Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) by github-actions[bot] · Pull Request #2404 · vercel/workflow · GitHub
Skip to content

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) - #2404

Merged
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable
Jun 13, 2026
Merged

Backport #2395: fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)#2404
VaguelySerious merged 1 commit into
stablefrom
backport/pr-2395-to-stable

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated backport of #2395 to stable (backport job run).

Triggered manually via workflow_dispatch.

Merge conflicts were resolved by AI (opencode with anthropic/claude-opus-4.8). Please review the conflict resolution carefully before merging.

* fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr)
Bump the esbuild catalog from ^0.27.3 (resolving 0.27.7) to ^0.28.1 to
resolve the High-severity advisory GHSA-gv7w-rqvm-qjhr (missing binary
integrity verification before executing downloaded binaries). All
workspace consumers reference esbuild via `catalog:` (@workflow/builders,
@workflow/cli, workbench/example, and the root devDependency), so the
single catalog bump propagates everywhere. Adds a patch changeset for the
two publishable consumers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ci): exclude esbuild from minimumReleaseAge gate
The canary E2E jobs run `pnpm install --no-frozen-lockfile` (they mutate
the next dependency), which re-resolves the catalog and hits the 48h
`minimumReleaseAge` gate on the freshly-published esbuild@0.28.1, failing
setup with ERR_PNPM_NO_MATCHING_VERSION. Add esbuild and @esbuild/* to
minimumReleaseAgeExclude (pnpm's recommended fix, consistent with the
existing @vercel/*, @workflow/*, turbo exclusions) so the intended,
catalog-pinned security upgrade resolves under non-frozen installs.
Re-resolving also drops the redundant esbuild@0.28.0 (nitropack@2.13.4
consolidates onto 0.28.1 within its ^0.28.0 range).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: da80e65

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages
NameType
@workflow/buildersPatch
@workflow/cliPatch
@workflow/astroPatch
@workflow/nestPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/rollupPatch
@workflow/sveltekitPatch
@workflow/vitePatch
@workflow/vitestPatch
workflowPatch
@workflow/world-testingPatch
@workflow/nuxtPatch
@workflow/corePatch
@workflow/web-sharedPatch
@workflow/webPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Addednpm/​esbuild@​0.28.1911007391100

View full report

@github-actions

github-actionsBot commented Jun 13, 2026

Copy link
Copy Markdown
ContributorAuthor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production96711671045
❌ 💻 Local Development104212861140
❌ 📦 Local Production104212861140
❌ 🐘 Local Postgres104212861140
❌ 🪟 Windows941095
❌ 🌍 Community Worlds1341036243
❌ 📋 Other528636570
Total48491573675373

❌ Failed Tests

▲ Vercel Production (11 failed)

astro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

example (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

express (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

fastify (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

hono (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nextjs-webpack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nitro (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

nuxt (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

sveltekit (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability

vite (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ | 🔍 observability
💻 Local Development (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
📦 Local Production (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

express-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

fastify-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

hono-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-turbopack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-canary (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nextjs-webpack-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nitro-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

nuxt-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

sveltekit-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

vite-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
🌍 Community Worlds (103 failed)

mongodb (17 failed):

  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

redis (13 failed):

  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • pages router sleepingWorkflow via pages router
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS

turso (73 failed):

  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • addTenWorkflow | wrun_01KV12TDC6J1MW25H8S0DV6FBY
  • wellKnownAgentWorkflow (.well-known/agent) | wrun_01KV12TGPYDYCYVAEGAVTSSR07
  • should work with react rendering in step
  • promiseAllWorkflow | wrun_01KV12TN1EN5H8450W9PH4QJ4A
  • promiseRaceWorkflow | wrun_01KV12TSWJDGG4H2KY7GMJ9YXK
  • promiseAnyWorkflow | wrun_01KV12TXHC452XM217X97XE5AD
  • importedStepOnlyWorkflow | wrun_01KV12TYNSWRM8M3N7F54Y3Z13
  • readableStreamWorkflow | wrun_01KV12V03T0WF0XQFGABD5ZA57
  • hookWorkflow | wrun_01KV12VD6GH82PVMCMEKMF7QHQ
  • hookWorkflow is not resumable via public webhook endpoint | wrun_01KV12VMDGPRRRC19RAJXJXQWX
  • webhookWorkflow | wrun_01KV12VSTFNB9H7PJEQPJKP73B
  • sleepingWorkflow | wrun_01KV12W0J21JJFSXYA6EBQBSB2
  • parallelSleepWorkflow | wrun_01KV12WG6HD3XSWDARVJSKV8YP
  • nullByteWorkflow | wrun_01KV12WKS0XVFYHYZYA06P2PWM
  • workflowAndStepMetadataWorkflow | wrun_01KV12WP13WW32TKBJRA52WE9E
  • outputStreamWorkflow no startIndex (reads all chunks)
  • outputStreamWorkflow positive startIndex (skips first chunk)
  • outputStreamWorkflow negative startIndex (reads from end)
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns correct index after stream completes
  • outputStreamWorkflow - getTailIndex and getStreamChunks getTailIndex returns -1 before any chunks are written
  • outputStreamWorkflow - getTailIndex and getStreamChunks getStreamChunks returns same content as reading the stream
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions | wrun_01KV12ZAEJD5F8WR2K06AKYMYH
  • writableForwardedFromWorkflowWorkflow | wrun_01KV12ZRB8F2NSMDBK4EX4K7WE
  • writableForwardedFromStepWorkflow | wrun_01KV12ZWT3N4R700YT1BAQF6NA
  • fetchWorkflow | wrun_01KV1300F0ATN8AFEWK4YY021A
  • promiseRaceStressTestWorkflow | wrun_01KV1303ZZXJ30V17KQXFDG6BR
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • error handling not registered WorkflowNotRegisteredError fails the run when workflow does not exist
  • error handling not registered StepNotRegisteredError fails the step but workflow can catch it
  • error handling not registered StepNotRegisteredError fails the run when not caught in workflow
  • hookCleanupTestWorkflow - hook token reuse after workflow completion | wrun_01KV133MNB1T4VX1VZJTKH87FC
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously | wrun_01KV13436ENA4DE24074GRNJ1R
  • hookGetConflictWorkflow - awaiting hook.getConflict() registers hook without payload | wrun_01KV134FQRV1H77FDAQ28YGD2B
  • 'hookGetConflictWithPriorStepWorkflow' - hook.getConflict() does not block step execution | wrun_01KV134J9WYPKPJBT5BQ8ZSSCQ
  • 'hookGetConflictWithParallelStepWorkfl…' - hook.getConflict() does not block step execution | wrun_01KV134MXC2MQC3GGZ82FP5YSW
  • hookGetConflictThenStepParallelWorkflow - hook.getConflict() continuation step runs alongside other steps | wrun_01KV134QFQTG4KAKGRYE83CY3Q
  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running | wrun_01KV1358NXGXVPPZGCJK5VPZC1
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_01KV135S8V2JHDHCNPY7HMNVZM
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument | wrun_01KV13636N3K2YA87MRFNNJCKD
  • closureVariableWorkflow - nested step functions with closure variables | wrun_01KV13692SYEV0QW8SYCZ9H1N8
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step | wrun_01KV136BK9SBD22Z19XYKHPGJZ
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • health check (CLI) - workflow health command reports healthy endpoints
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly | wrun_01KV136XXV0Q3Q6CYHEF554R0P
  • Calculator.calculate - static workflow method using static step methods from another class | wrun_01KV1374CQX6EEVYWHP66SYQBT
  • AllInOneService.processNumber - static workflow method using sibling static step methods | wrun_01KV137BW516QZWNM9GGBKXNBY
  • ChainableService.processWithThis - static step methods using this to reference the class | wrun_01KV137K66P7AERRMKV39ZS87M
  • thisSerializationWorkflow - step function invoked with .call() and .apply() | wrun_01KV137TK2TP9XJQVGEXKGHBPN
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE | wrun_01KV1383MJJRPGMAC5QD9PJM59
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_01KV138C15S76WAB98FE4AR875
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context | wrun_01KV138SZP1PWJJKAVTKQ0EG4G
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument | wrun_01KV13956HEFNYCF78TQAPREG5
  • cancelRun - cancelling a running workflow | wrun_01KV139CHWBWFW03QMFX92H62J
  • cancelRun via CLI - cancelling a running workflow | wrun_01KV139PM6JJTAQFBB4CTC9CTF
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
  • hookWithSleepWorkflow - hook payloads delivered correctly with concurrent sleep | wrun_01KV13A3GV2GY3BHDT0AS92AYE
  • sleepInLoopWorkflow - sleep inside loop with steps actually delays each iteration | wrun_01KV13AMYVYAA4B442VSQZ6TX3
  • sleepWithSequentialStepsWorkflow - sequential steps work with concurrent sleep (control) | wrun_01KV13B0GB5D5NS1W73QMR3QQ8
  • importMetaUrlWorkflow - import.meta.url is available in step bundles | wrun_01KV13B8722ASGWJSC9YKH4K0D
  • metadataFromHelperWorkflow - getWorkflowMetadata/getStepMetadata work from module-level helper (#1577) | wrun_01KV13BAST2MM42WR59D1G60CD
  • resilient start: addTenWorkflow completes when run_created returns 500 | wrun_01KV13BD1YRC4V3HD992ZS1BNS
📋 Other (6 failed)

e2e-local-dev-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-dev-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-postgres-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-nest-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

e2e-local-prod-tanstack-start-stable (1 failed):

  • hookGetConflictWorkflow - hook.getConflict() resolves with the conflicting run when token is already registered | wrun_01KV1353THXEB65XVT4RWAFFEJ

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro8717
❌ example8717
❌ express8717
❌ fastify8717
❌ hono8717
❌ nextjs-turbopack9212
❌ nextjs-webpack9212
❌ nitro8717
❌ nuxt8717
❌ sveltekit8717
❌ vite8717
❌ 💻 Local Development
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 📦 Local Production
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🐘 Local Postgres
AppPassedFailedSkipped
❌ astro-stable8816
❌ express-stable8816
❌ fastify-stable8816
❌ hono-stable8816
❌ nextjs-turbopack-canary75119
❌ nextjs-turbopack-stable9410
❌ nextjs-webpack-canary75119
❌ nextjs-webpack-stable9410
❌ nitro-stable8816
❌ nuxt-stable8816
❌ sveltekit-stable8816
❌ vite-stable8816
❌ 🪟 Windows
AppPassedFailedSkipped
❌ nextjs-turbopack9410
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev302
❌ mongodb59170
✅ redis-dev302
❌ redis63130
✅ turso-dev302
❌ turso3730
❌ 📋 Other
AppPassedFailedSkipped
❌ e2e-local-dev-nest-stable8816
❌ e2e-local-dev-tanstack-start-stable8816
❌ e2e-local-postgres-nest-stable8816
❌ e2e-local-postgres-tanstack-start-stable8816
❌ e2e-local-prod-nest-stable8816
❌ e2e-local-prod-tanstack-start-stable8816

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@VaguelySerious
VaguelySerious merged commit 15507bd into stableJun 13, 2026
37 of 94 checks passed
@VaguelySerious
VaguelySerious deleted the backport/pr-2395-to-stable branch June 13, 2026 18:19
pranaygp added a commit that referenced this pull request Jun 13, 2026
…-stable
* origin/stable:
[test] Fix stable e2e hookGetConflict test to use waitForHookState (#2405)
Update queue client to 0.3.1 (#2399) (#2401)
fix(deps): upgrade esbuild to 0.28.1 (GHSA-gv7w-rqvm-qjhr) (#2395) (#2404)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@VaguelySerious