workflow@5.2.3

@workflow/core@5.2.3

• #4335 91297ab @pranaygp - Security: remove the nanoid dependency (pinned at 5.1.6, affected by GHSA-28wg-ghj8-5hjv). Default hook tokens now come from a built-in copy of the same generator, so tokens and seeded random values stay identical for runs recorded on earlier versions. Upgrading nanoid itself would have changed them, because nanoid@5.1.16 draws a different number of random bytes per id.
• #4758 0bc17d7 @pranaygp - Resolve a run's encryption key from metadata only, so Run#getReadable() and resuming a hook stored without a resume context no longer make the server resolve the run's whole input and output first.
• #4916 42077f2 @VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
• #4870 59b76f8 @TooTallNate - Stamp the default snapshot threshold into QuickJS runs at start() so they qualify for the event limit exemption, warn when a run approaches the event limit, and recommend WORKFLOW_VM=quickjs in MAX_EVENTS_EXCEEDED and REPLAY_TIMEOUT errors
• #4866 73a7efa @VaguelySerious - Read event logs where a step's creation is recorded on its step_started alone, with no separate step_created.
• #4874 2163290 @TooTallNate - Preserve workflowVm and snapshotThreshold from executionContext in hydrateResourceIO for observability UIs
• #4895 0d434fc @karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.
• #4819 cd2f917 @VaguelySerious - Ignore events a step or hook writes after its outcome during replay instead of failing the run

@workflow/cli@5.0.6

• #4758 0bc17d7 @pranaygp - Resolve a run's encryption key from metadata only when decrypting in workflow inspect --decrypt and the web UI, instead of making the server resolve the run's whole input and output for each lookup.

@workflow/world@5.0.5

• #4916 42077f2 @VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
• #4870 59b76f8 @TooTallNate - Exempt QuickJS runs with a positive snapshot threshold from the default per-run event limit, matching the Vercel World
• #4895 0d434fc @karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.

@workflow/world-local@5.1.2

• #4922 5170f8f @NishitaSikka - Restore missing run_created events for interrupted local run creation.
• #4870 59b76f8 @TooTallNate - Exempt QuickJS runs with a positive snapshot threshold from the default per-run event limit, matching the Vercel World
• #4924 a067ef7 @AndrewBarba - Fix an edge case in createHook({ experimental_force: true }) where a racing resumeHook could be dropped during the handover

@workflow/world-postgres@5.0.5

• #4883 93396c5 @VaguelySerious - Write run_started, run_completed, run_failed, run_cancelled, attr_set, step_retrying, wait_created and wait_completed in one transaction with the entity change they record. A process that died between the two used to leave an entity in a state its event log did not explain; a completed wait with no wait_completed made the run retry the wait forever. A wait left in that state by an earlier version now gets its missing event on the next attempt.
• #4882 ecaa047 @dretanacr - Write a step's step_completed or step_failed row update and its event in one transaction, as step_started already does. A process that died between the two used to leave a terminal step with no terminal event, so the replayed step_started was refused as terminal and the run never advanced.
• #4812 32f213e @pranaygp - Keep a checked-out client in the World's own pg pool from ending the process when the database drops its connection.
• #4757 7882c81 @pranaygp - Store timestamps as timestamp with time zone so createdAt is correct when the Postgres server or session is not in UTC. Migration 0027 converts the columns and repairs created_at values written by earlier versions.

@workflow/world-vercel@5.2.3

• #4916 42077f2 @VaguelySerious - Fix cross-deployment start() to 4.x deployments being misread as a run invocation, and keep replayed runs in the original run's region.
• #4895 0d434fc @karthikscale3 - Avoid redundant history reads when independent hooks register concurrently. Keep existing single-event requests parallel and reconcile their committed events together before continuing, with the normal history reload when the responses do not cover a complete consecutive suffix.

@workflow/web@5.0.6

• #4758 0bc17d7 @pranaygp - Resolve a run's encryption key from metadata only when decrypting in workflow inspect --decrypt and the web UI, instead of making the server resolve the run's whole input and output for each lookup.
• #4874 2163290 @TooTallNate - Recommend the QuickJS VM with snapshotting on runs that failed with MAX_EVENTS_EXCEEDED or REPLAY_TIMEOUT

@workflow/web-shared@5.0.6

• #4866 73a7efa @VaguelySerious - Read event logs where a step's creation is recorded on its step_started alone, with no separate step_created.
• #4874 2163290 @TooTallNate - Add getRunLimitGuidance() for runs that failed with MAX_EVENTS_EXCEEDED or REPLAY_TIMEOUT, and show the run's workflow VM in the sidebar
• #4819 cd2f917 @VaguelySerious - Ignore events a step or hook writes after its outcome during replay instead of failing the run

@workflow/errors@5.0.5

• #4870 59b76f8 @TooTallNate - Add a QuickJS snapshotting hint and docs link to MaxEventsExceededError