You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#433591297ab@pranaygp - Security: remove the nanoid dependency (pinned at 5.1.6, affected by GHSA-28wg-ghj8-5hjv). Default hook tokens now come from a built-in copy of the same generator, so tokens and seeded random values stay identical for runs recorded on earlier versions. Upgrading nanoid itself would have changed them, because nanoid@5.1.16 draws a different number of random bytes per id.
#47580bc17d7@pranaygp - Resolve a run's encryption key from metadata only, so Run#getReadable() and resuming a hook stored without a resume context no longer make the server resolve the run's whole input and output first.
#491642077f2@VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
#487059b76f8@TooTallNate - Stamp the default snapshot threshold into QuickJS runs at start() so they qualify for the event limit exemption, warn when a run approaches the event limit, and recommend WORKFLOW_VM=quickjs in MAX_EVENTS_EXCEEDED and REPLAY_TIMEOUT errors
#486673a7efa@VaguelySerious - Read event logs where a step's creation is recorded on its step_started alone, with no separate step_created.
#48742163290@TooTallNate - Preserve workflowVm and snapshotThreshold from executionContext in hydrateResourceIO for observability UIs
#48950d434fc@karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.
#4819cd2f917@VaguelySerious - Ignore events a step or hook writes after its outcome during replay instead of failing the run
#47580bc17d7@pranaygp - Resolve a run's encryption key from metadata only when decrypting in workflow inspect --decrypt and the web UI, instead of making the server resolve the run's whole input and output for each lookup.
#491642077f2@VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
#487059b76f8@TooTallNate - Exempt QuickJS runs with a positive snapshot threshold from the default per-run event limit, matching the Vercel World
#48950d434fc@karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.
#487059b76f8@TooTallNate - Exempt QuickJS runs with a positive snapshot threshold from the default per-run event limit, matching the Vercel World
#4924a067ef7@AndrewBarba - Fix an edge case in createHook({ experimental_force: true }) where a racing resumeHook could be dropped during the handover
#488393396c5@VaguelySerious - Write run_started, run_completed, run_failed, run_cancelled, attr_set, step_retrying, wait_created and wait_completed in one transaction with the entity change they record. A process that died between the two used to leave an entity in a state its event log did not explain; a completed wait with no wait_completed made the run retry the wait forever. A wait left in that state by an earlier version now gets its missing event on the next attempt.
#4882ecaa047@dretanacr - Write a step's step_completed or step_failed row update and its event in one transaction, as step_started already does. A process that died between the two used to leave a terminal step with no terminal event, so the replayed step_started was refused as terminal and the run never advanced.
#481232f213e@pranaygp - Keep a checked-out client in the World's own pg pool from ending the process when the database drops its connection.
#47577882c81@pranaygp - Store timestamps as timestamp with time zone so createdAt is correct when the Postgres server or session is not in UTC. Migration 0027 converts the columns and repairs created_at values written by earlier versions.
#491642077f2@VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
#48950d434fc@karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.
#47580bc17d7@pranaygp - Resolve a run's encryption key from metadata only when decrypting in workflow inspect --decrypt and the web UI, instead of making the server resolve the run's whole input and output for each lookup.
#48742163290@TooTallNate - Recommend the QuickJS VM with snapshotting on runs that failed with MAX_EVENTS_EXCEEDED or REPLAY_TIMEOUT
#486673a7efa@VaguelySerious - Read event logs where a step's creation is recorded on its step_started alone, with no separate step_created.
#48742163290@TooTallNate - Add getRunLimitGuidance() for runs that failed with MAX_EVENTS_EXCEEDED or REPLAY_TIMEOUT, and show the run's workflow VM in the sidebar
#4819cd2f917@VaguelySerious - Ignore events a step or hook writes after its outcome during replay instead of failing the run
#4733e6bd692 Thanks @VaguelySerious! - Add InBandSupersededError and optional inBand/expectedSeqInBand event-create params for the in-band writer fence. @workflow/world-vercel forwards them, does not retry a fenced write in-process, and records the fence on its event spans. The runtime does not use them yet.
The reason will be displayed to describe this comment to others. Learn more.
Review at head 7b72d53f: the major workflow update has a failing test-frontend check. Please diagnose the failing test(s), update the package/lock combination or code as needed, and rerun frontend tests on the exact head before approval.
Closing this older Workflow 5.2.3 update as superseded by #2401. #2401 targets the same version and includes the runtime and patch fixes that this branch lacks; its current frontend, Python, lint, and build checks pass. The upgrade remains open in #2401: a live ready pack has not been verified after the model hit its daily quota, and dependency-review evidence still fails. This closure is not approval or completion of the upgrade.
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps workflow from 4.8.9 to 5.2.3.
Release notes
Sourced from workflow's releases.
... (truncated)
Changelog
Sourced from workflow's changelog.
... (truncated)
Commits
d9bcbf6Version Packages (#4872)0b6b3e2Version Packages (#4847)ac46e54Version Packages (#4776)f6d93f9fix(core): close lifecycle hook review follow-ups (#4439)ea5ef7fVersion Packages (#4687)e6bd692[world-vercel] In-band writer fence params and InBandSupersededError (#4733)515dc9ffix(core): finish lifecycle registration guidance and diagnostics (#4438)2f9edf3Version Packages (#4580)941e031Export Serializable from Workflow public entrypoints (#4578)ed4ff9eVersion Packages (#4526)