Release workflow@4.8.14 · vercel/workflow

@workflow/core@4.8.14

#4336 79796a0 @pranaygp - Security: remove the nanoid dependency (pinned at 5.1.6, affected by GHSA-28wg-ghj8-5hjv). Default hook tokens now come from a built-in copy of the same generator, so tokens and seeded random values stay identical for runs recorded on earlier versions. Upgrading nanoid itself would have changed them, because nanoid@5.1.16 draws a different number of random bytes per id.

#4760 b276686 @pranaygp - workflow inspect stream exits 1 when it cannot read or decode a stream, and workflow inspect st lists streams instead of steps.

#4754 12cf587 @pranaygp - Register a run's stream names under a lock so listStreamsByRunId no longer drops a stream when several of the run's streams first write at once. A stream written again after clear() is listed again.

#4883 a31ab3b @VaguelySerious - Write run_started, run_completed, run_failed, run_cancelled, step_retrying, wait_created and wait_completed in one transaction with the entity change they record. A process that died between the two used to leave an entity in a state its event log did not explain; a completed wait with no wait_completed made the run retry the wait forever. A wait left in that state by an earlier version now gets its missing event on the next attempt.
#4882 486a7d2 @dretanacr - Write a step's step_completed or step_failed row update and its event in one transaction, as step_started already does. A process that died between the two used to leave a terminal step with no terminal event, so the replayed step_started was refused as terminal and the run never advanced.
#4817 fdaf4ae @VaguelySerious - Fix a process crash when the database closes an idle connection
#4756 8d9f05f @pranaygp - Honor pagination.sortOrder in runs.list and steps.list, which always returned newest first.
#4812 4a32790 @pranaygp - Keep a checked-out client in the World's own pg pool from ending the process when the database drops its connection.
#4757 f4b491e @pranaygp - Store timestamps as timestamp with time zone so createdAt is correct when the Postgres server or session is not in UTC. Migration 0027 converts the columns and repairs created_at values written by earlier versions.

#4828 9fc7ee2 @mmarufov - Fix UND_ERR_REQ_CONTENT_LENGTH_MISMATCH by retrying HTTP stream appends with fresh bodies after confirmed 429s, with a bounded Retry-After wait. Retry only connection-refused, DNS, and connect-timeout failures; surface other transport errors without replay.