Skip to content

Bump devalue and workflow in /apps/web - #42

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/multi-73e41cc54c
Open

Bump devalue and workflow in /apps/web#42
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/multi-73e41cc54c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown

Bumps devalue to 6.0.3 and updates ancestor dependency workflow. These dependencies need to be updated together.

Updates devalue from 5.8.1 to 6.0.3

Release notes

Sourced from devalue's releases.

v6.0.3

Patch Changes

  • 5cd712a: perf: use native JSON.stringify for strings that need escaping, instead of a per-character loop
  • b49ae34: chore: lower required node version to >=18
  • c411e5e: fix: use explicit .js extension in type imports for nodenext compatibility

v6.0.2

Patch Changes

  • 12ad9d6: chore: remove dts-buddy

v6.0.1

Patch Changes

  • c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
  • 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
  • e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
  • 6156b2e: perf: only format path when an error is raised
  • 6156b2e: perf: cache quoted property names
  • 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

v6.0.0

Major Changes

  • afb3cb4: breaking: use tagged template js for uneval replacers instead of nested uneval
  • 3100507: breaking: require Node 22.17 or newer

Minor Changes

  • afb3cb4: feat: support cyclic custom objects

Patch Changes

  • ac295fb: fix: escape unpaired surrogates so uneval/stringify output survives UTF-8 transport

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays

... (truncated)

Changelog

Sourced from devalue's changelog.

6.0.3

Patch Changes

  • 5cd712a: perf: use native JSON.stringify for strings that need escaping, instead of a per-character loop
  • b49ae34: chore: lower required node version to >=18
  • c411e5e: fix: use explicit .js extension in type imports for nodenext compatibility

6.0.2

Patch Changes

  • 12ad9d6: chore: remove dts-buddy

6.0.1

Patch Changes

  • c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
  • 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
  • e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
  • 6156b2e: perf: only format path when an error is raised
  • 6156b2e: perf: cache quoted property names
  • 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

6.0.0

Major Changes

  • afb3cb4: breaking: use tagged template js for uneval replacers instead of nested uneval
  • 3100507: breaking: require Node 22.17 or newer

Minor Changes

  • afb3cb4: feat: support cyclic custom objects

Patch Changes

  • ac295fb: fix: escape unpaired surrogates so uneval/stringify output survives UTF-8 transport

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays

... (truncated)

Commits

Updates workflow from 4.8.3 to 5.2.2

Release notes

Sourced from workflow's releases.

workflow@5.2.2

@​workflow/core@​5.2.2

  • #4861 afdc68b @​pranaygp - Order setAttributes() resolution with the replay delivery barriers so a branch awaiting it can no longer resume out of event-log order, which could fail the run with REPLAY_DIVERGENCE or hand concurrent branches each other's step results
  • #4856 a04ecaa @​http-samc - Upgrade devalue to 6.0.3, which escapes large strings with native JSON.stringify instead of a per-character loop. Strings containing unpaired surrogates now round-trip exactly instead of being replaced with U+FFFD.
  • #4818 0948b0a @​VaguelySerious - Remove the experimental WORKFLOW_RESILIENT_STEP_DISPATCH option

@​workflow/world-vercel@​5.2.2

  • #4828 02993a2 @​mmarufov - Fix UND_ERR_REQ_CONTENT_LENGTH_MISMATCH by retrying HTTP stream appends with fresh bodies after confirmed 429s, using the shared throttle wait policy. Retry only connection-refused, DNS, and connect-timeout failures; surface other transport errors without replay.

workflow@5.2.1

@​workflow/core@​5.2.1

  • #4669 854242e @​http-samc - Compress workflow arguments on the libuv threadpool when starting a run, so large inputs no longer block the caller's event loop during zstd compression.
  • #4670 73a6ca3 @​http-samc - Add a compressArguments option to start(); pass false to store the run's arguments uncompressed when the inputs are known to be incompressible.
  • #4835 fcb554b @​pranaygp - Record the queue namespace on a run's executionContext.queueNamespace in start(), so restart recovery re-enqueues the run to its own namespace.

@​workflow/cli@​5.0.4

  • #4760 1342a96 @​pranaygp - Improve workflow inspect for long runs and scoped lookups: add --all for complete steps, events, and sleeps listings, print reusable cursor hints, and keep pagination on the read path that issued the cursor. Support event ID and short workflow-name lookups, require --runId for individual steps, events, and streams, fix st to mean streams, include run IDs in stream hints, and exit non-zero when a stream read fails.

@​workflow/world@​5.0.4

  • #4733 e6bd692 @​VaguelySerious - Add InBandSupersededError and optional inBand/expectedSeqInBand event-create params for the in-band writer fence. @workflow/world-vercel forwards them, does not retry a fenced write in-process, and records the fence on its event spans. The runtime does not use them yet.
  • #4835 fcb554b @​pranaygp - Add optional Queue.registerRoute() and Queue.registerHandler(), implemented by @workflow/world-local and @workflow/world-postgres, so a queue consumer other than the Workflow SDK receives its own prefix's messages on its own route or in process. reenqueueActiveRuns() re-enqueues a run to the queue namespace it recorded, and @workflow/world-postgres keeps a job's queue prefix.
  • #4821 ebaa5b7 @​VaguelySerious - Implement the optional in-band writer fence and list snapshot in @workflow/world-local and @workflow/world-postgres, declared with the new inBandFence capability.
  • #4821 ebaa5b7 @​VaguelySerious - Report deliveryCount and createdAt in queue handler meta on @workflow/world-local and @workflow/world-postgres.
  • #4833 3e93033 @​pranaygp - @workflow/world-vercel declares the inBandFence capability (its backend refuses a stale in-band write on every run with an event sequencer, and answers an in-band write on an older run with a 400), and passes on the in-band counts its backend reports: snapshot on events.list and allocated on a single events.create. The inBandFence contract lets a World list no snapshot when its refusals carry both counters, and @workflow/world-testing takes the counters from a refusal for such a World.

@​workflow/world-local@​5.1.1

  • #4835 fcb554b @​pranaygp - Add optional Queue.registerRoute() and Queue.registerHandler(), implemented by @workflow/world-local and @workflow/world-postgres, so a queue consumer other than the Workflow SDK receives its own prefix's messages on its own route or in process. reenqueueActiveRuns() re-enqueues a run to the queue namespace it recorded, and @workflow/world-postgres keeps a job's queue prefix.
  • #4821 ebaa5b7 @​VaguelySerious - Implement the optional in-band writer fence and list snapshot in @workflow/world-local and @workflow/world-postgres, declared with the new inBandFence capability.
  • #4838 b69fabe @​fazxes - Fix initDataDir() crashing on Bun for a new data directory: Bun's opendir() reports a missing directory on the first read, not when it is opened.
  • #4834 77ccb69 @​pranaygp - Fix in-band event count conflicts when multiple processes write events, and fix count not surviving world restarts
  • #4754 c57820d @​pranaygp - Register a run's stream names under a lock so streams.list no longer drops a stream when several of the run's streams first write at once. A stream written again after clear() is listed again.
  • #4821 ebaa5b7 @​VaguelySerious - Report a message's cumulative deliveryCount across { timeoutSeconds } redeliveries on @workflow/world-postgres.
  • #4821 ebaa5b7 @​VaguelySerious - Report deliveryCount and createdAt in queue handler meta on @workflow/world-local and @workflow/world-postgres.

@​workflow/world-postgres@​5.0.4

  • #4817 026741b @​VaguelySerious - Fix a process crash when the database closes an idle connection
  • #4835 fcb554b @​pranaygp - Add optional Queue.registerRoute() and Queue.registerHandler(), implemented by @workflow/world-local and @workflow/world-postgres, so a queue consumer other than the Workflow SDK receives its own prefix's messages on its own route or in process. reenqueueActiveRuns() re-enqueues a run to the queue namespace it recorded, and @workflow/world-postgres keeps a job's queue prefix.
  • #4821 ebaa5b7 @​VaguelySerious - Implement the optional in-band writer fence and list snapshot in @workflow/world-local and @workflow/world-postgres, declared with the new inBandFence capability.
  • #4821 ebaa5b7 @​VaguelySerious - Report a message's cumulative deliveryCount across { timeoutSeconds } redeliveries on @workflow/world-postgres.
  • #4756 e631e78 @​pranaygp - Honor pagination.sortOrder in runs.list and steps.list, which always returned newest first.
  • #4821 ebaa5b7 @​VaguelySerious - Report deliveryCount and createdAt in queue handler meta on @workflow/world-local and @workflow/world-postgres.

@​workflow/world-vercel@​5.2.1

... (truncated)

Changelog

Sourced from workflow's changelog.

5.2.2

Patch Changes

5.2.1

Patch Changes

  • #4733 e6bd692 Thanks @​VaguelySerious! - Add InBandSupersededError and optional inBand/expectedSeqInBand event-create params for the in-band writer fence. @workflow/world-vercel forwards them, does not retry a fenced write in-process, and records the fence on its event spans. The runtime does not use them yet.
  • Updated dependencies [1342a96, 854242e, e6bd692, fcb554b, 73a6ca3, fcb554b]:
    • @​workflow/cli@​5.0.4
    • @​workflow/core@​5.2.1
    • @​workflow/errors@​5.0.4
    • @​workflow/utils@​5.0.2
    • @​workflow/next@​5.0.4
    • @​workflow/nitro@​5.0.4
    • @​workflow/typescript-plugin@​5.0.0
    • @​workflow/nest@​5.1.2
    • @​workflow/astro@​5.0.4
    • @​workflow/rollup@​5.0.4
    • @​workflow/sveltekit@​5.0.4
    • @​workflow/nuxt@​5.0.4

5.2.0

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump devalue and workflow in /apps/web
b495d25 
Bumps [devalue](https://github.com/sveltejs/devalue) to 6.0.3 and updates ancestor dependency [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow). These dependencies need to be updated together.


Updates `devalue` from 5.8.1 to 6.0.3
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.8.1...v6.0.3)

Updates `workflow` from 4.8.3 to 5.2.2
- [Release notes](https://github.com/vercel/workflow/releases)
- [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md)
- [Commits](https://github.com/vercel/workflow/commits/workflow@5.2.2/packages/workflow)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 6.0.3
  dependency-type: indirect
- dependency-name: workflow
  dependency-version: 5.2.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Litju as a code owner October 19, 2026 23:27
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026
@dependabot dependabot Bot mentioned this pull request Oct 19, 2026
Closed
@coderabbitai

coderabbitai Bot commented Oct 19, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 8dd9db38-f7d5-41b6-a1ff-427372c002b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Litju Litju Awaiting requested review from Litju Litju is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants