Repository navigation
fix: bump workflow from 4.8.15 to 5.2.3 in /apps/web - #2401
Open
dependabot[bot] wants to merge 5 commits into
Open
dependabot[bot] wants to merge 5 commits into
dependabot[bot] wants to merge 5 commits into
Conversation
dependabot
Bot
added
dependencies
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency ReviewThe following issues were found:
|
groupthinking
requested changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Review at head ad08e519: this PR changes apps/web/package.json without updating the root package-lock.json, and current-head build, lint, and frontend test checks fail. Reconcile the workspace lockfile with the manifest, then rerun the checks before approval.
Bumps [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow) from 4.8.15 to 5.2.3. - [Release notes](https://github.com/vercel/workflow/releases) - [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md) - [Commits](https://github.com/vercel/workflow/commits/workflow@5.2.3/packages/workflow) --- updated-dependencies: - dependency-name: workflow dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/apps/web/workflow-5.1.0
branch
from
October 28, 2026 07:44
ad08e51 to
a2acf24
Compare
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
🔍 PR Validation |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at eee3cb393cf17ddf4673ab72169405ec8c99b941: the earlier requested change is addressed. The web workflow 5.2.3 declaration and root lockfile now agree, and current hosted build, lint, frontend tests, and issue-link checks pass. The code handles Workflow 5's changed fetch paths for string URLs versus Request inputs, and regression tests cover both paths and idempotence. A clean npm install, focused tests, the web suite (1,522 passed, 28 skipped), lint, type check, and production build passed locally. There are no open inline review threads.
I approve the code at this head. This is not a merge recommendation: the shared dependency-review evidence job still fails, and a real Vercel durable Video Pack run has not been verified. Keep this PR open until those checks are satisfied. The older #2345 targets the same Workflow 5.2.3 upgrade and should remain open until this replacement is accepted.
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
approved these changes
Oct 29, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at exact head bbff05c2d5cf3037b011feeff0e9aa9243c6c331: the web Workflow 5.2.3 declaration and root lockfile agree, the Workflow fetch patch handles string URLs and Request inputs with regression coverage, and the scoped security overrides move Workflow zod to 4.6.6, body-parser to 2.4.0, and qs to 6.17.1. Clean install, focused 64-test suite, web TypeScript/lint and production build passed locally. Current hosted checks are 27 successful and 3 skipped, with no failures or open review threads. The current dependency artifact has a warning-free, independently matched 235-row comparison and no added vulnerability entries. I approve the code and dependency fix at this head.
This approval is not a merge recommendation. The prior exact-preview Video Pack run started and persisted through Workflow 5.2.3 but ended with Gemini 429 daily quota, so it did not produce a ready pack. A successful live Video Pack outcome is still unverified; issue #2429 remains open.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current review and security repair — 2026-10-29
Current head
bbff05c2d5cf3037b011feeff0e9aa9243c6c331keeps the Workflow 5 migration and repairs the new dependency-review finding from the prior head. The prior head's warning-free 232-row comparison identified three newly added vulnerable transitive versions; its recorder artifact and a fresh GitHub comparison matched exactly. The older review update below is retained as history and is superseded by this section.Security dependency evidence
<4.6.6, fixed in4.6.6; body-parser GHSA-27r3-jxmh-p828 affects>=2.0.0,<2.4.0, fixed in2.4.0; qs GHSA-6pq8-jhm2-2vcw affects>=6.7.0,<=6.16.0, fixed in6.16.1.@workflow/{cli,core,world,world-local,world-vercel} → zodrequested~4.5.4, so scoped overrides resolve their copies from vulnerable4.5.4to4.6.6; the root lock resolves Zod4.6.7.@modelcontextprotocol/sdk → express → body-parserresolves2.3.0 → 2.4.0, andexpress/body-parser → qsresolves6.16.0 → 6.17.1. The two latter ranges permit the fixes without overrides.npx --yes npm@10.8.0 ci --ignore-scriptspassed;npm run postinstall --workspace apps/webpassed;npx --yes npm@10.8.0 exec --workspace apps/web -- vitest run src/lib/__tests__/patch-world-vercel-undici-fetch.test.ts src/lib/__tests__/video-pack.test.ts src/lib/__tests__/studio-workflow.test.tspassed 64/64;./node_modules/.bin/tsc --noEmit -p apps/web/tsconfig.json,npx --yes npm@10.8.0 run lint --workspace apps/web,npx --yes npm@10.8.0 run build:web, andgit diff --staged --checkpassed. The npm install reported 30 overall audit findings; these are not asserted fixed by this PR. Current-head hosted checks finished 27 passed, 3 skipped, 0 failed/pending. The dependency-review job passed; its uploaded attempt-1 artifactdependency-review-bbff05c2d5cf3037b011feeff0e9aa9243c6c331-1records 235 rows. An independent GitHub comparison withper_page=5returned HTTP 200, an empty snapshot-warning header, the same 235 rows, and no newly added vulnerability entries.This branch remains open and unmerged. Current-head hosted dependency review and artifact inspection have passed. A live Workflow 5 Video Pack outcome remains a separate gate.
Review update — 2026-10-28
Current head
eee3cb393cf17ddf4673ab72169405ec8c99b941merges currentmain(ba2777d1b008c2148d413e07cc497791966310e0) and synchronizes the web Workflow 5 manifest with the root lockfile. The declared range isworkflow^5.2.3. To make the major upgrade work, the app now importsworkflow/apiwhen the Video Pack workflow starts, and the postinstall fetch patch handles Workflow 5's changed runtime layout. The patch has regression coverage and was rerun to confirm it is idempotent.Validation at this head: clean root
npm ci --ignore-scriptspassed; focused patch tests passed; the web suite passed 1,522 tests with 28 skipped; web lint, type check, and production build passed;git diff --checkpassed. Hosted checks finished 25 passed, 3 skipped, 1 failed. The sole failure is the shareddependency-reviewevidence step (Maximum object size exceeded), which uploaded no artifact; it is tracked in #2487/#2485.Live preview check at this exact head: the protected Vercel deployment
dpl_DC3tFZFvwxXscSLHP8sPBN7ppPP1was independently mapped to this PR commit. A single POST for NASA’s public 60-second video (previously absent from the pack store) returned HTTP 202processing. Workflow runwrun_41M61MEJWM0GTM609SK2CHC8JSand its extraction step completed on Workflow Core 5.2.3; separate GETs confirmed a persisted terminalHOSTED_PACK_EXTRACT_FAILEDrecord. The model returned a temporary 503 and then a 429 free-tier daily limit (20 requests/day) forgemini-3.8-flash. This verifies durable start, step execution, and saved error handling, not a successful extracted pack. No second POST was sent. Keep this PR open and unmerged until a ready pack is verified after model quota is available and the shareddependency-reviewevidence check is reliable. The original generated Dependabot notes follow for provenance.Original Dependabot notes
Bumps workflow from 4.8.15 to 5.2.3.
Release notes
Sourced from workflow's releases.
... (truncated)
Changelog
Sourced from workflow's changelog.
... (truncated)
Commits
d9bcbf6Version Packages (#4872)0b6b3e2Version Packages (#4847)ac46e54Version Packages (#4776)f6d93f9fix(core): close lifecycle hook review follow-ups (#4439)ea5ef7fVersion Packages (#4687)e6bd692[world-vercel] In-band writer fence params and InBandSupersededError (#4733)515dc9ffix(core): finish lifecycle registration guidance and diagnostics (#4438)2f9edf3Version Packages (#4580)941e031Export Serializable from Workflow public entrypoints (#4578)ed4ff9eVersion Packages (#4526)