Skip to content

fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102

Merged
TooTallNate merged 1 commit into
mainfrom
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged

fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

Conversation

@TooTallNate

@TooTallNateTooTallNate commented Jul 24, 2026

Copy link
Copy Markdown
Member

Fixes VULN-13483

Summary

Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.

Changes

  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains

Notes

  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)

Verification

  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22

CopilotAI review requested due to automatic review settings July 24, 2026 22:19
@TooTallNate
TooTallNate requested review from a team and ijjk as code ownersJuly 24, 2026 22:19
@vercel

vercelBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm

@changeset-bot

changeset-botBot commented Jul 24, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: cc296a8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

CopilotAI reviewed Jul 24, 2026

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Workflow Benchmarks

commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs

Backend: vercel · app: nextjs-turbopack

MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology

Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)

Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost

🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120

All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.

Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.

@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

❌ Some tests failed

❌ Failed E2E Tests

▲ Vercel Production (1 failed)

sveltekit (1 failed):

E2E Test Summary

Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category

❌ ▲ Vercel Production

AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028

✅ 💻 Local Development

AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026

✅ 📦 Local Production

AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026

✅ 🐘 Local Postgres

AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026

✅ 🪟 Windows

AppPassedFailedSkipped
✅ nextjs-turbopack15400

✅ 📋 Other

AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028

✅ vercel-multi-region

AppPassedFailedSkipped
✅ nextjs-turbopack2700

📋 View full workflow run

@TooTallNate
TooTallNate merged commit 706b6c4 into mainJul 24, 2026
41 of 60 checks passed
@TooTallNate
TooTallNate deleted the naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in branch July 24, 2026 22:22
github-actionsBot added a commit that referenced this pull request Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions

github-actionsBot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)

@github-actionsgithub-actionsBot mentioned this pull request Jul 24, 2026
Merged
TooTallNate pushed a commit that referenced this pull request Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit that referenced this pull request Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 by TooTallNate · Pull Request #3102 · vercel/workflow · GitHub
Skip to content
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 - #3102
Merged
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Jul 24, 2026
Merged
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849#3102
TooTallNate merged 1 commit into
mainfrom 
naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in
Conversation
@TooTallNate
@TooTallNateTooTallNate
commented
Jul 24, 2026

Copy link


Copy Markdown

Member
Fixes VULN-13483
Summary
Socket.dev flagged postcss@8.5.16 (GHSA-r28c-9q8g-f849, CVSS 7.5 High) — path traversal in previous source map auto-loading (sourceMappingURL) leading to arbitrary .map file disclosure. Affected versions: < 8.5.18. This is a follow-up to #3067, whose patched version (8.5.16) is inside this new advisory's range.
Changes
  • workbench/swc-playground/package.json and docs/package.json: bump postcss from ^8.5.12 to ^8.5.18
  • pnpm-workspace.yaml: widen the override from postcss@<8.5.12: 8.5.16 to postcss@<8.5.18: 8.5.22 so Next.js's pinned transitive postcss@8.4.31 also lands on a patched version (still required — next@16.2.11 continues to declare postcss: 8.4.31 upstream)
  • Lockfile: single postcss@8.5.22 resolution (plus its nanoid 3.3.12 → 3.3.16 dep); no postcss < 8.5.18 remains
Notes
  • 8.5.22 is the newest version satisfying the repo's minimumReleaseAge (48h): 8.5.23 was published only ~5h ago
  • No changeset needed: no published package's manifest changed (pnpm changeset status --since=main passes)
Verification
  • Fresh pnpm install + pnpm build (27/27 tasks) pass
  • Direct (docs, swc-playground) and transitive (via next) postcss resolutions all verified at 8.5.22
CopilotAI
review requested due to automatic review settings
July 24, 2026 22:19
@TooTallNate
TooTallNate
requested review from
a team and ijjk
as code ownersJuly 24, 2026 22:19
@vercel
vercelBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 24, 2026 10:24pm
example-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-astro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-express-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-hono-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nestjs-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workbench-vite-workflowReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 24, 2026 10:24pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-tarballsReadyReadyPreview, CommentJul 24, 2026 10:24pm
workflow-webReadyReadyPreview, CommentJul 24, 2026 10:24pm
@changeset-bot
changeset-botBot
commented
Jul 24, 2026

Copy link


Copy Markdown

⚠️ No Changeset found
Latest commit: cc296a8
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
CopilotAI
reviewed
Jul 24, 2026
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📊 Workflow Benchmarks
commit cc296a8 · Fri, 24 Jul 2026 22:43:06 GMT · run logs
Backend: vercel · app: nextjs-turbopack
MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep13361390 🔴1419 🔴1710 🔴30
TTFSstream13361388 🔴1434 🔴1619 🔴30
TTFShook + stream14291586 🔴1622 🔴1837 🔴30
STSO1020 steps (1-20)157262 🔴320 🔴373 🔴19
STSO1020 steps (101-120)190295 🔴451 🔴524 🔴19
STSO1020 steps (1001-1020)467562 🔴702 🔴754 🔴19
WO1020 steps3794143794143794143794141
SLstream latency87144 🔴171 🔴341 🔴30
SOstream overhead (text)10615118535430
SOstream overhead (structured)9613715423430
ℹ️ Metric definitions & methodology
Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window)
Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost
🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120
All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.
Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.
@github-actions
github-actionsBot
commented
Jul 24, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
🧪 E2E Test Results
❌ Some tests failed
❌ Failed E2E Tests
▲ Vercel Production (1 failed)
sveltekit (1 failed):
E2E Test Summary
Summary
PassedFailedSkippedTotal
❌ ▲ Vercel Production145412391694
✅ 💻 Local Development148602081694
✅ 📦 Local Production162102271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
✅ 📋 Other102002121232
✅ vercel-multi-region270027
Total7383111138497
Details by Category
❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro126028
✅ example126028
✅ express126028
✅ fastify126028
✅ hono126028
✅ nextjs-turbopack15103
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
❌ sveltekit14419
✅ vite126028
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
✅ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
✅ e2e-vercel-prod-nest126028
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700
📋 View full workflow run
@TooTallNate
TooTallNate
merged commit 706b6c4
into
mainJul 24, 2026

41 of 60 checks passed

@TooTallNate
TooTallNate
deleted the

naterajlich/vuln-13483-dependency-vulnerability-postcss8516-in

branch
July 24, 2026 22:22
github-actionsBot
added a commit
that referenced
this pull request
Jul 24, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)
0b77d9f
Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions
github-actionsBot
commented
Jul 24, 2026

Copy link


Copy Markdown

Contributor
Backport PR opened against stable: #3103. Merge conflicts were resolved by AI — please review carefully. (backport job run)
@github-actionsgithub-actionsBot
mentioned this pull request
Jul 24, 2026
 Merged

TooTallNate pushed a commit
that referenced
this pull request
Jul 25, 2026
@github-actions
fix: upgrade postcss to >=8.5.18 to addressGHSA-r28c-9q8g-f849(#3102)…
6f234bd
… (#3103)
Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
pranaygp added a commit
that referenced
this pull request
Jul 28, 2026
@pranaygp
Merge remote-tracking branch 'origin/main' into karthik/shadcn-regist…
b138b75
…ry-2
* origin/main: (292 commits)
feat(core): seal forwarded stream writes to the owner's public key (#3098)
feat(core): seal hook payloads to the target run's public key (#3096)
[e2e] Rebuild the event-log corruption repro around step-count divergence (#3147)
feat: decrypt sealed payloads in the dashboard and CLI (#3146)
Prewarm only appended replay payloads (#3131)
feat: publish each run's X25519 public key on the run entity (#3095)
feat(core): route sealed envelopes through the serialization layer (#3094)
docs: redirect retired migration-guides URLs to comparisons (#3127)
feat(core): add `encp` sealed-box encryption primitive (#3093)
chore(core): clarify runtime comments (#3111)
Remove obsolete world factory aliases (#3112)
feat(core): deterministic sandbox hardening (#3045)
Remove retired v1 step route plumbing (#3061)
[core] Don't count racing invocations' duplicate step_started events toward the maxRetries ceiling (#3069)
[world-testing] Isolate each spawned test server's data directory (#3055)
fix: upgrade postcss to >=8.5.18 to address GHSA-r28c-9q8g-f849 (#3102)
[next] Respect .gitignore in dev watcher to avoid EMFILE on large monorepos (#3085)
[ci] Backport only stability fixes to `stable`, default to claude-opus-5 (#3092)
perf(core): immediate leading-edge dispatch for idle streams (flush window default 0) (#3088)
Optimize `processImportSpecifier` by computing `shouldFollowImportsFromFile` once per file (#3052)
...
# Conflicts:
#	docs/components/geistdocs/desktop-menu.tsx
#	docs/components/geistdocs/mobile-menu.tsx
#	docs/content/docs/v5/cookbook/advanced/child-workflows.mdx
#	docs/content/docs/v5/cookbook/advanced/upgrading-workflows.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/agent-cancellation.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/durable-agent.mdx
#	docs/content/docs/v5/cookbook/agent-patterns/human-in-the-loop.mdx
#	docs/content/docs/v5/cookbook/common-patterns/batching.mdx
#	docs/content/docs/v5/cookbook/common-patterns/idempotency.mdx
#	docs/content/docs/v5/cookbook/common-patterns/rate-limiting.mdx
#	docs/content/docs/v5/cookbook/common-patterns/saga.mdx
#	docs/content/docs/v5/cookbook/common-patterns/scheduling.mdx
#	docs/content/docs/v5/cookbook/common-patterns/sequential-and-parallel.mdx
#	docs/content/docs/v5/cookbook/common-patterns/timeouts.mdx
#	docs/content/docs/v5/cookbook/common-patterns/webhooks.mdx
#	docs/content/docs/v5/cookbook/common-patterns/workflow-composition.mdx
#	docs/content/docs/v5/cookbook/index.mdx
#	docs/content/docs/v5/cookbook/integrations/ai-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/chat-sdk.mdx
#	docs/content/docs/v5/cookbook/integrations/sandbox.mdx
#	docs/next.config.ts
#	docs/proxy.ts
#	docs/scripts/lint.ts
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate@VaguelySerious