Repository navigation
fix: bump workflow from 4.8.15 to 5.2.3 in /apps/web - #2401
Open
dependabot[bot] wants to merge 7 commits into
Open
dependabot[bot] wants to merge 7 commits into
dependabot[bot] wants to merge 7 commits into
Conversation
dependabot
Bot
added
dependencies
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency ReviewThe following issues were found:
|
groupthinking
requested changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Review at head ad08e519: this PR changes apps/web/package.json without updating the root package-lock.json, and current-head build, lint, and frontend test checks fail. Reconcile the workspace lockfile with the manifest, then rerun the checks before approval.
Bumps [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow) from 4.8.15 to 5.2.3. - [Release notes](https://github.com/vercel/workflow/releases) - [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md) - [Commits](https://github.com/vercel/workflow/commits/workflow@5.2.3/packages/workflow) --- updated-dependencies: - dependency-name: workflow dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/apps/web/workflow-5.1.0
branch
from
October 28, 2026 07:44
ad08e51 to
a2acf24
Compare
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
🔍 PR Validation |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Oct 28, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at eee3cb393cf17ddf4673ab72169405ec8c99b941: the earlier requested change is addressed. The web workflow 5.2.3 declaration and root lockfile now agree, and current hosted build, lint, frontend tests, and issue-link checks pass. The code handles Workflow 5's changed fetch paths for string URLs versus Request inputs, and regression tests cover both paths and idempotence. A clean npm install, focused tests, the web suite (1,522 passed, 28 skipped), lint, type check, and production build passed locally. There are no open inline review threads.
I approve the code at this head. This is not a merge recommendation: the shared dependency-review evidence job still fails, and a real Vercel durable Video Pack run has not been verified. Keep this PR open until those checks are satisfied. The older #2345 targets the same Workflow 5.2.3 upgrade and should remain open until this replacement is accepted.
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Oct 29, 2026
groupthinking
left a comment
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at exact head bbff05c2d5cf3037b011feeff0e9aa9243c6c331: the web Workflow 5.2.3 declaration and root lockfile agree, the Workflow fetch patch handles string URLs and Request inputs with regression coverage, and the scoped security overrides move Workflow zod to 4.6.6, body-parser to 2.4.0, and qs to 6.17.1. Clean install, focused 64-test suite, web TypeScript/lint and production build passed locally. Current hosted checks are 27 successful and 3 skipped, with no failures or open review threads. The current dependency artifact has a warning-free, independently matched 235-row comparison and no added vulnerability entries. I approve the code and dependency fix at this head.
This approval is not a merge recommendation. The prior exact-preview Video Pack run started and persisted through Workflow 5.2.3 but ended with Gemini 429 daily quota, so it did not produce a ready pack. A successful live Video Pack outcome is still unverified; issue #2429 remains open.
Contributor
Author
|
A newer version of workflow exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
This was referenced Nov 2, 2026
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current conflict repair — 2026-11-02
Head
3b71432399f6cc3abf57c7a706b37bf2c60e68bemerges mainffd07a012ddae375096d0ac0f7d20faa680464feinto the existing Workflow 5 branch without rewriting its history. The six-file PR diff retains Workflow 5.2.3, the deferredworkflow/apiimport, and the Workflow 5 fetch patch/regressions. It preserves current main's consumer fixes, Next 16.4.3, explicit app Undici 8.12.3, and v0 CLI compatibility override. This description reports validation of the reconciled head.The root lock preserves the scoped Workflow Zod 4.6.6 overrides and root Zod 4.6.7, body-parser 2.4.0, and qs 6.17.1. Workflow's own Undici copies resolve 7.30.1. New Workflow 5 dependencies (including queue 0.8.0, proper-lockfile, quickjs-wasi, and srvx) are present without adding transitive packages to application manifests. Proper-lockfile keeps its compatible signal-exit 3.0.7 copy; main's root signal-exit 4.1.0 remains.
Local validation used Node 24.20.0 and npm 10.8.0:
npx --yes npm@10.8.0 ci --ignore-scriptsandnpx --yes npm@10.8.0 run postinstall --workspace apps/webpassed.npx --yes npm@10.8.0 exec --workspace apps/web -- vitest run --maxWorkers=2 src/lib/__tests__/patch-world-vercel-undici-fetch.test.ts src/lib/__tests__/video-pack.test.ts src/lib/__tests__/studio-workflow.test.ts src/lib/__tests__/world-vercel-fetch.test.ts src/lib/__tests__/emit-app-builder-sandbox.test.ts src/lib/__tests__/v0-cli-config-compatibility.test.tspassed 92 tests across 6 suites.npx --yes npm@10.8.0 run type-check --workspace apps/web,npx --yes npm@10.8.0 run lint --workspace apps/web, andNEXT_TELEMETRY_DISABLED=1 npx --yes npm@10.8.0 run build:webpassed; build generated all 52 static pages.git diff --checkpassed.instrumentedFetch, paired with its owning Undici 7.30.1 Agent, returned HTTP 200 and the expected body. The application separately resolves Undici 8.12.3. This tests transport compatibility without invoking a hosted model.npx --yes npm@10.8.0 ls --all --jsonexits 1 both here and on independently clean-installed main: the same two extraneous platform package records, two OpenTelemetry peer-version conflicts, and three existing Nest/SWC peer gaps. No new graph problem remains; this is not a clean-graph claim.npx --yes npm@10.8.0 audit --json --package-lock-onlyremains nonzero: 53 records (12 high, 41 moderate), compared with main's 58 (25 high, 33 moderate). No new primary advisory appears in the comparison. Remaining audit findings are not asserted fixed.Hosted build, frontend tests, E2E and Vercel preview have passed on this head. The dependency vulnerability comparison passed, but the evidence recorder failed on a reported change under an unchanged Python requirements manifest, so no complete dependency artifact or passing dependency-review result is established. The previous exact-head approval and green rollup apply to
bbff05c, not this merge commit. The prior live preview proved durable start, step execution, and persisted quota-error handling, but did not produce a ready video pack. Keep this PR open and unmerged until current-head hosted validation and a successful ready-pack outcome are verified. No production deployment or live model request was performed for this repair.The retained security floors address Zod GHSA-mrhx-c7xc-m3w5, body-parser GHSA-27r3-jxmh-p828, and qs GHSA-6pq8-jhm2-2vcw. They remain transitive dependencies. The Workflow-scoped Zod overrides are deliberate compatibility exceptions to narrow upstream pins and are exercised through actual schema and runtime consumers. Reverting those floors can restore vulnerable versions; rollback requires a reviewed manifest-and-lock change preserving unrelated main work.
Security dependency evidence