Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate
, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); fix: bump devalue to 5.8.1 by pranaygp · Pull Request #2292 · vercel/workflow · GitHub
Skip to content

fix: bump devalue to 5.8.1 - #2292

Merged
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284
Jun 8, 2026
Merged

fix: bump devalue to 5.8.1#2292
pranaygp merged 1 commit into
mainfrom
pranaygp/codex/devalue-security-2284

Conversation

@pranaygp

Copy link
Copy Markdown
Contributor

Summary

  • bump the root devalue override from 5.6.3 to 5.8.1
  • bump @workflow/core's direct devalue dependency to 5.8.1
  • refresh the lockfile and add a patch changeset for workflow and @workflow/core

Context

Issue #2284 reported high-severity advisories from npm audit affecting the published devalue path. The undici portion was already addressed separately by #2231, so this PR isolates the remaining actionable dependency fix.

Validation

  • pnpm install --ignore-scripts
  • pnpm audit --prod with no devalue findings
  • pnpm --filter @workflow/utils --filter @workflow/errors --filter @workflow/serde build
  • pnpm --filter @workflow/core exec vitest run src/serialization-format.test.ts src/serialization/serialization.test.ts

Notes

  • Local commands ran under Node v25.2.1, so pnpm emitted the repo's unsupported-engine warning (^18 || ^20 || ^22 || ^24), but the commands above completed successfully.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d64516f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/corePatch
workflowPatch
@workflow/buildersPatch
@workflow/cliPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/vitestPatch
@workflow/web-sharedPatch
@workflow/webPatch
@workflow/world-testingPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production126242191485
✅ 💻 Local Development167102191890
❌ 📦 Local Production166922191890
✅ 🐘 Local Postgres167102191890
✅ 🪟 Windows13500135
❌ 📋 Other7681176945
Total7176710528235

❌ Failed Tests

▲ Vercel Production (4 failed)

express (1 failed):

  • startFromWorkflow - calling start() directly inside a workflow function with hook communication | wrun_01KTM8S3XHVRXD1Z2PWEXSAC0B | 🔍 observability

fastify (1 failed):

hono (1 failed):

vite (1 failed):

  • AbortController abortAnyInStepWorkflow: AbortSignal.any inside a step composes deserialized signals
📦 Local Production (2 failed)

fastify-stable (1 failed):

  • AbortController abortThrowIfAbortedWorkflow: throwIfAborted causes FatalError, no retries

nextjs-turbopack-canary (1 failed):

  • AbortController abortAnyInWorkflowWorkflow: AbortSignal.any composes signals inside the workflow VM
📋 Other (1 failed)

e2e-vercel-prod-tanstack-start (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro109026
✅ example109026
❌ express108126
❌ fastify108126
❌ hono108126
✅ nextjs-turbopack13302
✅ nextjs-webpack13302
✅ nitro109026
✅ nuxt109026
✅ sveltekit12807
❌ vite108126
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
❌ fastify-stable109125
✅ hono-stable110025
❌ nextjs-turbopack-canary115119
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable110025
✅ express-stable110025
✅ fastify-stable110025
✅ hono-stable110025
✅ nextjs-turbopack-canary116019
✅ nextjs-turbopack-stable-lazy-discovery-disabled13500
✅ nextjs-turbopack-stable-lazy-discovery-enabled13500
✅ nextjs-webpack-canary116019
✅ nextjs-webpack-stable-lazy-discovery-disabled13500
✅ nextjs-webpack-stable-lazy-discovery-enabled13500
✅ nitro-stable110025
✅ nuxt-stable110025
✅ sveltekit-stable12906
✅ vite-stable110025
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack13500
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable110025
✅ e2e-local-dev-tanstack-start-110025
✅ e2e-local-postgres-nest-stable110025
✅ e2e-local-postgres-tanstack-start-110025
✅ e2e-local-prod-nest-stable110025
✅ e2e-local-prod-tanstack-start-110025
❌ e2e-vercel-prod-tanstack-start108126

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express0.044s (+2.5%)1.006s (~)0.962s101.00x
💻 LocalNext.js (Turbopack)0.060s (+9.5% 🔺)1.006s (~)0.946s101.36x
🐘 PostgresNitro0.061s (-3.2%)1.013s (~)0.952s101.38x
🐘 PostgresExpress0.063s (-4.8%)1.014s (~)0.951s101.42x
🐘 PostgresNext.js (Turbopack)0.066s (-6.3% 🟢)1.012s (~)0.946s101.48x
💻 LocalNitro⚠️missing----
workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
💻 Local🥇 Express1.090s (-1.0%)2.007s (~)0.917s101.00x
🐘 PostgresNitro1.103s (-0.9%)2.010s (~)0.907s101.01x
🐘 PostgresExpress1.108s (+1.4%)2.009s (~)0.902s101.02x
💻 LocalNext.js (Turbopack)1.130s (+1.9%)2.006s (~)0.876s101.04x
🐘 PostgresNext.js (Turbopack)1.140s (~)2.010s (~)0.870s101.05x
💻 LocalNitro⚠️missing----
workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro10.505s (-0.6%)11.018s (~)0.513s31.00x
💻 LocalExpress10.524s (~)11.023s (~)0.499s31.00x
🐘 PostgresExpress10.557s (-1.5%)11.020s (-2.9%)0.463s31.00x
💻 LocalNext.js (Turbopack)10.748s (+1.3%)11.021s (~)0.273s31.02x
🐘 PostgresNext.js (Turbopack)10.809s (~)11.021s (~)0.212s31.03x
💻 LocalNitro⚠️missing----
workflow with 25 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro13.707s (-1.0%)14.021s (~)0.314s51.00x
🐘 PostgresExpress13.828s (~)14.016s (-1.5%)0.188s51.01x
💻 LocalExpress13.850s (~)14.027s (-1.4%)0.177s51.01x
💻 LocalNext.js (Turbopack)14.305s (+2.0%)15.028s (+2.7%)0.723s41.04x
🐘 PostgresNext.js (Turbopack)14.584s (~)15.021s (~)0.437s41.06x
💻 LocalNitro⚠️missing----
workflow with 50 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro12.434s (-2.4%)13.018s (~)0.584s71.00x
💻 LocalExpress12.539s (~)13.026s (~)0.487s71.01x
🐘 PostgresExpress12.657s (-0.6%)13.022s (-2.2%)0.364s71.02x
💻 LocalNext.js (Turbopack)13.494s (+4.2%)14.027s (+5.4% 🔺)0.532s71.09x
🐘 PostgresNext.js (Turbopack)13.972s (+1.5%)14.447s (+3.1%)0.475s71.12x
💻 LocalNitro⚠️missing----
Promise.all with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.177s (-1.8%)2.007s (~)0.830s151.00x
🐘 PostgresExpress1.197s (~)2.007s (-0.8%)0.810s151.02x
💻 LocalExpress1.205s (-4.6%)2.006s (~)0.801s151.02x
🐘 PostgresNext.js (Turbopack)1.235s (-1.3%)2.009s (~)0.774s151.05x
💻 LocalNext.js (Turbopack)1.356s (+10.9% 🔺)2.005s (~)0.649s151.15x
💻 LocalNitro⚠️missing----
Promise.all with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.240s (-1.5%)2.007s (~)0.767s151.00x
🐘 PostgresExpress1.265s (-4.6%)2.008s (~)0.742s151.02x
🐘 PostgresNext.js (Turbopack)1.398s (-0.8%)2.007s (~)0.609s151.13x
💻 LocalNext.js (Turbopack)1.851s (+7.2% 🔺)2.150s (+7.2% 🔺)0.299s141.49x
💻 LocalExpress1.906s (+1.3%)2.223s (~)0.316s141.54x
💻 LocalNitro⚠️missing----
Promise.all with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.371s (-2.5%)2.006s (~)0.635s151.00x
🐘 PostgresExpress1.413s (+1.4%)2.007s (~)0.594s151.03x
🐘 PostgresNext.js (Turbopack)1.721s (-2.2%)2.154s (-6.1% 🟢)0.434s141.26x
💻 LocalNext.js (Turbopack)4.680s (+6.5% 🔺)5.179s (+3.4%)0.499s63.41x
💻 LocalExpress5.381s (+1.5%)6.014s (~)0.633s53.92x
💻 LocalNitro⚠️missing----
Promise.race with 10 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.174s (-2.2%)2.010s (~)0.836s151.00x
🐘 PostgresExpress1.192s (-0.9%)2.008s (~)0.817s151.02x
🐘 PostgresNext.js (Turbopack)1.242s (-1.9%)2.008s (~)0.766s151.06x
💻 LocalNext.js (Turbopack)1.430s (+9.5% 🔺)2.073s (+3.4%)0.643s151.22x
💻 LocalExpress1.578s (-4.7%)2.007s (-3.2%)0.429s151.34x
💻 LocalNitro⚠️missing----
Promise.race with 25 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.252s (-1.8%)2.008s (~)0.756s151.00x
🐘 PostgresExpress1.278s (+2.8%)2.007s (~)0.729s151.02x
🐘 PostgresNext.js (Turbopack)1.389s (-0.6%)2.009s (~)0.620s151.11x
💻 LocalNext.js (Turbopack)2.029s (~)2.508s (~)0.480s121.62x
💻 LocalExpress2.121s (~)2.591s (~)0.470s121.69x
💻 LocalNitro⚠️missing----
Promise.race with 50 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.383s (-5.4% 🟢)2.008s (~)0.625s151.00x
🐘 PostgresExpress1.409s (-6.1% 🟢)2.010s (-16.2% 🟢)0.601s151.02x
🐘 PostgresNext.js (Turbopack)1.676s (+1.2%)2.076s (~)0.399s151.21x
💻 LocalNext.js (Turbopack)4.849s (-6.0% 🟢)5.349s (-11.1% 🟢)0.499s63.51x
💻 LocalExpress5.882s (~)6.416s (+3.3%)0.534s54.25x
💻 LocalNitro⚠️missing----
workflow with 10 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.543s (-10.8% 🟢)1.006s (~)0.463s601.00x
🐘 PostgresExpress0.584s (-12.4% 🟢)1.007s (-3.9%)0.422s601.08x
💻 LocalExpress0.639s (-2.6%)1.039s (~)0.400s581.18x
🐘 PostgresNext.js (Turbopack)0.808s (~)1.024s (+1.7%)0.216s591.49x
💻 LocalNext.js (Turbopack)0.843s (+21.1% 🔺)1.021s (+1.7%)0.178s591.55x
💻 LocalNitro⚠️missing----
workflow with 25 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.267s (-10.6% 🟢)2.007s (~)0.740s451.00x
🐘 PostgresExpress1.379s (-10.2% 🟢)2.029s (-5.7% 🟢)0.650s451.09x
💻 LocalExpress1.570s (-1.4%)2.007s (-1.1%)0.437s451.24x
🐘 PostgresNext.js (Turbopack)1.945s (~)2.101s (-3.3%)0.157s431.54x
💻 LocalNext.js (Turbopack)2.087s (+20.7% 🔺)2.820s (+39.1% 🔺)0.733s321.65x
💻 LocalNitro⚠️missing----
workflow with 50 sequential data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro2.560s (-12.1% 🟢)3.058s (-6.8% 🟢)0.498s401.00x
🐘 PostgresExpress2.852s (-2.1%)3.193s (-9.8% 🟢)0.341s381.11x
💻 LocalExpress3.597s (+5.2% 🔺)4.216s (+5.1% 🔺)0.619s291.40x
🐘 PostgresNext.js (Turbopack)3.829s (-0.8%)4.110s (+0.8%)0.281s301.50x
💻 LocalNext.js (Turbopack)4.226s (+13.4% 🔺)5.010s (+21.9% 🔺)0.784s241.65x
💻 LocalNitro⚠️missing----
workflow with 10 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.210s (-11.0% 🟢)1.006s (~)0.796s601.00x
🐘 PostgresExpress0.230s (-8.8% 🟢)1.006s (~)0.776s601.10x
🐘 PostgresNext.js (Turbopack)0.261s (-7.3% 🟢)1.006s (~)0.744s601.25x
💻 LocalExpress0.506s (+8.9% 🔺)1.039s (+3.4%)0.533s582.41x
💻 LocalNext.js (Turbopack)0.587s (-3.9%)1.022s (-1.6%)0.435s592.80x
💻 LocalNitro⚠️missing----
workflow with 25 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.322s (-13.1% 🟢)1.006s (~)0.684s901.00x
🐘 PostgresExpress0.361s (+6.4% 🔺)1.006s (~)0.645s901.12x
🐘 PostgresNext.js (Turbopack)0.463s (-4.0%)1.006s (~)0.542s901.44x
💻 LocalExpress2.225s (+1.5%)2.714s (-3.8%)0.489s346.91x
💻 LocalNext.js (Turbopack)2.479s (+1.2%)3.116s (~)0.636s297.70x
💻 LocalNitro⚠️missing----
workflow with 50 concurrent data payload steps (10KB)

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.627s (-11.4% 🟢)1.006s (~)0.379s1201.00x
🐘 PostgresExpress0.717s (+14.6% 🔺)1.007s (-4.6%)0.290s1201.14x
🐘 PostgresNext.js (Turbopack)0.931s (-4.9%)1.326s (-17.5% 🟢)0.395s911.49x
💻 LocalExpress10.104s (-2.1%)10.529s (-3.1%)0.425s1216.12x
💻 LocalNext.js (Turbopack)10.508s (+1.9%)11.391s (+0.8%)0.883s1116.76x
💻 LocalNitro⚠️missing----
Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.161s (-1.7%)2.000s (~)0.001s (-21.4% 🟢)2.011s (~)0.850s101.00x
💻 LocalExpress1.164s (~)2.005s (~)0.012s (-3.9%)2.020s (~)0.856s101.00x
🐘 PostgresExpress1.171s (-2.0%)1.999s (~)0.002s (-95.6% 🟢)2.011s (-1.6%)0.841s101.01x
💻 LocalNext.js (Turbopack)1.200s (+2.7%)2.003s (~)0.011s (+4.0%)2.018s (~)0.818s101.03x
🐘 PostgresNext.js (Turbopack)1.214s (-1.6%)2.001s (~)0.001s (-33.3% 🟢)2.010s (~)0.796s101.05x
💻 LocalNitro⚠️missing-----
stream pipeline with 5 transform steps (1MB)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.546s (-7.1% 🟢)2.005s (~)0.004s (+0.9%)2.023s (~)0.477s301.00x
🐘 PostgresExpress1.661s (-4.4%)2.003s (-6.5% 🟢)0.004s (+33.2% 🔺)2.026s (-6.2% 🟢)0.366s301.07x
🐘 PostgresNext.js (Turbopack)1.728s (-2.0%)2.008s (~)0.004s (-3.3%)2.023s (~)0.296s301.12x
💻 LocalExpress1.796s (+9.8% 🔺)2.011s (~)0.011s (-2.9%)2.202s (+8.8% 🔺)0.406s281.16x
💻 LocalNext.js (Turbopack)1.930s (+17.7% 🔺)2.046s (+1.8%)0.010s (-1.0%)2.244s (+11.0% 🔺)0.314s271.25x
💻 LocalNitro⚠️missing-----
10 parallel streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro0.658s (-9.0% 🟢)1.033s (~)0.000s (-32.2% 🟢)1.056s (+0.8%)0.398s571.00x
🐘 PostgresExpress0.763s (-22.0% 🟢)1.032s (-27.7% 🟢)0.000s (-75.9% 🟢)1.042s (-28.0% 🟢)0.280s581.16x
🐘 PostgresNext.js (Turbopack)0.829s (~)1.068s (~)0.000s (-50.9% 🟢)1.080s (~)0.251s571.26x
💻 LocalExpress1.446s (-2.4%)2.014s (~)0.001s (+26.7% 🔺)2.016s (~)0.570s302.20x
💻 LocalNext.js (Turbopack)1.513s (+4.6%)2.013s (~)0.000s (+75.0% 🔺)2.016s (~)0.503s302.30x
💻 LocalNitro⚠️missing-----
fan-out fan-in 10 streams (1MB each)

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🐘 Postgres🥇 Nitro1.355s (-3.9%)2.069s (+3.7%)0.000s (NaN%)2.099s (+4.3%)0.743s291.00x
🐘 PostgresExpress1.503s (-6.9% 🟢)2.141s (-5.0%)0.000s (+Infinity% 🔺)2.159s (-5.3% 🟢)0.656s281.11x
🐘 PostgresNext.js (Turbopack)1.693s (-2.0%)2.147s (-5.1% 🟢)0.000s (NaN%)2.174s (-4.2%)0.481s281.25x
💻 LocalNext.js (Turbopack)3.118s (-3.0%)3.672s (-5.8% 🟢)0.000s (-24.7% 🟢)3.676s (-5.7% 🟢)0.558s172.30x
💻 LocalExpress3.296s (-1.1%)3.903s (+1.7%)0.000s (-16.7% 🟢)3.905s (+1.6%)0.610s162.43x
💻 LocalNitro⚠️missing-----

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalExpress15/21
🐘 PostgresNitro21/21
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express🐘 Postgres16/21
Next.js (Turbopack)🐘 Postgres15/21
Nitro🐘 Postgres21/21
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Redis + BullMQ: Community world (local development)
  • 🌐 Cloudflare: Community world (local development)
  • 🌐 MySQL: Community world (local development)
  • 🌐 Azure: Community world (local development)
  • 🌐 NATS JetStream: Community world (local development)
  • 🌐 Upstash: Community world (local development)

📋 View full workflow run


Some benchmark jobs failed:

  • Local: failure
  • Postgres: success
  • Vercel: failure

Check the workflow run for details.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​devalue@​5.8.110010010093100

View full report

@pranaygp
pranaygp marked this pull request as ready for review June 8, 2026 19:02
@pranaygp
pranaygp requested a review from a team as a code ownerJune 8, 2026 19:02
CopilotAI review requested due to automatic review settings June 8, 2026 19:02

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s devalue dependency to a non-vulnerable version to address the security advisories reported in Issue #2284, ensuring both the workspace override and @workflow/core resolve to devalue@5.8.1.

Changes:

  • Bump the root pnpm.overrides.devalue from 5.6.3 to 5.8.1.
  • Bump @workflow/core’s direct devalue dependency to 5.8.1.
  • Refresh pnpm-lock.yaml and add a patch changeset for workflow and @workflow/core.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

FileDescription
package.jsonUpdates the workspace pnpm override to force devalue@5.8.1.
packages/core/package.jsonPins @workflow/core’s direct devalue dependency to 5.8.1.
pnpm-lock.yamlLockfile refresh to reflect devalue@5.8.1 across importers/snapshots and package resolution.
.changeset/strong-cups-sip.mdAdds a patch changeset documenting the security-related dependency bump.
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@pranaygp
pranaygp merged commit aa628b7 into mainJun 8, 2026
108 of 120 checks passed
@pranaygp
pranaygp deleted the pranaygp/codex/devalue-security-2284 branch June 8, 2026 19:04
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
github-actionsBot added a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #2294. (backport job run)

TooTallNate pushed a commit that referenced this pull request Jun 8, 2026
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actionsgithub-actionsBot mentioned this pull request Jun 8, 2026
pranaygp added a commit that referenced this pull request Jun 8, 2026
…-stable
* origin/stable:
fix: bump devalue to 5.8.1 (#2292) (#2294)
fix(docs): declare Nitro auto-import globals for code samples (#2290) (#2291)
pranaygp added a commit that referenced this pull request Jun 11, 2026
…-attributes-client
* origin/main: (32 commits)
feat(core): add optional namespace for queue topic prefix (#2305)
[web-shared] Show precise durations in the new trace viewer (#2335)
Validate unique workflow step IDs at build time (#2018)
Move run attributes into their own detail card (#2327)
[core] Forward-port stream reconnect to getReadable level (#2318)
[docs] Add "Step executed multiple times" error page (#2310)
Fix flickering on the detail panel when navigating the trace viewer (#2325)
Version Packages (beta) (#2254)
Patch vulnerable package dependencies (#2301)
Deprecate DurableAgent and update it with WorkflowAgent in v5 docs (#2285)
[codex] Fix partial world-local exclusive writes (#2296)
[world-vercel] Validate ref resolve responses before use (#2035)
fix: bump devalue to 5.8.1 (#2292)
Handle lazy stream key request failures (#2257)
fix(docs): declare Nitro auto-import globals for code samples (#2290)
[core] Preserve event-log order in hook-vs-sleep replay races (#2171) (#2185)
docs: add nitro changelog (#2232)
fix(next): always apply turbopack content condition regardless of builder mode (#2253)
Update @vercel/queue from 0.2.1 to 0.3.0 (#2255)
[nest] Use AST-based CommonJS import rewriting (#2080)
...
# Conflicts:
#	packages/world-local/src/storage/events-storage.ts
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@pranaygp@TooTallNate