Update dependency workflow to v4.5.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
workflow (source)	4.3.1 → 4.5.0

---

Release Notes

vercel/workflow (workflow)

v4.5.0

Compare Source

@​workflow/core@​4.5.0

• #​2373 296b785 @​pranaygp - Replace hook.hasConflict (a Promise<boolean> property) with hook.getConflict(), a method returning a promise that suspends the workflow to commit hook registration and resolves with { runId } identifying the conflicting run when another active hook owns the token (or null once the hook is registered), without waiting for hook payload data. Code using await hook.hasConflict should migrate to const conflict = await hook.getConflict() and branch on conflict !== null.
• #​2305 9c667e0 @​willsather - Add an optional namespace parameter that scopes queue topic prefixes to __{namespace}_wkf_workflow_*. This allows configuring multiple frameworks in the same deployment without queue topic collision.
• #​2345 2100fc3 @​pranaygp - Fix unhandled rejection when step_created/wait_created calls fail in waitUntil
• #​2336 4291c59 @​TooTallNate - Fix unexpected rejections in waitUntil causing process crashes
• #​1847 73975ad @​VaguelySerious - Auto-reconnect getReadable() streams on server close or transient errors

@​workflow/cli@​4.2.10

• #​2395 15507bd @​pranaygp - Upgrade esbuild to ^0.28.1 to resolve GHSA-gv7w-rqvm-qjhr (missing binary integrity verification before executing downloaded binaries).

@​workflow/world@​4.2.0

• #​2305 9c667e0 @​willsather - Add an optional namespace parameter that scopes queue topic prefixes to __{namespace}_wkf_workflow_*. This allows configuring multiple frameworks in the same deployment without queue topic collision.

@​workflow/world-local@​4.2.0

• #​2305 9c667e0 @​willsather - Add an optional namespace parameter that scopes queue topic prefixes to __{namespace}_wkf_workflow_*. This allows configuring multiple frameworks in the same deployment without queue topic collision.
• #​2399 b5569a8 @​VaguelySerious - Update @​vercel/queues from 0.3.0 to 0.3.1, which adds native retries for 429s and ECONNRESET

@​workflow/world-postgres@​4.2.0

• #​2305 9c667e0 @​willsather - Add an optional namespace parameter that scopes queue topic prefixes to __{namespace}_wkf_workflow_*. This allows configuring multiple frameworks in the same deployment without queue topic collision.
• #​2399 b5569a8 @​VaguelySerious - Update @​vercel/queues from 0.3.0 to 0.3.1, which adds native retries for 429s and ECONNRESET

@​workflow/world-vercel@​4.4.1

• #​2338 253eeea @​xujustinj - Use vitest run instead of watch mode so local pnpm test exits cleanly.
• #​1847 73975ad @​VaguelySerious - Propagate client stream cancellation
• #​2399 b5569a8 @​VaguelySerious - Update @​vercel/queues from 0.3.0 to 0.3.1, which adds native retries for 429s and ECONNRESET

@​workflow/world-testing@​4.1.10

• #​2338 253eeea @​xujustinj - Use vitest run instead of watch mode so local pnpm test exits cleanly.

@​workflow/builders@​4.1.0

• #​2305 9c667e0 @​willsather - Add an optional namespace parameter that scopes queue topic prefixes to __{namespace}_wkf_workflow_*. This allows configuring multiple frameworks in the same deployment without queue topic collision.
• #​2395 15507bd @​pranaygp - Upgrade esbuild to ^0.28.1 to resolve GHSA-gv7w-rqvm-qjhr (missing binary integrity verification before executing downloaded binaries).

v4.4.0

Compare Source

@​workflow/core@​4.4.0

• #​1854 5077962 @​TooTallNate - Surface workflowCoreVersion from the responding deployment in healthCheck() results.
• #​2012 326d93a @​pranaygp - Expose the active run ID on hook token conflict errors.
• #​2257 9acd46a @​pranaygp - Avoid unhandled run lookups for unused or empty readable streams and include Vercel request correlation headers in world transport errors.
• #​2145 b385a2d @​TooTallNate - Classify SDK-level AES-GCM encryption failures as RUNTIME_ERROR instead of USER_ERROR via a new RuntimeDecryptionError.
• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​2292 2ab46de @​pranaygp - Bump devalue to 5.8.1 to address published security advisories.
• #​2214 e959124 @​pranaygp - Skip workflow replay when the event log already contains a terminal run event.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/cli@​4.2.9

• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/world@​4.1.5

• #​2012 326d93a @​pranaygp - Expose the active run ID on hook token conflict errors.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/world-local@​4.1.5

• #​2296 a84a293 @​pranaygp - Prevent concurrent readers from observing partially written local entity files.
• #​2012 326d93a @​pranaygp - Expose the active run ID on hook token conflict errors.
• #​2231 95b3477 @​VaguelySerious - Update undici to 7.26.0.
• #​2246 c74e5a3 @​ctgowrie - Update @vercel/queue from 0.1.7 to 0.2.1
• #​2255 c8c8ec1 @​ctgowrie - Update @​vercel/queue from 0.2.1 to 0.3.0
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/world-postgres@​4.1.5

• #​2012 326d93a @​pranaygp - Expose the active run ID on hook token conflict errors.
• #​2246 c74e5a3 @​ctgowrie - Update @vercel/queue from 0.1.7 to 0.2.1
• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​2255 c8c8ec1 @​ctgowrie - Update @​vercel/queue from 0.2.1 to 0.3.0
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/world-vercel@​4.4.0

• #​2235 ecea733 @​AndrewBarba - Add a dispatcher option to createVercelWorld for supplying a custom undici dispatcher, used for both HTTP and queue requests. Defaults to the shared undici RetryAgent.
• #​2231 95b3477 @​VaguelySerious - Update undici to 7.26.0.
• #​2246 c74e5a3 @​ctgowrie - Update @vercel/queue from 0.1.7 to 0.2.1
• #​2257 9acd46a @​pranaygp - Avoid unhandled run lookups for unused or empty readable streams and include Vercel request correlation headers in world transport errors.
• #​2255 c8c8ec1 @​ctgowrie - Update @​vercel/queue from 0.2.1 to 0.3.0
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.
• #​2035 8fde11c @​TooTallNate - Validate ref resolve responses (empty, truncated, or Content-Length-mismatched bodies) before use, throwing WorkflowWorldError instead of corrupting the event log.

@​workflow/world-testing@​4.1.9

• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/web@​4.1.10

• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.

@​workflow/web-shared@​4.1.10

• #​2251 d58f0ba @​karthikscale3 - Render message-only workflow errors with the dedicated error block instead of the generic data inspector.
• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/ai@​6.0.0

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/typescript-plugin@​4.0.3

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/builders@​4.0.10

• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/next@​4.0.10

• #​2298 bc2cf32 @​pranaygp - Preserve deferred step registration with Turbopack content filtering.
• #​2253 a06206e @​wbinnssmith - Always apply turbopack content condition regardless of builder mode to prevent the workflow loader from running on every JS/TS file when lazy discovery is enabled.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/nitro@​4.1.0

• #​2110 8bc2065 @​RihanArfan - Add /_workflow route in dev mode that opens the workflow observability dashboard.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/nuxt@​4.0.10

• #​2302 b93a071 @​pranaygp - Update vulnerable package dependencies to patched releases.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/sveltekit@​4.0.9

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/astro@​4.0.9

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/vite@​4.0.9

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/rollup@​4.0.9

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/errors@​4.1.4

• #​2012 326d93a @​pranaygp - Expose the active run ID on hook token conflict errors.
• #​2145 b385a2d @​TooTallNate - Classify SDK-level AES-GCM encryption failures as RUNTIME_ERROR instead of USER_ERROR via a new RuntimeDecryptionError.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/utils@​4.1.3

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/nest@​0.0.9

• #​2080 4df5cff @​VaguelySerious - Use AST-based import rewriting for NestJS CommonJS workflow bundles.
• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/serde@​4.1.2

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

@​workflow/vitest@​4.0.10

• #​1799 eca3b51 @​TooTallNate - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Sunday and Saturday (* 0-6 * * 6,0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.