[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

[world-local] Bump undici dependency to latest minor version - #568

Merged
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec
Dec 7, 2025
Merged

[world-local] Bump undici dependency to latest minor version#568
VaguelySerious merged 3 commits into
mainfrom
peter/bump-undici-dep-sec

Conversation

@VaguelySerious

Copy link
Copy Markdown
Member

Current undici version gets reported as vulnerable to request tampering, though this doesn't affect us (since it's the local world, and also running on the backend), but patching this to reduce dependabot noise for users

@changeset-bot

changeset-botBot commented Dec 7, 2025

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea78785

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
NameType
@workflow/world-localPatch
@workflow/cliPatch
@workflow/corePatch
@workflow/world-postgresPatch
workflowPatch
@workflow/world-testingPatch
@workflow/buildersPatch
@workflow/nextPatch
@workflow/nitroPatch
@workflow/web-sharedPatch
@workflow/aiPatch
@workflow/astroPatch
@workflow/sveltekitPatch
@workflow/nuxtPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production2255011286
✅ 💻 Local Development25208260
✅ 📦 Local Production25208260
✅ 🐘 Local Postgres25208260
✅ 🪟 Windows260026
❌ 🌍 Community Worlds105110116
Total111261351208

❌ Failed Tests

▲ Vercel Production (50 failed)

nextjs-turbopack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

nextjs-webpack (25 failed):

  • addTenWorkflow
  • addTenWorkflow
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • readableStreamWorkflow
  • hookWorkflow
  • webhookWorkflow
  • webhook route with invalid token
  • sleepingWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • outputStreamWorkflow
  • outputStreamInsideStepWorkflow - getWritable() called inside step functions
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • retryAttemptCounterWorkflow
  • retryableAndFatalErrorWorkflow
  • stepDirectCallWorkflow - calling step functions directly outside workflow context
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
🌍 Community Worlds (11 failed)

mongodb (1 failed):

  • webhookWorkflow

redis (1 failed):

  • webhookWorkflow

starter (8 failed):

  • addTenWorkflow
  • addTenWorkflow
  • retryAttemptCounterWorkflow
  • crossFileErrorWorkflow - stack traces work across imported modules
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step

turso (1 failed):

  • webhookWorkflow

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
✅ astro2501
✅ example2501
✅ express2501
✅ fastify2501
✅ hono2501
❌ nextjs-turbopack0251
❌ nextjs-webpack0251
✅ nitro2501
✅ nuxt2501
✅ sveltekit2501
✅ vite2501
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable2501
✅ express-stable2501
✅ fastify-stable2501
✅ hono-stable2501
✅ nextjs-turbopack-stable2600
✅ nextjs-webpack-stable2600
✅ nitro-stable2501
✅ nuxt-stable2501
✅ sveltekit-stable2501
✅ vite-stable2501
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack2600
❌ 🌍 Community Worlds
AppPassedFailedSkipped
✅ mongodb-dev300
❌ mongodb2510
✅ redis-dev300
❌ redis2510
✅ starter-dev300
❌ starter1880
✅ turso-dev300
❌ turso2510

📋 View full workflow run


Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: success
  • Local Prod: success
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Dec 7, 2025

Copy link
Copy Markdown
Contributor

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.038s (+29.4% 🔺)1.013s (~)0.975s101.00x
💻 LocalNext.js (Turbopack)0.040s (+2.5%)1.017s (~)0.977s101.05x
🌐 RedisNext.js (Turbopack)0.042s (+5.5% 🔺)1.017s (~)0.975s101.09x
💻 LocalNitro0.043s (-7.9% 🟢)1.006s (~)0.963s101.13x
💻 LocalExpress0.043s (~)1.007s (~)0.964s101.13x
🌐 TursoNext.js (Turbopack)0.097s (-4.6%)1.013s (~)0.916s102.54x
🌐 MongoDBNext.js (Turbopack)0.127s (+58.5% 🔺)1.014s (~)0.887s103.32x
🐘 PostgresNext.js (Turbopack)0.189s (+52.4% 🔺)1.019s (~)0.831s104.93x
🐘 PostgresNitro0.329s (-11.1% 🟢)1.012s (~)0.683s108.59x
🐘 PostgresExpress0.375s (+10.1% 🔺)1.014s (~)0.639s109.79x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro0.491s (-50.5% 🟢)1.526s (-20.7% 🟢)1.035s101.00x
▲ VercelExpress0.498s (-19.8% 🟢)1.573s (+2.6%)1.075s101.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 1 step

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.092s (+2.6%)2.009s (~)0.917s101.00x
💻 LocalNext.js (Turbopack)1.094s (~)2.012s (~)0.917s101.00x
🌐 RedisNext.js (Turbopack)1.102s (~)2.012s (~)0.910s101.01x
💻 LocalNitro1.111s (~)2.006s (~)0.896s101.02x
💻 LocalExpress1.113s (~)2.007s (~)0.894s101.02x
🌐 MongoDBNext.js (Turbopack)1.296s (-1.1%)2.013s (~)0.716s101.19x
🌐 TursoNext.js (Turbopack)1.302s (~)2.011s (~)0.709s101.19x
🐘 PostgresNext.js (Turbopack)1.712s (-7.0% 🟢)2.016s (~)0.304s101.57x
🐘 PostgresNitro2.184s (-1.0%)3.014s (~)0.830s102.00x
🐘 PostgresExpress2.220s (+4.1%)3.013s (~)0.793s102.03x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express2.439s (-1.9%)3.457s (~)1.018s101.00x
▲ VercelNitro2.529s (+0.9%)3.554s (+1.7%)1.025s101.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

workflow with 10 sequential steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)10.583s (+1.2%)11.011s (~)0.428s51.00x
💻 LocalNext.js (Turbopack)10.656s (~)11.014s (~)0.359s51.01x
🌐 RedisNext.js (Turbopack)10.664s (~)11.014s (~)0.350s51.01x
💻 LocalNitro10.779s (~)11.012s (~)0.233s51.02x
💻 LocalExpress10.788s (~)11.013s (~)0.225s51.02x
🌐 TursoNext.js (Turbopack)12.179s (~)13.020s (~)0.840s51.15x
🌐 MongoDBNext.js (Turbopack)12.247s (~)13.022s (~)0.775s51.16x
🐘 PostgresNext.js (Turbopack)15.356s (+0.7%)16.032s (~)0.676s51.45x
🐘 PostgresExpress20.278s (+9.7% 🔺)21.032s (+10.5% 🔺)0.754s51.92x
🐘 PostgresNitro20.417s (~)21.028s (~)0.610s51.93x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro21.460s (+4.4%)22.110s (+2.2%)0.650s51.00x
▲ VercelExpress22.052s (+7.6% 🔺)23.211s (+8.8% 🔺)1.159s51.03x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

workflow with 10 parallel steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)1.352s (~)2.008s (~)0.656s51.00x
💻 LocalNext.js (Turbopack)1.354s (~)2.010s (~)0.656s51.00x
🌐 RedisNext.js (Turbopack)1.354s (+1.3%)2.010s (~)0.656s51.00x
💻 LocalNitro1.391s (~)2.005s (~)0.614s51.03x
💻 LocalExpress1.395s (+1.2%)2.007s (~)0.612s51.03x
🐘 PostgresNext.js (Turbopack)1.935s (+6.8% 🔺)2.013s (~)0.078s51.43x
🌐 MongoDBNext.js (Turbopack)2.161s (+1.2%)3.012s (~)0.851s51.60x
🌐 TursoNext.js (Turbopack)2.211s (+4.6%)3.013s (~)0.802s51.64x
🐘 PostgresNitro2.598s (-0.9%)3.011s (~)0.413s51.92x
🐘 PostgresExpress2.663s (+6.4% 🔺)3.014s (~)0.351s51.97x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express4.406s (+15.5% 🔺)5.258s (+14.7% 🔺)0.852s51.00x
▲ VercelNitro4.432s (+21.4% 🔺)5.186s (+10.4% 🔺)0.754s51.01x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.all with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.405s (+3.9%)6.784s (+7.1% 🔺)0.379s51.00x
🌐 RedisNext.js (Turbopack)8.037s (+1.9%)8.412s (+1.4%)0.375s41.25x
🐘 PostgresNext.js (Turbopack)8.684s (-2.2%)9.177s (+1.0%)0.493s41.36x
🐘 PostgresNitro8.866s (+1.6%)9.286s (+2.6%)0.419s41.38x
🐘 PostgresExpress8.968s (-1.2%)9.253s (-1.8%)0.285s41.40x
💻 LocalNext.js (Turbopack)13.326s (-11.0% 🟢)13.648s (-9.4% 🟢)0.323s32.08x
💻 LocalNitro13.898s (+3.7%)13.989s (+2.8%)0.091s32.17x
💻 LocalExpress14.172s (+7.4% 🔺)14.319s (+8.0% 🔺)0.148s32.21x
🌐 MongoDBNext.js (Turbopack)19.779s (-2.3%)20.532s (~)0.753s23.09x
🌐 TursoNext.js (Turbopack)20.236s (~)20.588s (~)0.352s23.16x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Express18.749s (+4.4%)19.463s (+5.8% 🔺)0.714s21.00x
▲ VercelNitro19.434s (+6.4% 🔺)20.278s (+5.6% 🔺)0.844s21.04x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Express | Nitro

stress test: Promise.race with 100 concurrent steps

💻 Local Development

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)6.770s (+8.3% 🔺)7.124s (+9.2% 🔺)0.354s51.00x
🌐 RedisNext.js (Turbopack)8.531s (-1.3%)8.928s (-1.0%)0.397s41.26x
🐘 PostgresNitro9.288s (+1.3%)9.631s (+2.8%)0.343s41.37x
🐘 PostgresNext.js (Turbopack)9.484s (-3.4%)9.640s (-5.7% 🟢)0.157s41.40x
🐘 PostgresExpress9.541s (+2.7%)10.192s (+6.3% 🔺)0.650s31.41x
💻 LocalNitro15.265s (+1.5%)15.589s (+2.9%)0.324s22.25x
💻 LocalNext.js (Turbopack)16.306s (+7.3% 🔺)16.512s (+4.5%)0.205s22.41x
💻 LocalExpress16.800s (+9.9% 🔺)17.020s (+10.4% 🔺)0.219s22.48x
🌐 TursoNext.js (Turbopack)20.078s (-0.5%)20.647s (+0.6%)0.569s22.97x
🌐 MongoDBNext.js (Turbopack)20.166s (+1.8%)20.526s (+2.5%)0.361s22.98x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro17.487s (-8.3% 🟢)18.296s (-8.2% 🟢)0.809s21.00x
▲ VercelExpress17.907s (-3.9%)18.931s (-2.5%)1.024s21.02x
▲ VercelNext.js (Turbopack)⚠️missing----

🔍 Observability: Nitro | Express

Stream Benchmarks(includes TTFB metrics)
workflow with stream

💻 Local Development

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
🌐 Starter🥇 Next.js (Turbopack)0.127s (+29.8% 🔺)1.005s (~)0.000s (NaN%)1.011s (~)0.884s101.00x
💻 LocalNext.js (Turbopack)0.136s (~)1.003s (~)0.015s (-3.1%)1.026s (~)0.890s101.07x
🌐 RedisNext.js (Turbopack)0.144s (~)1.004s (~)0.000s (-50.0% 🟢)1.013s (~)0.869s101.13x
💻 LocalNitro0.174s (-3.5%)0.993s (~)0.016s (+8.0% 🔺)1.023s (~)0.849s101.37x
💻 LocalExpress0.175s (+1.3%)0.992s (~)0.014s (-0.7%)1.021s (~)0.846s101.38x
🌐 TursoNext.js (Turbopack)0.481s (-0.9%)0.971s (+0.5%)0.000s (-100.0% 🟢)1.012s (~)0.531s103.79x
🌐 MongoDBNext.js (Turbopack)0.509s (+6.0% 🔺)0.940s (-3.5%)0.000s (~)1.013s (~)0.504s104.01x
🐘 PostgresNext.js (Turbopack)0.885s (+40.5% 🔺)1.240s (+27.2% 🔺)0.000s (NaN%)1.315s (+29.5% 🔺)0.430s106.98x
🐘 PostgresNitro1.266s (-25.8% 🟢)1.774s (-14.1% 🟢)0.000s (+Infinity% 🔺)2.013s (-13.0% 🟢)0.746s109.98x
🐘 PostgresExpress1.312s (+13.8% 🔺)1.730s (+8.0% 🔺)0.000s (NaN%)2.014s (+11.1% 🔺)0.702s1010.34x

▲ Production (Vercel)

WorldFrameworkWorkflow TimeTTFBSlurpWall TimeOverheadSamplesvs Fastest
▲ Vercel🥇 Nitro2.592s (+4.1%)2.630s (-9.4% 🟢)0.726s (+5.0%)3.815s (-5.8% 🟢)1.222s101.00x
▲ VercelExpress2.615s (+9.6% 🔺)3.180s (+18.7% 🔺)0.413s (-43.0% 🟢)4.055s (+5.9% 🔺)1.440s101.01x
▲ VercelNext.js (Turbopack)⚠️missing-----

🔍 Observability: Nitro | Express

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World🥇 Fastest FrameworkWins
💻 LocalNext.js (Turbopack)6/7
🐘 PostgresNext.js (Turbopack)6/7
▲ VercelNitro4/7
Fastest World by Framework

Winner determined by most benchmark wins

Framework🥇 Fastest WorldWins
Express💻 Local5/7
Next.js (Turbopack)🌐 Starter7/7
Nitro💻 Local5/7
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Starter: Community world (local development)
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@socket-security

socket-securityBot commented Dec 7, 2025

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updatednpm/​undici@​6.19.0 ⏵ 6.22.099+1100+14100+190100

View full report

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

An unused @ts-expect-error directive is causing TypeScript compilation to fail. The directive suppresses a type error that no longer exists due to improved type compatibility between the Fetch API and undici types.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive in queue.ts

What fails: TypeScript compilation fails with error TS2578: "Unused '@ts-expect-error' directive" in packages/world-local/src/queue.ts at line 94.

How to reproduce:

pnpm exec turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Fix: Removed the unused @ts-expect-error comment on line 93. The comment was suppressing a type error that no longer exists due to improved type compatibility between the Fetch API and undici types in newer versions of TypeScript.

Fix on Vercel

@vercelvercelBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔧 Build Fix:

The @ts-expect-error comment on line 93 is no longer needed because TypeScript can now properly type the dispatcher property in the fetch options. This unused directive causes the build to fail with a TypeScript error when strict checking is enabled.

View Details
📝 Patch Details
diff --git a/packages/world-local/src/queue.ts b/packages/world-local/src/queue.ts
index 229e1b0..c55eec8 100644
--- a/packages/world-local/src/queue.ts+++ b/packages/world-local/src/queue.ts@@ -91,7 +91,6 @@ export function createQueue(config: Partial<Config>): Queue {
{
method: 'POST',
duplex: 'half',
- // @ts-expect-error undici type differences
dispatcher: httpAgent,
headers: {
'content-type': 'application/json',

Analysis

Unused @ts-expect-error directive causes TypeScript compilation failure

What fails: TypeScript compiler fails on packages/world-local/src/queue.ts due to an unused @ts-expect-error directive that is no longer needed

How to reproduce:

pnpm turbo run build --filter='@workflow/world-local'

Result:

src/queue.ts(94,15): error TS2578: Unused '@ts-expect-error' directive.

Root cause: The dispatcher property in the fetch options now has proper type definitions in the undici/fetch types, so the TypeScript error that the directive was suppressing no longer occurs. This causes TypeScript to report the directive as unused when noUnusedDirectives or similar strict checking is enabled.

Fix on Vercel

@pranaygp

Copy link
Copy Markdown
Contributor

all builds are failing @VaguelySerious

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@VaguelySerious@pranaygp