Repository navigation
fix: preserve Workflow 5 transport and current main compatibility - #2401
Draft
dependabot[bot] wants to merge 10 commits into
Draft
dependabot[bot] wants to merge 10 commits into
dependabot[bot] wants to merge 10 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check |  |
This assessment has not completed. The check will be retried on the next pre-merge check run. | |
| Description check | |
This assessment has not completed. The check will be retried on the next pre-merge check run. |
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency ReviewThe following issues were found:
|
groupthinking
requested changes
Oct 28, 2026
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Review at head ad08e519: this PR changes apps/web/package.json without updating the root package-lock.json, and current-head build, lint, and frontend test checks fail. Reconcile the workspace lockfile with the manifest, then rerun the checks before approval.
Bumps [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow) from 4.8.15 to 5.2.3. - [Release notes](https://github.com/vercel/workflow/releases) - [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md) - [Commits](https://github.com/vercel/workflow/commits/workflow@5.2.3/packages/workflow) --- updated-dependencies: - dependency-name: workflow dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/apps/web/workflow-5.1.0
branch
from
October 28, 2026 07:44
ad08e51 to
a2acf24
Compare
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
🔍 PR Validation |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Oct 28, 2026
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at eee3cb393cf17ddf4673ab72169405ec8c99b941: the earlier requested change is addressed. The web workflow 5.2.3 declaration and root lockfile now agree, and current hosted build, lint, frontend tests, and issue-link checks pass. The code handles Workflow 5's changed fetch paths for string URLs versus Request inputs, and regression tests cover both paths and idempotence. A clean npm install, focused tests, the web suite (1,522 passed, 28 skipped), lint, type check, and production build passed locally. There are no open inline review threads.
I approve the code at this head. This is not a merge recommendation: the shared dependency-review evidence job still fails, and a real Vercel durable Video Pack run has not been verified. Keep this PR open until those checks are satisfied. The older #2345 targets the same Workflow 5.2.3 upgrade and should remain open until this replacement is accepted.
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Oct 29, 2026
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Code review at exact head bbff05c2d5cf3037b011feeff0e9aa9243c6c331: the web Workflow 5.2.3 declaration and root lockfile agree, the Workflow fetch patch handles string URLs and Request inputs with regression coverage, and the scoped security overrides move Workflow zod to 4.6.6, body-parser to 2.4.0, and qs to 6.17.1. Clean install, focused 64-test suite, web TypeScript/lint and production build passed locally. Current hosted checks are 27 successful and 3 skipped, with no failures or open review threads. The current dependency artifact has a warning-free, independently matched 235-row comparison and no added vulnerability entries. I approve the code and dependency fix at this head.
This approval is not a merge recommendation. The prior exact-preview Video Pack run started and persisted through Workflow 5.2.3 but ended with Gemini 429 daily quota, so it did not produce a ready pack. A successful live Video Pack outcome is still unverified; issue #2429 remains open.
Contributor
Author
|
A newer version of workflow exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
This was referenced Nov 2, 2026
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
groupthinking
previously approved these changes
Nov 11, 2026
groupthinking
left a comment
Owner
There was a problem hiding this comment.
Reviewed exact head 3cd7a26ef9c55471dae7c362b6cd4093a9072019 against main 67bf5f1ed600261f4739ca679c00cb80f50e4f5f. The original manifest/lock mismatch and failing build, lint and frontend checks are repaired. Workflow 5.2.3 uses its owning Undici 7.30.1 transport; the application retains Undici 8.12.4 and current main authentication, quota, billing, Studio flag and Stripe.js behavior. The installed transport regression covers successful body/headers, typed 503 failure and bounded timeout, with an unpatched negative control.
Current-head hosted frontend tests pass 1,576 cases with one skip; build generates 47 pages, Docker and 21 preflight checks pass, E2E passes 16 cases, and both Python jobs pass. The dependency artifact was independently matched against all 181 complete typed comparison rows and all 102 lock changes. Latest checks have 27 successes and three skips, including the updated-description validation; no open review threads remain.
The missing live extraction proof is now observed: exact preview deployment dpl_6uupMSENS2uyVwdmSAdDx3YaJG7r ran wrun_41M74G2GSH0GNR3GQCJMK68WEF with Workflow core 5.2.3 and persisted a successful NASA sample pack. Two independent GETs returned the identical complete pack. Its ten narrated passages match official NASA captions in meaning, with the disclosed minor wording variation.
I approve this code and dependency repair. Limits remain explicit in the description: full audit is 0 critical/10 high/34 moderate with no new primary advisory IDs compared with the audited main; timed-out Python scans leave incomplete transitive coverage. This live test proves extraction and persistence for one sample, not application generation: grounded_spec remains source-unavailable, and generated visuals/follow-up suggestions were not independently certified or executed. This review does not merge the PR, waive remaining findings or deploy production.
groupthinking
marked this pull request as draft
November 13, 2026 01:37
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Workflow 5.2.3 retains its owning Undici transport while preserving the current Gemini SDK, dependency security floors, authentication, quota, billing, feature flag and Stripe integration. Integration head:
4df5fd2cfe2217ead201bf1b2d94641159cbe2fd, tree526b5f22b77df61636af9aa625b1681bf115233c(GitHub/local exact match).Resolved the root manifest and lockfile conflicts against current main. Workflow's scoped Undici floor is now ^7.30.1; scoped Zod 4.6.6 and current main's broader overrides remain. Current main's runtime dependency scope flags and newer packages are retained. Relative to main, the diff is eight files: Workflow manifest/lock changes, transport patch and regressions, deferred workflow/api import, and the two branch deployment exclusions.
Current integration uses main
512a2558f73d6281b6a880548bedf140b7e30292. The history-preserving commit retains the prior PR head and that main as parents. Frozen installs used Node 24.22.1 and repository npm 10.8.0 withci --ignore-scripts --legacy-peer-deps --no-audit --no-fund; manifest and lockfile bytes stayed unchanged. The reviewed existing postinstall transport patch was run explicitly.Both root and app Vercel configurations use
git.deploymentEnabledwith this exact branch set false. This is a draft: do not merge or deploy. No live extraction, provider request, production mutation, security exception, or CI weakening was performed. Hosted checks on earlier heads are historical and do not certify this integration. Current-head CI and hosted build/security evidence are required before acceptance. Preview E2E may fail because preview deployment is intentionally disabled; preserve that gate.The full current dependency audit was not rerun; no clean-audit or clean-image claim is made.
Validation on this exact tree, November 12, 2026 (America/Chicago):
npm --workspace=apps/web test -- --maxWorkers=2: 1,569 passed, 28 skipped, 171 files; exit 0.npm --workspace=apps/web run type-check,npm --workspace=apps/web run lint,git diff --cached --check: exit 0.npm run build:webcompiled successfully, but final build acceptance is NOT VERIFIED. Automatic approval review blocked continuation because the build contacted Sentry ingest and could transmit telemetry/source-map/project data outside this testing scope. No bypass or retry was attempted.The earlier November 11 NASA preview extraction belongs to historical head 3cd7a26 and is not a live test of this integration. No new extraction was attempted.
Security dependency evidence