Skip to content

[deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 - #4738

Merged
TooTallNate merged 4 commits into
mainfrom
naterajlich/astro-7-2-10
Oct 8, 2026
Merged

[deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2#4738
TooTallNate merged 4 commits into
mainfrom
naterajlich/astro-7-2-10

Conversation

@TooTallNate

@TooTallNate TooTallNate commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Bumps astro from 7.0.6 to 7.2.10, the latest 7.2.x release, to fix GHSA-26w7-cxv4-gfx2: critical remote code execution through AVIF image optimization, affecting < 7.2.8.

  • packages/astro: devDependency 7.0.6 → 7.2.10. The published package doesn't depend on astro, so the changeset is empty.
  • workbench/astro:
    • astro ^7.0.6 → ^7.2.10
    • @astrojs/node 11.0.2 → 11.1.5. 11.0.2's standalone entry crashes on astro 7.2 at startup (Cannot read properties of undefined (reading 'getLogger')). 11.1.x requires astro ^7.2.1, and 11.1.5 was released alongside astro 7.2.10.
    • @astrojs/vercel ^11.0.2 → ^11.0.9 (the release paired with astro 7.2.10). It resolves to 11.0.11 under the 48h release-age gate.

This also moves astro's transitive dependencies forward (sharp 0.34 → 0.35, @astrojs/compiler-rs 0.3 → 0.4, satteri 0.9 → 0.10).

Testing

  • pnpm turbo run build --filter @workflow/astro... --filter workflow... passes
  • workbench/astro builds, and the production server (scripts/start-with-pg.mjs) starts and serves requests
  • Ran a subset of packages/core/e2e/e2e.test.ts against the local production build: 56 passed, including the addTenWorkflow, sleeping, error handling, and hook tests

Copilot AI balanced review requested due to automatic review settings October 7, 2026 23:39
@TooTallNate
TooTallNate requested a review from a team as a code owner October 7, 2026 23:39
@changeset-bot

changeset-bot Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 6c53d16

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copilot AI reviewed Oct 7, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@vercel

vercel Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
example-nextjs-workflow-turbopack Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
example-nextjs-workflow-webpack Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
example-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-astro-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-express-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-fastify-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-hono-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-nestjs-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-nitro-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-nuxt-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-python-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-sveltekit-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-tanstack-start-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workbench-vite-workflow Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workflow-docs Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workflow-swc-playground Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workflow-tarballs Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC
workflow-web Ready Ready Preview, v0 Oct 8, 2026 6:42am UTC

@github-actions

github-actions Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Workflow Benchmarks

commit 6c53d16 · Thu, 08 Oct 2026 06:54:43 GMT · run logs

Backend: vercel · app: nextjs-turbopack

Metric Scenario Best (ms) P75 (ms) P90 (ms) P99 (ms) Samples
TTFS step 1844 (+32%) 🔻 2259 🔴 (+31%) 🔻 2326 🔴 (+19%) 🔻 2372 🔴 (+4.9%) 30
TTFS stream 1843 (+35%) 🔻 2248 🔴 (+43%) 🔻 2275 🔴 (+43%) 🔻 2302 🔴 (+43%) 🔻 30
TTFS hook + stream 2103 (+181%) 🔻 2215 🔴 (+20%) 🔻 2247 🔴 (+14%) 2268 🔴 (-40%) 💚 30
Fan-out TTFS Promise.all(100 steps) 599 (+29%) 🔻 816 (-6.2%) 887 (-7.6%) 2626 (+30%) 🔻 10
Fan-out TTLS Promise.all(100 steps) 2256 (+65%) 🔻 4230 (-36%) 💚 6020 (-28%) 💚 8358 (-7.1%) 10
STSO 1020 steps (inline) 86 (-5.5%) 104 (-6.3%) 123 (-4.7%) 173 (-30%) 💚 1019
WO 1020 steps 104979 (-7.9%) 104979 (-7.9%) 104979 (-7.9%) 104979 (-7.9%) 1
📈 STSO distribution vs main (inline / queue-hop histograms)

1020 steps (inline)

Cumulative STSO time: main 113656ms → this run 104669ms (Δ -8987ms, -8%)

 50-100 ms  ███████░░░░░░░░░░░░┃      main 231  this 633  +402
100-150 ms  ███████████┃████████████  main 747  this 360  -387
150-200 ms  ┃                         main  24  this  21    -3
200-250 ms  ┃                         main   7  this   4    -3
250-300 ms  ┃                         main   3  this   0    -3
300-350 ms  ┃                         main   2  this   1    -1
400-450 ms  ┃                         main   3  this   0    -3
550-600 ms  ┃                         main   1  this   0    -1
600-650 ms  ┃                         main   1  this   0    -1
📜 Previous results (2)

b547c75

Thu, 08 Oct 2026 06:26:17 GMT · run logs

vercel / nextjs-turbopack

Metric Scenario Best (ms) P75 (ms) P90 (ms) P99 (ms) Samples
TTFS step 1655 (+59%) 🔻 1959 🔴 (+34%) 🔻 1983 🔴 (+29%) 🔻 2039 🔴 (+10%) 30
TTFS stream 1753 (+28%) 🔻 1889 🔴 (+31%) 🔻 1899 🔴 (+31%) 🔻 1920 🔴 (+19%) 🔻 30
TTFS hook + stream 2077 (+28%) 🔻 2174 🔴 (+26%) 🔻 2212 🔴 (+21%) 🔻 2469 🔴 (-44%) 💚 30
Fan-out TTFS Promise.all(100 steps) 543 (+11%) 758 (-57%) 💚 1908 (+0.9%) 2303 (+12%) 10
Fan-out TTLS Promise.all(100 steps) 1411 (+16%) 🔻 6505 (+2.2%) 7114 (-3.0%) 9332 (+20%) 🔻 10
STSO 1020 steps (inline) 81 (+14%) 98 (-11%) 117 (-10%) 162 (-3.6%) 1019
WO 1020 steps 99380 (-12%) 99380 (-12%) 99380 (-12%) 99380 (-12%) 1

b8ba333

Wed, 07 Oct 2026 23:50:42 GMT · run logs

vercel / nextjs-turbopack

Metric Scenario Best (ms) P75 (ms) P90 (ms) P99 (ms) Samples
TTFS step 1536 (+527%) 🔻 1893 🔴 (+16%) 🔻 1922 🔴 (+15%) 1960 🔴 (+4.6%) 30
TTFS stream 1649 (+487%) 🔻 1858 🔴 (+30%) 🔻 1887 🔴 (+25%) 🔻 1915 🔴 (+14%) 30
TTFS hook + stream 1725 (+244%) 🔻 2186 🔴 (+26%) 🔻 2222 🔴 (+18%) 🔻 2482 🔴 (+25%) 🔻 30
Fan-out TTFS Promise.all(100 steps) 482 (-8.9%) 620 (-33%) 💚 691 (-29%) 💚 2098 (+13%) 10
Fan-out TTLS Promise.all(100 steps) 1605 (+8.0%) 3262 (-56%) 💚 4968 (-35%) 💚 7502 (-11%) 10
STSO 1020 steps (inline) 92 (+9.5%) 110 (-3.5%) 129 (-7.9%) 179 (-34%) 💚 1019
WO 1020 steps 111527 (-3.3%) 111527 (-3.3%) 111527 (-3.3%) 111527 (-3.3%) 1
ℹ️ Metric definitions & methodology

The collapsed STSO distribution section above buckets every step gap, split inline (same warm process — pure framework overhead) vs queue-hop (fresh process — dispatch, reinit, replay). █ = main, ┃ = this run, ░ = fill.

Best/P75/P90/P99 deltas compare against the most recent benchmark run on main at the time of this run. 🔻 flags a delta worse than +15%, 💚 one better than −15%.

Metrics — TTFS: time to first step body (in-deployment start() → first step body) · Fan-out TTFS: fan-out time to first step (in-deployment start() → first of the parallel step bodies to complete) · Fan-out TTLS: fan-out time to last step (in-deployment start() → last of the parallel step bodies to complete, i.e. when the Promise.all resolves) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored)

Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · Promise.all(100 steps): 100 trivial no-op steps started together in a single Promise.all; Fan-out TTFS is the first of them to complete and Fan-out TTLS the last, both from the in-deployment clientStart, so their gap is the spread the runtime adds across the fan-out

🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600

All timestamps are deployment-side; runs are triggered in-deployment, so the CI runner and api.vercel.com sit outside every measured window. TTFS = start() → first step body (includes dispatch + any cold start); Fan-out TTFS/TTLS = first/last step completion of one Promise.all from the same anchor (the gap is the runtime’s fan-out spread); STSO/WO between step bodies. Streaming delivery performance is measured in durabench.

Cold starts stay in the numbers (real bursty-workload latency, inflates P75+); Best is the warm floor.

@socket-security

socket-security Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​@​astrojs/​node@​11.0.2 ⏵ 11.1.5100 +1100 +1682 +197 +1100
Updatednpm/​@​astrojs/​vercel@​11.0.2 ⏵ 11.0.11100100 +283 +196 -1100
Updatednpm/​astro@​7.0.6 ⏵ 7.2.1098 +10100 +7588 +198100

View full report

@github-actions

github-actions Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

✅ All tests passed

⚠️ Flaky E2E Tests (passed on retry)

These tests failed at least once and passed on a retry. A recurring entry here is a real race worth investigating.

  • resumes in flight during the takeover are never lost: each lands in exactly one log (nextjs-webpack · local-dev / local / node / stable)

🛠 Infra Events (absorbed by the harness)

Platform anomalies the e2e harness detected and worked around (e.g. a run the queue never picked up, replaced by a fresh run). Clustered timestamps indicate a backend blip; a steady drip indicates a platform issue worth escalating.

  • run-pickup-stall · runs app-generated source against a registered step (tanstack-start) · at 06:45:02Z · abandoned wrun_01M4D43R6WQ5KW08G1V8H0GR4K
  • cold-start-warmup · suite warmup (tanstack-start) · at 06:45:03Z · abandoned wrun_01M4D43R75B96NH8HPQJ4HYFBG
  • run-pickup-stall · a chain of takeovers: each victim ends with HookForceClaimedError, deliveries follow the current owner (nextjs-webpack) · at 06:51:23Z · abandoned wrun_01M4D4FCFNA1EQJGN7XPHZXFS4

E2E Test Summary

Summary
Passed Failed Skipped Total
✅ ▲ Vercel Production 3982 0 878 4860
✅ 💻 Local Development 4669 0 551 5220
✅ 📦 Local Production 4669 0 551 5220
✅ 🐘 Local Postgres 4669 0 551 5220
✅ 🪟 Windows 348 0 12 360
✅ 🌐 Cross-language Conformance 68 0 87 155
✅ dynamic-runs 0 0 0 0
✅ vercel-http-transport 897 0 183 1080
✅ vercel-multi-region 27 0 0 27
✅ vercel-ws-transport 607 0 113 720
Total 19936 0 2926 22862
Details by Category

✅ ▲ Vercel Production

App Passed Failed Skipped
✅ astro-node 145 0 35
✅ astro-quickjs 145 0 35
✅ example-node 145 0 35
✅ example-quickjs 145 0 35
✅ express-node 145 0 35
✅ express-quickjs 145 0 35
✅ fastify-node 145 0 35
✅ fastify-quickjs 145 0 35
✅ hono-node 145 0 35
✅ hono-quickjs 145 0 35
✅ nest-node 145 0 35
✅ nest-quickjs 145 0 35
✅ nextjs-turbopack-node 172 0 8
✅ nextjs-turbopack-quickjs 172 0 8
✅ nextjs-webpack-node 172 0 8
✅ nextjs-webpack-quickjs 172 0 8
✅ nitro-node 145 0 35
✅ nitro-quickjs 145 0 35
✅ nuxt-node 145 0 35
✅ nuxt-quickjs 145 0 35
✅ python-node 66 0 114
✅ sveltekit-node 164 0 16
✅ sveltekit-quickjs 164 0 16
✅ tanstack-start-node 145 0 35
✅ tanstack-start-quickjs 145 0 35
✅ vite-node 145 0 35
✅ vite-quickjs 145 0 35

✅ 💻 Local Development

App Passed Failed Skipped
✅ astro-stable-node 151 0 29
✅ astro-stable-quickjs 151 0 29
✅ express-stable-node 151 0 29
✅ express-stable-quickjs 151 0 29
✅ fastify-stable-node 151 0 29
✅ fastify-stable-quickjs 151 0 29
✅ hono-stable-node 151 0 29
✅ hono-stable-quickjs 151 0 29
✅ nest-stable-node 151 0 29
✅ nest-stable-quickjs 151 0 29
✅ nextjs-turbopack-canary-node 179 0 1
✅ nextjs-turbopack-canary-quickjs 179 0 1
✅ nextjs-turbopack-quickjs-snapshot 179 0 1
✅ nextjs-turbopack-stable-node 179 0 1
✅ nextjs-turbopack-stable-quickjs 179 0 1
✅ nextjs-webpack-canary-node 179 0 1
✅ nextjs-webpack-canary-quickjs 179 0 1
✅ nextjs-webpack-stable-node 179 0 1
✅ nextjs-webpack-stable-quickjs 179 0 1
✅ nitro-stable-node 151 0 29
✅ nitro-stable-quickjs 151 0 29
✅ nuxt-stable-node 151 0 29
✅ nuxt-stable-quickjs 151 0 29
✅ sveltekit-stable-node 170 0 10
✅ sveltekit-stable-quickjs 170 0 10
✅ tanstack-start-node 151 0 29
✅ tanstack-start-quickjs 151 0 29
✅ vite-stable-node 151 0 29
✅ vite-stable-quickjs 151 0 29

✅ 📦 Local Production

App Passed Failed Skipped
✅ astro-stable-node 151 0 29
✅ astro-stable-quickjs 151 0 29
✅ express-stable-node 151 0 29
✅ express-stable-quickjs 151 0 29
✅ fastify-stable-node 151 0 29
✅ fastify-stable-quickjs 151 0 29
✅ hono-stable-node 151 0 29
✅ hono-stable-quickjs 151 0 29
✅ nest-stable-node 151 0 29
✅ nest-stable-quickjs 151 0 29
✅ nextjs-turbopack-canary-node 179 0 1
✅ nextjs-turbopack-canary-quickjs 179 0 1
✅ nextjs-turbopack-quickjs-snapshot 179 0 1
✅ nextjs-turbopack-stable-node 179 0 1
✅ nextjs-turbopack-stable-quickjs 179 0 1
✅ nextjs-webpack-canary-node 179 0 1
✅ nextjs-webpack-canary-quickjs 179 0 1
✅ nextjs-webpack-stable-node 179 0 1
✅ nextjs-webpack-stable-quickjs 179 0 1
✅ nitro-stable-node 151 0 29
✅ nitro-stable-quickjs 151 0 29
✅ nuxt-stable-node 151 0 29
✅ nuxt-stable-quickjs 151 0 29
✅ sveltekit-stable-node 170 0 10
✅ sveltekit-stable-quickjs 170 0 10
✅ tanstack-start-node 151 0 29
✅ tanstack-start-quickjs 151 0 29
✅ vite-stable-node 151 0 29
✅ vite-stable-quickjs 151 0 29

✅ 🐘 Local Postgres

App Passed Failed Skipped
✅ astro-stable-node 151 0 29
✅ astro-stable-quickjs 151 0 29
✅ express-stable-node 151 0 29
✅ express-stable-quickjs 151 0 29
✅ fastify-stable-node 151 0 29
✅ fastify-stable-quickjs 151 0 29
✅ hono-stable-node 151 0 29
✅ hono-stable-quickjs 151 0 29
✅ nest-stable-node 151 0 29
✅ nest-stable-quickjs 151 0 29
✅ nextjs-turbopack-canary-node 179 0 1
✅ nextjs-turbopack-canary-quickjs 179 0 1
✅ nextjs-turbopack-quickjs-snapshot 179 0 1
✅ nextjs-turbopack-stable-node 179 0 1
✅ nextjs-turbopack-stable-quickjs 179 0 1
✅ nextjs-webpack-canary-node 179 0 1
✅ nextjs-webpack-canary-quickjs 179 0 1
✅ nextjs-webpack-stable-node 179 0 1
✅ nextjs-webpack-stable-quickjs 179 0 1
✅ nitro-stable-node 151 0 29
✅ nitro-stable-quickjs 151 0 29
✅ nuxt-stable-node 151 0 29
✅ nuxt-stable-quickjs 151 0 29
✅ sveltekit-stable-node 170 0 10
✅ sveltekit-stable-quickjs 170 0 10
✅ tanstack-start-node 151 0 29
✅ tanstack-start-quickjs 151 0 29
✅ vite-stable-node 151 0 29
✅ vite-stable-quickjs 151 0 29

✅ 🪟 Windows

App Passed Failed Skipped
✅ nextjs-turbopack-node 174 0 6
✅ nextjs-turbopack-quickjs 174 0 6

✅ 🌐 Cross-language Conformance

App Passed Failed Skipped
✅ python 68 0 87

✅ dynamic-runs

App Passed Failed Skipped
✅ astro-vercel 0 0 0
✅ example-vercel 0 0 0
✅ express-vercel 0 0 0
✅ fastify-vercel 0 0 0
✅ hono-vercel 0 0 0
✅ nest-vercel 0 0 0
✅ nextjs-turbopack-vercel 0 0 0
✅ nextjs-webpack-vercel 0 0 0
✅ nitro-vercel 0 0 0
✅ nuxt-vercel 0 0 0
✅ sveltekit-vercel 0 0 0
✅ tanstack-start-vercel 0 0 0
✅ vite-vercel 0 0 0

✅ vercel-http-transport

App Passed Failed Skipped
✅ example 145 0 35
✅ express 145 0 35
✅ hono 145 0 35
✅ nextjs-turbopack 172 0 8
✅ nitro 145 0 35
✅ vite 145 0 35

✅ vercel-multi-region

App Passed Failed Skipped
✅ nextjs-turbopack 27 0 0

✅ vercel-ws-transport

App Passed Failed Skipped
✅ example 145 0 35
✅ express 145 0 35
✅ nextjs-turbopack 172 0 8
✅ vite 145 0 35

📋 View full workflow run

@github-actions

github-actions Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Sim World

Simulated world deterministic testing for races. Traces

🟠 world-sim scenario book — 1 fail of 42 total

fence=per-spec

scenario outcome events virt replay violations
✅ smoke-no-steps completed 3 0ms ok 0
✅ smoke-one-step completed 6 0ms ok 0
✅ hook-at-step-started completed 12 0ms ok 0
✅ hook-at-step-completed completed 12 0ms ok 0
✅ hook-at-hook-created completed 12 0ms ok 0
✅ deadline-hook-wins completed 7 1.0h ok 0
✅ deadline-expires completed 7 1.0h ok 0
✅ step-vs-timer-early-settlement completed 8 1.0h ok 0
✅ long-sleep completed 11 30.0d ok 0
✅ hook-never-arrives stalled 3 0ms skipped 0
✅ step-retries-twice completed 10 2.0s ok 0
✅ parallel-steps completed 9 0ms ok 0
✅ hook-on-execution-state completed 12 0ms ok 0
✅ peek-hook-before-branch completed 12 0ms ok 0
✅ peek-hook-after-branch completed 12 0ms ok 0
✅ peek-hook-at-registration completed 12 0ms ok 0
✅ race-hook-before-probe completed 12 0ms ok 0
✅ race-hook-after-probe completed 12 0ms ok 0
✅ race-duplicate-delivery completed 13 0ms ok 0
✅ attr-hook-before-step completed 11 0ms ok 0
✅ attr-hook-after-step completed 11 0ms ok 0
✅ attr-from-step-body completed 13 0ms ok 0
✅ fork-hook-after-timeout completed 14 1.0m ok 0
✅ fork-hook-before-timeout completed 14 1.0m ok 0
✅ count-hook-after-timeout completed 17 1.0m ok 0
✅ count-hook-before-timeout completed 20 1.0m ok 0
✅ stale-read-step-count-fork completed 20 1.0m ok 0
✅ stale-read-equal-step-counts completed 14 1.0m ok 0
✅ step-vs-step-fork completed 12 0ms ok 0
✅ step-vs-step-fork-fenced completed 12 0ms ok 0
✅ fence-catches-benign-direction completed 12 5ms ok 0
✅ in-flight-before-decision completed 17 1.0m ok 0
❌ in-flight-before-decision-counted completed 17 1.0m ok 0
✅ in-flight-after-decision completed 19 2.0m ok 0
✅ stale-read-step-count-fork-fenced completed 20 1.0m ok 0
✅ fork-hook-wins completed 13 1.0m ok 0
✅ fork-timeout-wins completed 13 1.0m ok 0
✅ unclaimed-payload-under-fork completed 17 1.0m ok 0
✅ claimed-payload-under-fork completed 17 1.0m ok 0
✅ writers-independent-step-bodies completed 12 0ms ok 0
✅ writers-scripted-tempo completed 12 0ms ok 0
✅ cancel-mid-step cancelled 7 0ms skipped 0

Full trace: world-sim.txt

@github-actions

github-actions Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
Framework Flow route Step reg. Framework output
hono 267.4 KiB (±0) 95.4 KiB (±0) 1.98 MiB (-3 B)
nextjs-turbopack 274.8 KiB (±0) 426 B (±0) 968.4 KiB (±0)
About these numbers

Sizes are gzip; parentheses show the change against main.
Flow route and Step reg. gate this job, on raw bytes rather than the gzip shown, at max(2%, 50.0 KiB). Framework output is informational.

6c53d16 · run

@TooTallNate
TooTallNate enabled auto-merge (squash) October 8, 2026 06:58
@TooTallNate
TooTallNate merged commit b5c1bc8 into main Oct 8, 2026
188 checks passed
@TooTallNate
TooTallNate deleted the naterajlich/astro-7-2-10 branch October 8, 2026 06:58
github-actions Bot added a commit that referenced this pull request Oct 8, 2026
@github-actions
[deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (#4738)
3c3f6db 
Bumps `astro` from 7.0.6 to 7.2.10, the latest 7.2.x release, to fix
**GHSA-26w7-cxv4-gfx2**: critical remote code execution through AVIF
image optimization, affecting `< 7.2.8`.

- `packages/astro`: devDependency `7.0.6` → `7.2.10`. The published
package doesn't depend on `astro`, so the changeset is empty.
- `workbench/astro`:
  - `astro` `^7.0.6` → `^7.2.10`
- `@astrojs/node` `11.0.2` → `11.1.5`. 11.0.2's standalone entry crashes
on astro 7.2 at startup (`Cannot read properties of undefined (reading
'getLogger')`). 11.1.x requires `astro ^7.2.1`, and 11.1.5 was released
alongside astro 7.2.10.
- `@astrojs/vercel` `^11.0.2` → `^11.0.9` (the release paired with astro
7.2.10). It resolves to 11.0.11 under the 48h release-age gate.

This also moves astro's transitive dependencies forward (`sharp` 0.34 →
0.35, `@astrojs/compiler-rs` 0.3 → 0.4, `satteri` 0.9 → 0.10).

- `pnpm turbo run build --filter @workflow/astro... --filter
workflow...` passes
- `workbench/astro` builds, and the production server
(`scripts/start-with-pg.mjs`) starts and serves requests
- Ran a subset of `packages/core/e2e/e2e.test.ts` against the local
production build: 56 passed, including the `addTenWorkflow`, sleeping,
error handling, and hook tests

Signed-off-by: Nathan Rajlich <n@n8.io>
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

Backport PR opened against stable: #4767. Merge conflicts were resolved by AI — please review carefully. (backport job run)

@github-actions github-actions Bot mentioned this pull request Oct 8, 2026
Merged
TooTallNate added a commit that referenced this pull request Oct 8, 2026
@github-actions @TooTallNate
Backport #4738: [deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (
65b7707 
#4767)

Automated backport of #4738 to `stable` ([backport job
run](https://github.com/vercel/workflow/actions/runs/37740634189)).

**AI recommendation:** This is a security dependency bump addressing
GHSA-26w7-cxv4-gfx2, a critical RCE in astro's AVIF image optimization
affecting `< 7.2.8`. Both affected paths exist on `stable` and still pin
the vulnerable version (`packages/astro` devDependency `astro` 7.0.6 and
`workbench/astro` `astro` ^7.0.6 / `@astrojs/node` 11.0.2 /
`@astrojs/vercel` ^11.0.2), so the fix applies there. The companion
`@astrojs/node`/`@astrojs/vercel` bumps are required for the workbench
to boot on astro 7.2, not separate feature work, and the changeset is
empty since no published package depends on astro.

Merge conflicts were resolved by AI ([opencode](https://opencode.ai)
with `anthropic/claude-opus-5`). **Please review the conflict resolution
carefully before merging.**

Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Nathan Rajlich <n@n8.io>
pranaygp added a commit that referenced this pull request Oct 8, 2026
@pranaygp
Merge origin/main into pgp/world-local-streams-list-race
c0235d1 
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* origin/main:
  [deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (#4738)
  [deps] Upgrade next to 16.3.8 for CVE-2026-94483 (#4737)
pranaygp added a commit that referenced this pull request Oct 8, 2026
@pranaygp
Merge main into pgp/world-postgres-steps-sort
ae409b0 
Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* origin/main:
  [deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (#4738)
  [deps] Upgrade next to 16.3.8 for CVE-2026-94483 (#4737)
pranaygp added a commit that referenced this pull request Oct 8, 2026
@pranaygp
Merge branch 'main' into pgp/world-postgres-utc-timestamps
ebb3d89 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* origin/main:
  [deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (#4738)
  [deps] Upgrade next to 16.3.8 for CVE-2026-94483 (#4737)
pranaygp added a commit that referenced this pull request Oct 8, 2026
@pranaygp
Merge branch 'main' into pgp/world-postgres-lease-renewal
901a4c6 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>

* origin/main:
  [deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (#4738)
  [deps] Upgrade next to 16.3.8 for CVE-2026-94483 (#4737)
pranaygp added a commit that referenced this pull request Oct 8, 2026
@pranaygp
Merge branch 'main' into pgp/world-postgres-start-scope
86a01ce 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* origin/main:
  [deps] Upgrade astro to 7.2.10 for GHSA-26w7-cxv4-gfx2 (#4738)
  [deps] Upgrade next to 16.3.8 for CVE-2026-94483 (#4737)
@pranaygp pranaygp mentioned this pull request Oct 8, 2026
Open

This branch was successfully deployed

1 active deployment
Preview – workflow-docs — 6c53d163 Deployed Oct 8, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySerious VaguelySerious VaguelySerious approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TooTallNate @VaguelySerious