​workflow/world-local@​5.1.2

  • #4922 5170f8f @​NishitaSikka - Restore missing run_created events for interrupted local run creation.
  • #4870 59b76f8 @​TooTallNate - Exempt QuickJS runs with a positive snapshot threshold from the default per-run event limit, matching the Vercel World
  • #4924 a067ef7 @​AndrewBarba - Fix an edge case in createHook({ experimental_force: true }) where a racing resumeHook could be dropped during the handover

@​workflow/world-postgres@​5.0.5

  • #4883 93396c5 @​VaguelySerious - Write run_started, run_completed, run_failed, run_cancelled, attr_set, step_retrying, wait_created and wait_completed in one transaction with the entity change they record. A process that died between the two used to leave an entity in a state its event log did not explain; a completed wait with no wait_completed made the run retry the wait forever. A wait left in that state by an earlier version now gets its missing event on the next attempt.
  • #4882 ecaa047 @​dretanacr - Write a step's step_completed or step_failed row update and its event in one transaction, as step_started already does. A process that died between the two used to leave a terminal step with no terminal event, so the replayed step_started was refused as terminal and the run never advanced.
  • #4812 32f213e @​pranaygp - Keep a checked-out client in the World's own pg pool from ending the process when the database drops its connection.
  • #4757 7882c81 @​pranaygp - Store timestamps as timestamp with time zone so createdAt is correct when the Postgres server or session is not in UTC. Migration 0027 converts the columns and repairs created_at values written by earlier versions.

@​workflow/world-vercel@​5.2.3

  • #4916 42077f2 @​VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
  • #4895 0d434fc @​karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.

@​workflow/web@​5.0.6

  • #4758 0bc17d7 @​pranaygp - Resolve a run's encryption key from metadata only when decrypting in workflow inspect --decrypt and the web UI, instead of making the server resolve the run's whole input and output for each lookup.
  • #4874 2163290 @​TooTallNate - Recommend the QuickJS VM with snapshotting on runs that failed with MAX_EVENTS_EXCEEDED or REPLAY_TIMEOUT

@​workflow/web-shared@​5.0.6

  • #4866 73a7efa @​VaguelySerious - Read event logs where a step's creation is recorded on its step_started alone, with no separate step_created.
  • #4874 2163290 @​TooTallNate - Add getRunLimitGuidance() for runs that failed with MAX_EVENTS_EXCEEDED or REPLAY_TIMEOUT, and show the run's workflow VM in the sidebar
  • #4819 cd2f917 @​VaguelySerious - Ignore events a step or hook writes after its outcome during replay instead of failing the run

... (truncated)

Changelog

Sourced from workflow's changelog.

5.2.3

Patch Changes

5.2.2

Patch Changes

5.2.1

Patch Changes

  • #4733 e6bd692 Thanks @​VaguelySerious! - Add InBandSupersededError and optional inBand/expectedSeqInBand event-create params for the in-band writer fence. @workflow/world-vercel forwards them, does not retry a fenced write in-process, and records the fence on its event spans. The runtime does not use them yet.
  • Updated dependencies [1342a96, 854242e, e6bd692, fcb554b, 73a6ca3, fcb554b]:
    • @​workflow/cli@​5.0.4
    • @​workflow/core@​5.2.1
    • @​workflow/errors@​5.0.4
    • @​workflow/utils@​5.0.2
    • @​workflow/next@​5.0.4
    • @​workflow/nitro@​5.0.4
    • @​workflow/typescript-plugin@​5.0.0
    • @​workflow/nest@​5.1.2
    • @​workflow/astro@​5.0.4
    • @​workflow/rollup@​5.0.4
    • @​workflow/sveltekit@​5.0.4

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 3, 2026
@dependabot
dependabot Bot requested a review from groupthinking as a code owner October 3, 2026 20:56
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 3, 2026
@vercel

vercel Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
v0-uvai Ready Ready Preview, v0 Oct 28, 2026 7:46am UTC

@github-actions

github-actions Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

🔍 PR Validation

⚠️ Large PR detected (10874 lines changed)

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

✅ E2E Test Results: ALL TESTS PASSED

Metric Value
Status 🟢 GREEN
Total Tests
Passed 16
Failed
Deployment https://v0-uvai-nqmg9faw0-garv1.vercel.app
Test Output
s on every request without persisting it�[32m 1�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mhomepage returns 200 with HTML�[32m 125�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page contains template/workflow markup�[32m 101�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page surfaces at least 5 workflow/template indicators�[32m 110�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mPOST /api/video/pack accepts a YouTube URL without hanging�[33m 2586�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mGET /api/video/pack resolves to a ready pack with evidence lineage�[33m 578�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang�[32m 70�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22minvalid URL returns 400 quickly, not a hang�[32m 67�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mPOST /api/video/pack with no body returns 400�[32m 51�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard returns 200�[32m 119�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard contains agent or pipeline visualization markup�[32m 85�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mGET /api returns a response (not 404)�[32m 250�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mretired /api/pipeline routes are gone (no pipeline served)�[32m 35�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22mhomepage has proper meta tags�[32m 75�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22m/features page returns 200�[32m 108�[2mms�[22m�[39m

�[2m Test Files �[22m �[1m�[32m1 passed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[32m16 passed�[39m�[22m�[90m (16)�[39m
�[2m   Start at �[22m 20:58:48
�[2m   Duration �[22m 5.83s�[2m (transform 52ms, setup 0ms, import 66ms, tests 5.64s, environment 0ms)�[22m


@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/workflow ^5.0.0 UnknownUnknown
pip/websockets 17.2 UnknownUnknown
npm/content-disposition 1.1.0 🟢 7.2
Details
CheckScoreReason
Code-Review🟢 6Found 20/30 approved changesets -- score normalized to 6
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dependency-Update-Tool🟢 10update tool detected
Vulnerabilities🟢 82 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool detected but not run on all commits
Security-Policy🟢 9security policy file detected
CI-Tests🟢 925 out of 26 merged PRs checked by a CI test -- score normalized to 9
Contributors🟢 10project has 21 contributing companies or organizations
npm/es-object-atoms 1.1.2 UnknownUnknown
npm/iconv-lite 0.7.3 UnknownUnknown
npm/path-to-regexp 8.4.2 🟢 7.1
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
CI-Tests🟢 925 out of 26 merged PRs checked by a CI test -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 5found 12 unreviewed changesets out of 29 -- score normalized to 5
Contributors🟢 1025 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 44 commit(s) out of 30 and 1 issue activity out of 30 found in the last 90 days -- score normalized to 4
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
SAST🟢 9SAST tool detected but not run on all commits
Security-Policy🟢 9security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities🟢 10no vulnerabilities detected

Scanned Files

  • apps/web/package.json
  • docs/knowledge_prototypes/mcp-servers/mcp-alexnet/requirements.txt
  • package-lock.json

@groupthinking groupthinking left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review at head 7b72d53f: the major workflow update has a failing test-frontend check. Please diagnose the failing test(s), update the package/lock combination or code as needed, and rerun frontend tests on the exact head before approval.

Bumps [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow) from 4.8.9 to 5.2.3.
- [Release notes](https://github.com/vercel/workflow/releases)
- [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md)
- [Commits](https://github.com/vercel/workflow/commits/workflow@5.2.3/packages/workflow)

---
updated-dependencies:
- dependency-name: workflow
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title fix: bump workflow from 4.8.9 to 5.0.0 fix: bump workflow from 4.8.9 to 5.2.3 Oct 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/workflow-5.0.0 branch from 7b72d53 to 577906b Compare October 28, 2026 07:44
@github-actions

Copy link
Copy Markdown
Contributor

✅ E2E Test Results: ALL TESTS PASSED

Metric Value
Status 🟢 GREEN
Total Tests
Passed 16
Failed
Deployment https://v0-uvai-f0sjktjrl-garv1.vercel.app
Test Output
very request without persisting it�[32m 1�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mhomepage returns 200 with HTML�[33m 324�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page contains template/workflow markup�[33m 333�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mTemplate Gallery�[2m > �[22mfeatures page surfaces at least 5 workflow/template indicators�[32m 238�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mPOST /api/video/pack accepts a YouTube URL without hanging�[33m 2565�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mVideo Pack Pipeline�[2m > �[22mGET /api/video/pack resolves to a ready pack with evidence lineage�[33m 857�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang�[32m 210�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22minvalid URL returns 400 quickly, not a hang�[32m 191�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mPOST /api/video/pack with no body returns 400�[32m 174�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard returns 200�[32m 272�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mDashboard�[2m > �[22m/dashboard contains agent or pipeline visualization markup�[33m 316�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mGET /api returns a response (not 404)�[33m 384�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mretired /api/pipeline routes are gone (no pipeline served)�[32m 100�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22mhomepage has proper meta tags�[32m 262�[2mms�[22m�[39m
 �[32m✓�[39m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mStatic Assets�[2m > �[22m/features page returns 200�[32m 243�[2mms�[22m�[39m

�[2m Test Files �[22m �[1m�[32m1 passed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[32m16 passed�[39m�[22m�[90m (16)�[39m
�[2m   Start at �[22m 07:47:06
�[2m   Duration �[22m 8.68s�[2m (transform 55ms, setup 0ms, import 69ms, tests 8.48s, environment 0ms)�[22m


@groupthinking

Copy link
Copy Markdown
Owner

Closing this older Workflow 5.2.3 update as superseded by #2401. #2401 targets the same version and includes the runtime and patch fixes that this branch lacks; its current frontend, Python, lint, and build checks pass. The upgrade remains open in #2401: a live ready pack has not been verified after the model hit its daily quota, and dependency-review evidence still fails. This closure is not approval or completion of the upgrade.

@dependabot @github

dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/workflow-5.0.0 branch October 28, 2026 16:39

This branch was successfully deployed

1 active deployment
Preview — 577906b5 Deployed Oct 28, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant