Skip to content

workflow@5.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 22:10
Immutable release. Only release title and notes can be modified.
workflow@5.5.0
47ae6d1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@workflow/core@5.5.0

  • #5227 e866ab9 @VaguelySerious - Remove opt-out and test-only environment variables that are no longer needed. The runtime no longer reads WORKFLOW_INLINE_EARLY_ADVANCE, WORKFLOW_RETURN_VALUE_LONG_POLL, WORKFLOW_SLOT_GAP_CHECK, WORKFLOW_LOG_ORDER_DRAWS, WORKFLOW_INLINE_OWNERSHIP or WORKFLOW_BATCH_TRANSITIONS, and the behavior they could switch off is always on. WORKFLOW_SEALED_LOG (deprecated) is no longer read, and @workflow/world no longer exports SEALED_LOG_ENV_VAR: set WORKFLOW_SPEC_VERSION=6 to create new runs without the sealed log. The Vercel World no longer reads WORKFLOW_MAX_CHUNKS_PER_REQUEST or WORKFLOW_TEST_LIMIT_OVERRIDES, and the Local and Postgres Worlds no longer read WORKFLOW_LOCAL_RUN_STATUS_POLL_INTERVAL_MS and WORKFLOW_POSTGRES_RUN_STATUS_POLL_INTERVAL_MS.
  • #5179 6e007c4 @NishitaSikka - Refuse deliveries to the flow route without the app's queue key, for Worlds that declare queueAuthMode: 'loopback', with a marked 401 before any run is touched, and count refusals on workflow.queue.delivery.refused. WORKFLOW_QUEUE_AUTH=off turns the check off, except while dynamic workflows are enabled. Warn when the flow route starts on a World that declares no queueAuthMode (once, then at most once a minute when routes restart).
  • #5306 dfe2764 @joelfickson - Add maxAttempts to getStepMetadata(), so a step can tell when it is running its last attempt.
  • #5214 1bcd7ef @karthikscale3 - Store deeply frozen values passed between steps, such as results of immer's produce, as references and changes instead of full copies. Such values are returned frozen.
  • #5214 1bcd7ef @karthikscale3 - Add createStateResolver() to workflow/observability and createRunStateHydrator() to @workflow/web-shared, so run inspectors show the actual values of state stored by reference.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5249 f292ef0 @VaguelySerious - Reading a started child's run.returnValue inside the parent workflow no longer starts waiting until the promise is awaited (its first then, catch or finally), so a parent that reads it early keeps spec 9 run-ahead for the steps before the await. The parent's child-run completion hook also stays open between waits instead of being disposed and registered again, and an open completion hook stops run-ahead only while something waits on it.
  • #5342 f486912 @VaguelySerious - QuickJS now treats an idle child completion hook as inactive when deciding whether to keep a workflow delivery live.
  • #5270 ef6343a @VaguelySerious - Read event logs where a run's creation is recorded on its first run_started alone, with no separate run_created.
  • #5289 3debce2 @VaguelySerious - Support Next.js' workflows.experimentalRoutePrefix in local tooling: workflow health takes --base-path, the CLI and web UI find a manifest generated below a route prefix, and the flow route span's http.route includes the base path.
  • #5248 f9b32b2 @VaguelySerious - Spec 9: a run that waits only on open hooks now lingers for WORKFLOW_ORCHESTRATOR_HOOK_LINGER_MS (default 5 seconds, never more than WORKFLOW_ORCHESTRATOR_LINGER_MS) instead of the full 30 seconds after each idle pass, so a long-lived approval or cancel hook beside a polling sleep() holds each wake for up to 5 seconds. A run with a background step still open keeps the full linger.
  • #5281 566cb8a @VaguelySerious - Spec 9: resumeHook() and resumeWebhook() now send the run's workflow name with their hook_received
  • #5248 f9b32b2 @VaguelySerious - Spec 9 node engine: keep the loaded event log's ids, highest slot and hole check in an incremental index, so an in-band write no longer rescans the whole log. On 2000 sequential inline steps in one delivery, time per step drops from about 18 ms to about 12 ms in the in-memory benchmark.
  • #5248 f9b32b2 @VaguelySerious - Spec 9 QuickJS orchestrator: hand off to the next delivery at the invocation's inline deadline, and create new steps as background steps within WORKFLOW_INLINE_STEP_DEADLINE_MARGIN_MS of it, as the node engine does. A delivery whose inline step ran past the deadline no longer starts the next inline step and runs into the function's maximum duration.
  • #5261 b7534aa @VaguelySerious - Spec 9: the QuickJS engine (WORKFLOW_VM=quickjs) now runs ahead of its writes as the node engine does, on by default with WORKFLOW_RUN_AHEAD_DEPTH (default 10, 0 turns it off). At a boundary no other writer can change, an inline step's outcome reaches the workflow before its step_completed commits, and the next steps' creations go out ahead in one batch while their bodies start. If another writer takes a slot a speculative write was placed at, QuickJS restarts the delivery in place from a fresh load, with run-ahead off for the rest of it. The node engine repairs such a write in place instead. Because the QuickJS clock advances to every event the VM reads, a boundary whose code read the clock while the VM held an unconfirmed speculative event waits for its writes to commit before deciding anything.
  • #5279 7ace801 @VaguelySerious - Spec 9: a background step's early redelivery while a retryAfter is still ahead now decides from the step's latest event (one newest-first listByCorrelationId read without payloads) instead of reading the run's whole log. Each step delivery's span records what it read (step.delivery.log_read).
  • #5297 d2a0d5a @VaguelySerious - Spec 9: keep the run-ahead hazard check's cost flat as a delivery runs more inline steps. It copied every step the delivery had run into new sets for each live-feed event and reported event, across one context per boundary it had ever run ahead of, so a long sequential run's step-to-step overhead grew with its length (about 60 ms per step at 1,000 steps on world-vercel). Contexts now leave once their speculative writes settle, and the check answers membership without copying. The workflow.execute span records the most contexts held at once as workflow.run_ahead.contexts_max.
  • #5275 50a1a9f @VaguelySerious - Back off a spec 9 orchestrator's log-tail poll while no live feed covers the run: each empty poll doubles the interval up to 10 seconds, reset on activity.
  • #5298 530abff @VaguelySerious - In spec 9, on a run's first delivery (turbo mode), a step fan-out now starts its inline bodies while its creation batches commit. Background steps' messages still go out only once their creation committed.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.
  • #5214 1bcd7ef @karthikscale3 - Add internal helpers that find and apply changes between versions of a frozen value.

@workflow/cli@5.1.0

  • #5179 6e007c4 @NishitaSikka - Send queue deliveries with the app's queue auth key, read from its data directory.
  • #5328 f41a6e2 @karthikscale3 - Fix CLI inspect and stream output for BigInt values by preserving their precision as decimal strings.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5316 9bf1109 @pranaygp - workflow start resolves the latest deployment the same way start({ deploymentId: 'latest' }) does, so workflows that have never run can be started. It gains --deployment, and --branch for preview.
  • #5289 3debce2 @VaguelySerious - Support Next.js' workflows.experimentalRoutePrefix in local tooling: workflow health takes --base-path, the CLI and web UI find a manifest generated below a route prefix, and the flow route span's http.route includes the base path.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.

@workflow/world@5.2.0

  • #5227 e866ab9 @VaguelySerious - Remove opt-out and test-only environment variables that are no longer needed. The runtime no longer reads WORKFLOW_INLINE_EARLY_ADVANCE, WORKFLOW_RETURN_VALUE_LONG_POLL, WORKFLOW_SLOT_GAP_CHECK, WORKFLOW_LOG_ORDER_DRAWS, WORKFLOW_INLINE_OWNERSHIP or WORKFLOW_BATCH_TRANSITIONS, and the behavior they could switch off is always on. WORKFLOW_SEALED_LOG (deprecated) is no longer read, and @workflow/world no longer exports SEALED_LOG_ENV_VAR: set WORKFLOW_SPEC_VERSION=6 to create new runs without the sealed log. The Vercel World no longer reads WORKFLOW_MAX_CHUNKS_PER_REQUEST or WORKFLOW_TEST_LIMIT_OVERRIDES, and the Local and Postgres Worlds no longer read WORKFLOW_LOCAL_RUN_STATUS_POLL_INTERVAL_MS and WORKFLOW_POSTGRES_RUN_STATUS_POLL_INTERVAL_MS.
  • #5179 6e007c4 @NishitaSikka - Add Queue.queueAuthMode ('loopback' | 'skip'), declaring how the runtime authenticates a World's deliveries to the flow route. Optional; a World that declares none is not checked.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5283 d56e791 @karthikscale3 - Validate with Zod's standard parser instead of z.compile, removing about 200 ms of schema compilation from each cold start without changing what is validated.
  • #5270 ef6343a @VaguelySerious - Read event logs where a run's creation is recorded on its first run_started alone, with no separate run_created.
  • #5281 566cb8a @VaguelySerious - Spec 9: resumeHook() and resumeWebhook() now send the run's workflow name with their hook_received
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.

@workflow/world-local@5.3.0

  • #5227 e866ab9 @VaguelySerious - Remove opt-out and test-only environment variables that are no longer needed. The runtime no longer reads WORKFLOW_INLINE_EARLY_ADVANCE, WORKFLOW_RETURN_VALUE_LONG_POLL, WORKFLOW_SLOT_GAP_CHECK, WORKFLOW_LOG_ORDER_DRAWS, WORKFLOW_INLINE_OWNERSHIP or WORKFLOW_BATCH_TRANSITIONS, and the behavior they could switch off is always on. WORKFLOW_SEALED_LOG (deprecated) is no longer read, and @workflow/world no longer exports SEALED_LOG_ENV_VAR: set WORKFLOW_SPEC_VERSION=6 to create new runs without the sealed log. The Vercel World no longer reads WORKFLOW_MAX_CHUNKS_PER_REQUEST or WORKFLOW_TEST_LIMIT_OVERRIDES, and the Local and Postgres Worlds no longer read WORKFLOW_LOCAL_RUN_STATUS_POLL_INTERVAL_MS and WORKFLOW_POSTGRES_RUN_STATUS_POLL_INTERVAL_MS.
  • #5179 6e007c4 @NishitaSikka - Authenticate queue deliveries (queueAuthMode: 'loopback') with a key in queue-auth-key in the data directory, written owner-only each time the app starts and read by the CLI and the web UI (queueAuthKey: 'read'). Retry a refused delivery at once when the key changed (up to 16 times per message), give it up after 5 other refusals, and write a .gitignore into a data directory that has none.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5283 d56e791 @karthikscale3 - Validate with Zod's standard parser instead of z.compile, removing about 200 ms of schema compilation from each cold start without changing what is validated.
  • #5025 71f6cd8 @pranaygp - Avoid repeated filesystem publication collisions between concurrent step events in one process.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.
  • #5305 b70daa3 @joelfickson - Stop @vercel/nft from copying the build machine's temp directory into functions that bundle the local world, such as the SvelteKit catch-all function.

@workflow/world-postgres@5.2.0

  • #5227 e866ab9 @VaguelySerious - Remove opt-out and test-only environment variables that are no longer needed. The runtime no longer reads WORKFLOW_INLINE_EARLY_ADVANCE, WORKFLOW_RETURN_VALUE_LONG_POLL, WORKFLOW_SLOT_GAP_CHECK, WORKFLOW_LOG_ORDER_DRAWS, WORKFLOW_INLINE_OWNERSHIP or WORKFLOW_BATCH_TRANSITIONS, and the behavior they could switch off is always on. WORKFLOW_SEALED_LOG (deprecated) is no longer read, and @workflow/world no longer exports SEALED_LOG_ENV_VAR: set WORKFLOW_SPEC_VERSION=6 to create new runs without the sealed log. The Vercel World no longer reads WORKFLOW_MAX_CHUNKS_PER_REQUEST or WORKFLOW_TEST_LIMIT_OVERRIDES, and the Local and Postgres Worlds no longer read WORKFLOW_LOCAL_RUN_STATUS_POLL_INTERVAL_MS and WORKFLOW_POSTGRES_RUN_STATUS_POLL_INTERVAL_MS.
  • #5248 f9b32b2 @VaguelySerious - Recover a spec 9 run whose worker died mid-delivery within about 8 minutes by default, instead of after Graphile Worker's 4 hours. With jobLockStaleSeconds unset, every delivery now renews its job lock and registers its worker as renewing, and another process releases a job in a spec 9 run's named queue once its lock has gone unrenewed for 300 seconds, if its holder registered. Jobs held by processes on earlier versions are never released this way, so the default is safe during a rolling upgrade. Setting jobLockStaleSeconds keeps releasing every job after that window, and 0 turns renewal off. Run bootstrap to apply migration 0030_add_job_lock_holders; without it nothing is released, and a warning names the migration.
  • #5275 50a1a9f @VaguelySerious - Implement events.subscribe World functionality over LISTEN/NOTIFY, improving resumption speed on spec 9.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5283 d56e791 @karthikscale3 - Validate with Zod's standard parser instead of z.compile, removing about 200 ms of schema compilation from each cold start without changing what is validated.
  • #5179 6e007c4 @NishitaSikka - Declare queueAuthMode: 'skip' until messages are delivered in-process (#5258); protect the flow route at the network edge. The internal Local World only reads the queue auth key, so a Postgres app creates no key file or .workflow-data directory.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.
  • #5275 50a1a9f @VaguelySerious - Deduplicate every run's keyed step messages with unsafe_dedupe: a spec 8 step message sent again while its job was being delivered added a second job, and another worker ran the step body twice.

@workflow/world-vercel@5.5.0

  • #5227 e866ab9 @VaguelySerious - Remove opt-out and test-only environment variables that are no longer needed. The runtime no longer reads WORKFLOW_INLINE_EARLY_ADVANCE, WORKFLOW_RETURN_VALUE_LONG_POLL, WORKFLOW_SLOT_GAP_CHECK, WORKFLOW_LOG_ORDER_DRAWS, WORKFLOW_INLINE_OWNERSHIP or WORKFLOW_BATCH_TRANSITIONS, and the behavior they could switch off is always on. WORKFLOW_SEALED_LOG (deprecated) is no longer read, and @workflow/world no longer exports SEALED_LOG_ENV_VAR: set WORKFLOW_SPEC_VERSION=6 to create new runs without the sealed log. The Vercel World no longer reads WORKFLOW_MAX_CHUNKS_PER_REQUEST or WORKFLOW_TEST_LIMIT_OVERRIDES, and the Local and Postgres Worlds no longer read WORKFLOW_LOCAL_RUN_STATUS_POLL_INTERVAL_MS and WORKFLOW_POSTGRES_RUN_STATUS_POLL_INTERVAL_MS.
  • #5179 6e007c4 @NishitaSikka - Declare queueAuthMode: 'skip': the flow route only Vercel Queues can trigger takes a message ID, so the runtime does not check a key.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5316 9bf1109 @pranaygp - workflow start resolves the latest deployment the same way start({ deploymentId: 'latest' }) does, so workflows that have never run can be started. It gains --deployment, and --branch for preview.
  • #5283 d56e791 @karthikscale3 - Validate with Zod's standard parser instead of z.compile, removing about 200 ms of schema compilation from each cold start without changing what is validated.
  • #5292 7153e09 @karthikscale3 - Keep idle queue connections for 60s instead of 10s, so instances that publish every 10-60s reuse a warm connection instead of paying a TCP and TLS handshake inside each send.
  • #5270 ef6343a @VaguelySerious - Read event logs where a run's creation is recorded on its first run_started alone, with no separate run_created.
  • #5279 7ace801 @VaguelySerious - Spec 9: watch the live feed with backend heartbeats. world-vercel lists the run-heartbeat WS flag. Against a backend that confirms heartbeats on subscribe_ack, a feed silent for three heartbeat intervals ends through onError, a heartbeat naming a slot the feed never delivered makes it read and deliver the missing events from the log, and a heartbeat for another subscription ends the feed.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.
  • #5329 a9eba54 @VaguelySerious - Record why an event write that tried the run's events WebSocket went over HTTP: the HTTP span carries workflow.events.transport_fallback, no_channel when the run had no socket or connecting for a run_started written during the handshake. Writes that never tried the socket carry no such attribute.
  • #5299 6fe8408 @VaguelySerious - Write run_started over HTTP while the run's events WebSocket is still connecting, instead of waiting for the handshake. A delivery writes it first, as the flow route's socket is still opening, and every later write of the delivery waits for it (on spec 9 it gates turbo's first creation batch and step 1's outcome). The handshake keeps going for the writes after it; a socket that is already open still carries run_started.
  • #5172 87847c5 @abhiramshaji-cyber - Bound the events WebSocket handshake, including the token fetch before it, by WORKFLOW_REQUEST_TIMEOUT_MS, and close the channel when a handshake or a write over it times out, so later event writes fall back to HTTP instead of hanging until maxDuration.

@workflow/world-testing@5.1.0

  • #5179 6e007c4 @NishitaSikka - Add queue auth conformance tests: forged flow-route requests are refused and change no run, and a process sharing the app's data directory starts runs the app completes.
  • #5330 c386053 @TooTallNate - Bump zod to 4.6.7 and undici to 7.30.2 to pick up security fixes.
  • #5283 d56e791 @karthikscale3 - Validate with Zod's standard parser instead of z.compile, removing about 200 ms of schema compilation from each cold start without changing what is validated.
  • #5314 d4f2b6a @porada - Added compatibility coverage for Vitest 5.x
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases. - workflow@5.5.0

@workflow/web@5.1.0

  • #5179 6e007c4 @NishitaSikka - Send queue deliveries with the app's queue auth key, read from its data directory.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.
  • #5214 1bcd7ef @karthikscale3 - Add createStateResolver() to workflow/observability and createRunStateHydrator() to @workflow/web-shared, so run inspectors show the actual values of state stored by reference.

@workflow/web-shared@5.1.0

  • #5214 1bcd7ef @karthikscale3 - Add createStateResolver() to workflow/observability and createRunStateHydrator() to @workflow/web-shared, so run inspectors show the actual values of state stored by reference.
  • #5270 ef6343a @VaguelySerious - Read event logs where a run's creation is recorded on its first run_started alone, with no separate run_created.
  • #5350 8dbb733 @VaguelySerious - Show a run's start Hook in the trace viewer and hook lists. A start Hook has no hook_created event (the run's creation stands for it), so its span and every hook_received delivered to it were dropped from the trace.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.

@workflow/ai@5.0.4

@workflow/builders@5.1.0

  • #4339 285c60d @VaguelySerious - Add workflows.experimentalRoutePrefix option to withWorkflow(), backed by the same field on the Next.js builder config. It emits the generated workflow routes, their queue trigger config and the manifest below a route segment the app owns (e.g. /dashboard/.well-known/workflow/v1/flow). Can be used to host workflow routes within a Microfrontends child app
  • #5224 e05186a @VaguelySerious - Register serialization classes from packages with no workflow dependency, such as AI SDK providers, in the step bundle. A model created inside a "use workflow" function and passed to a step (the WorkflowAgent shape) no longer fails with Class "class//@ai-sdk/openai@…" not found.
  • #5304 f61f410 @joelfickson - Compile JSX in project-local files bundled into a directly loaded steps bundle (Nitro dev, Vitest, NestJS ESM), so a step that imports a .tsx module no longer fails with Unexpected token '<'.
  • #5303 b573022 @joelfickson - Read experimentalDecorators and emitDecoratorMetadata through tsconfig extends (including extends arrays and extensionless paths such as ./tsconfig.base), so decorated classes in workflow and step files compile when the options live in a base config.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.

@workflow/next@5.1.0

  • #4339 285c60d @VaguelySerious - Add workflows.experimentalRoutePrefix option to withWorkflow(), backed by the same field on the Next.js builder config. It emits the generated workflow routes, their queue trigger config and the manifest below a route segment the app owns (e.g. /dashboard/.well-known/workflow/v1/flow). Can be used to host workflow routes within a Microfrontends child app
  • #5330 c386053 @TooTallNate - Bump dev dependencies next to 16.4.5 and vite to 7.3.7 to pick up security fixes.
  • #5303 b573022 @joelfickson - Read experimentalDecorators and emitDecoratorMetadata through tsconfig extends (including extends arrays and extensionless paths such as ./tsconfig.base), so decorated classes in workflow and step files compile when the options live in a base config.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.

@workflow/nitro@5.0.9

@workflow/nuxt@5.0.9

@workflow/sveltekit@5.0.9

@workflow/astro@5.0.9

@workflow/vite@5.0.9

@workflow/rollup@5.0.9

@workflow/utils@5.1.0

  • #5179 6e007c4 @NishitaSikka - Add queue auth helpers: QUEUE_AUTH_HEADER, the key functions (generateQueueAuthKey(), getQueueAuthKey(), isQueueAuthKey(), isWellFormedQueueAuthKey(), setQueueAuthKeySource(), clearQueueAuthKeySources(), verifyQueueAuthKey()), the refusal marker (isQueueAuthRefusal(), QUEUE_AUTH_REFUSED_HEADER, QUEUE_AUTH_REFUSED_CODE) and createLogLimiter().
  • #5267 54f7fd4 @Hecze - Detect dev servers that listen only on IPv6 (such as Vite on localhost, which binds ::1) on Windows, where netstat -p tcp lists IPv4 sockets only.

@workflow/nest@5.1.7

  • #5307 c7003b1 @joelfickson - Mark the NestJS and SWC peer dependencies as optional, so installing workflow no longer pulls @nestjs/core, @nestjs/common and @swc/cli into projects that do not use NestJS. NestJS projects must now list @swc/cli and @swc/core in their own devDependencies (npm i -D @swc/cli @swc/core).workflow-nest init now warns when they are missing.
  • #5331 a8030ca @VaguelySerious - Upgrade dependencies to their latest patch and minor releases.

@workflow/vitest@5.0.9

Assets 3
Loading