[core] Upgrade devalue to 6.0.3 by http-samc · Pull Request #4856 · vercel/workflow

http-samc · 2026-10-13T17:15:11Z

Bumps devalue 5.9.2 → 6.0.3 (catalog pin in pnpm-workspace.yaml + packages/core).

Why

6.0.3 ships sveltejs/devalue#217: stringify escapes strings via native JSON.stringify plus one regex pass instead of a per-character JS loop. Output is byte-identical; on JSON-shaped strings it is 2–3× faster (7 MB: 84 → 37 ms, 35 MB: 514 → 176 ms, measured locally). This is the dominant cost in start() argument serialization for large string inputs, which the /flow host pays on the caller's event loop.

Also picked up from 6.0.x: the no-escape fast path and quoted-key cache (6.0.1), unpaired-surrogate escaping so output survives UTF-8 transport (6.0.0), and the .js-extension type-import fix for nodenext (6.0.3).

6.0.0 breaking changes, checked

uneval replacer API changed to a tagged template — @workflow/core does not use uneval.
Node floor raised to 22.17 in 6.0.0, lowered back to >=18 in 6.0.3; this repo's engines are ^22 || ^24 either way.
devalue runs on the Node host only (quickjs-serde.ts operates on handles; there is no in-VM copy), so the QuickJS engine is unaffected.

Verification

Full @workflow/core unit suite on 6.0.3: 144 files, 3089 passed, 6 expected-fail (pre-existing), 1 skipped. tsc --noEmit clean. Lockfile diff is devalue-only.

Changeset: @workflow/core patch.

Picks up the native-JSON.stringify string escaping (sveltejs/devalue#217): 2-3x faster on multi-MB strings with many quotes, byte-identical output. 6.0.0's breaking changes are the uneval replacer API, which core does not use, and a Node floor that 6.0.3 lowered back to >=18. Co-Authored-By: Samarth Chitgopekar <67826352+http-samc@users.noreply.github.com>

vercel · 2026-10-13T17:15:19Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
example-nextjs-workflow-turbopack	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
example-nextjs-workflow-webpack	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
example-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-astro-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-express-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-fastify-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-hono-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-nestjs-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-nitro-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-nuxt-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-python-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-sveltekit-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-tanstack-start-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workbench-vite-workflow	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workflow-docs	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workflow-swc-playground	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workflow-tarballs	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC
workflow-web	Ready	Preview, v0	Oct 13, 2026 8:04pm UTC

socket-security · 2026-10-13T17:15:58Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/devalue@6.0.3

View full report

github-actions · 2026-10-13T17:22:51Z

🧪 E2E Test Results

✅ All tests passed

⚠️ Flaky E2E Tests (passed on retry)

These tests failed at least once and passed on a retry. A recurring entry here is a real race worth investigating.

a run can take over its own earlier hook (nextjs-webpack · local-dev / local / node / stable)
concurrent hook token conflict - two workflows cannot use the same hook token simultaneously (nuxt · local-dev / local / node / stable)
hookClaimOnlyMutexWorkflow - hook works as a pure run mutex without payload data (nextjs-webpack · local-dev / local / node / stable)
sleepingWorkflow via pages router (nextjs-webpack · local-dev / local / node / stable)
takes a retained token from a finished run without touching its log (nextjs-webpack · local-dev / local / node / stable)

🛠 Infra Events (absorbed by the harness)

Platform anomalies the e2e harness detected and worked around (e.g. a run the queue never picked up, replaced by a fresh run). Clustered timestamps indicate a backend blip; a steady drip indicates a platform issue worth escalating.

run-pickup-stall · runs app-generated source against a registered step (tanstack-start) · at 20:04:44Z · abandoned wrun_01M4VDVMW68W5WZG7S7F928K85
cold-start-warmup · suite warmup (tanstack-start) · at 20:04:45Z · abandoned wrun_01M4VDVMWBMX33T0QJTK0CV0FF
run-pickup-stall · AllInOneService.processNumber - static workflow method using sibling static step methods (nest) · at 20:06:58Z · abandoned wrun_01M4VDZQ9CNXGECJGFTHXAQ9ZV
run-pickup-stall · takes a retained token from a finished run without touching its log (nextjs-webpack) · at 20:11:18Z · abandoned wrun_01M4VE7NDE30VN8QNBJ3JA8Y4A
run-pickup-stall · hookClaimOnlyMutexWorkflow - hook works as a pure run mutex without payload data (nextjs-webpack) · at 20:12:48Z · abandoned wrun_01M4VEADA712KS1ZFYND1VJRG3
run-pickup-stall · plainModuleDoneHook resumed via plain API route (o2flow shape) (nextjs-webpack) · at 20:13:09Z · abandoned wrun_01M4VEB1V5REDJ3RD47PEFJ757

E2E Test Summary

Summary

	Passed	Skipped	Total
✅ ▲ Vercel Production	3982	878	4860
✅ 💻 Local Development	4669	551	5220
✅ 📦 Local Production	4669	551	5220
✅ 🐘 Local Postgres	4669	551	5220
✅ 🪟 Windows	348	12	360
✅ 🌐 Cross-language Conformance	68	87	155
✅ dynamic-runs	0	0	0
✅ vercel-http-transport	897	183	1080
✅ vercel-multi-region	27	0	27
✅ vercel-ws-transport	607	113	720
Total	19936	2926	22862

Details by Category

✅ ▲ Vercel Production

App	Passed	Skipped
✅ astro-node	145	35
✅ astro-quickjs	145	35
✅ example-node	145	35
✅ example-quickjs	145	35
✅ express-node	145	35
✅ express-quickjs	145	35
✅ fastify-node	145	35
✅ fastify-quickjs	145	35
✅ hono-node	145	35
✅ hono-quickjs	145	35
✅ nest-node	145	35
✅ nest-quickjs	145	35
✅ nextjs-turbopack-node	172	8
✅ nextjs-turbopack-quickjs	172	8
✅ nextjs-webpack-node	172	8
✅ nextjs-webpack-quickjs	172	8
✅ nitro-node	145	35
✅ nitro-quickjs	145	35
✅ nuxt-node	145	35
✅ nuxt-quickjs	145	35
✅ python-node	66	114
✅ sveltekit-node	164	16
✅ sveltekit-quickjs	164	16
✅ tanstack-start-node	145	35
✅ tanstack-start-quickjs	145	35
✅ vite-node	145	35
✅ vite-quickjs	145	35

✅ 💻 Local Development

App	Passed	Skipped
✅ astro-stable-node	151	29
✅ astro-stable-quickjs	151	29
✅ express-stable-node	151	29
✅ express-stable-quickjs	151	29
✅ fastify-stable-node	151	29
✅ fastify-stable-quickjs	151	29
✅ hono-stable-node	151	29
✅ hono-stable-quickjs	151	29
✅ nest-stable-node	151	29
✅ nest-stable-quickjs	151	29
✅ nextjs-turbopack-canary-node	179	1
✅ nextjs-turbopack-canary-quickjs	179	1
✅ nextjs-turbopack-quickjs-snapshot	179	1
✅ nextjs-turbopack-stable-node	179	1
✅ nextjs-turbopack-stable-quickjs	179	1
✅ nextjs-webpack-canary-node	179	1
✅ nextjs-webpack-canary-quickjs	179	1
✅ nextjs-webpack-stable-node	179	1
✅ nextjs-webpack-stable-quickjs	179	1
✅ nitro-stable-node	151	29
✅ nitro-stable-quickjs	151	29
✅ nuxt-stable-node	151	29
✅ nuxt-stable-quickjs	151	29
✅ sveltekit-stable-node	170	10
✅ sveltekit-stable-quickjs	170	10
✅ tanstack-start-node	151	29
✅ tanstack-start-quickjs	151	29
✅ vite-stable-node	151	29
✅ vite-stable-quickjs	151	29

✅ 📦 Local Production

App	Passed	Skipped
✅ astro-stable-node	151	29
✅ astro-stable-quickjs	151	29
✅ express-stable-node	151	29
✅ express-stable-quickjs	151	29
✅ fastify-stable-node	151	29
✅ fastify-stable-quickjs	151	29
✅ hono-stable-node	151	29
✅ hono-stable-quickjs	151	29
✅ nest-stable-node	151	29
✅ nest-stable-quickjs	151	29
✅ nextjs-turbopack-canary-node	179	1
✅ nextjs-turbopack-canary-quickjs	179	1
✅ nextjs-turbopack-quickjs-snapshot	179	1
✅ nextjs-turbopack-stable-node	179	1
✅ nextjs-turbopack-stable-quickjs	179	1
✅ nextjs-webpack-canary-node	179	1
✅ nextjs-webpack-canary-quickjs	179	1
✅ nextjs-webpack-stable-node	179	1
✅ nextjs-webpack-stable-quickjs	179	1
✅ nitro-stable-node	151	29
✅ nitro-stable-quickjs	151	29
✅ nuxt-stable-node	151	29
✅ nuxt-stable-quickjs	151	29
✅ sveltekit-stable-node	170	10
✅ sveltekit-stable-quickjs	170	10
✅ tanstack-start-node	151	29
✅ tanstack-start-quickjs	151	29
✅ vite-stable-node	151	29
✅ vite-stable-quickjs	151	29

✅ 🐘 Local Postgres

App	Passed	Skipped
✅ astro-stable-node	151	29
✅ astro-stable-quickjs	151	29
✅ express-stable-node	151	29
✅ express-stable-quickjs	151	29
✅ fastify-stable-node	151	29
✅ fastify-stable-quickjs	151	29
✅ hono-stable-node	151	29
✅ hono-stable-quickjs	151	29
✅ nest-stable-node	151	29
✅ nest-stable-quickjs	151	29
✅ nextjs-turbopack-canary-node	179	1
✅ nextjs-turbopack-canary-quickjs	179	1
✅ nextjs-turbopack-quickjs-snapshot	179	1
✅ nextjs-turbopack-stable-node	179	1
✅ nextjs-turbopack-stable-quickjs	179	1
✅ nextjs-webpack-canary-node	179	1
✅ nextjs-webpack-canary-quickjs	179	1
✅ nextjs-webpack-stable-node	179	1
✅ nextjs-webpack-stable-quickjs	179	1
✅ nitro-stable-node	151	29
✅ nitro-stable-quickjs	151	29
✅ nuxt-stable-node	151	29
✅ nuxt-stable-quickjs	151	29
✅ sveltekit-stable-node	170	10
✅ sveltekit-stable-quickjs	170	10
✅ tanstack-start-node	151	29
✅ tanstack-start-quickjs	151	29
✅ vite-stable-node	151	29
✅ vite-stable-quickjs	151	29

✅ 🪟 Windows

App	Passed	Failed	Skipped
✅ nextjs-turbopack-node	174	0	6
✅ nextjs-turbopack-quickjs	174	0	6

✅ 🌐 Cross-language Conformance

App	Passed	Failed	Skipped
✅ python	68	0	87

✅ dynamic-runs

App	Passed	Failed	Skipped
✅ astro-vercel	0	0	0
✅ example-vercel	0	0	0
✅ express-vercel	0	0	0
✅ fastify-vercel	0	0	0
✅ hono-vercel	0	0	0
✅ nest-vercel	0	0	0
✅ nextjs-turbopack-vercel	0	0	0
✅ nextjs-webpack-vercel	0	0	0
✅ nitro-vercel	0	0	0
✅ nuxt-vercel	0	0	0
✅ sveltekit-vercel	0	0	0
✅ tanstack-start-vercel	0	0	0
✅ vite-vercel	0	0	0

✅ vercel-http-transport

App	Passed	Skipped
✅ example	145	35
✅ express	145	35
✅ hono	145	35
✅ nextjs-turbopack	172	8
✅ nitro	145	35
✅ vite	145	35

✅ vercel-multi-region

App	Passed	Failed	Skipped
✅ nextjs-turbopack	27	0	0

✅ vercel-ws-transport

App	Passed	Skipped
✅ example	145	35
✅ express	145	35
✅ nextjs-turbopack	172	8
✅ vite	145	35

📋 View full workflow run

github-actions · 2026-10-13T17:22:53Z

📊 Workflow Benchmarks

commit ad9ae7c · Tue, 13 Oct 2026 20:17:26 GMT · run logs

Backend: vercel · app: nextjs-turbopack

Metric	Scenario	Best (ms)	P75 (ms)	P90 (ms)	P99 (ms)	Samples
TTFS	step	412 (-62%) 💚	2072 🔴 (+27%) 🔻	2125 🔴 (+5.9%)	2228 🔴 (-5.7%)	30
TTFS	stream	1650 (+20%) 🔻	2076 🔴 (+42%) 🔻	2095 🔴 (+43%) 🔻	2140 🔴 (+41%) 🔻	30
TTFS	hook + stream	2251 (+39%) 🔻	2353 🔴 (+36%) 🔻	2394 🔴 (+35%) 🔻	5617 🔴 (+171%) 🔻	30
Fan-out TTFS	Promise.all(100 steps)	565 (+2.2%)	754 (-1.2%)	816 (+3.8%)	2801 (+60%) 🔻	10
Fan-out TTLS	Promise.all(100 steps)	1816 (-18%) 💚	4068 (+7.4%)	4703 (+9.2%)	8086 (+32%) 🔻	10
STSO	1020 steps (inline)	98 (+29%) 🔻	127 (+32%) 🔻	145 (+28%) 🔻	176 (-13%)	1019
WO	1020 steps	125064 (+27%) 🔻	125064 (+27%) 🔻	125064 (+27%) 🔻	125064 (+27%) 🔻	1

📈 STSO distribution vs main (inline / queue-hop histograms)

1020 steps (inline)

Cumulative STSO time: main 97617ms → this run 124725ms (Δ +27108ms, +28%)

 50-100 ms  ┃███████████████████      main 805  this   2  -803
100-150 ms  █████░░░░░░░░░░░░░░░░░░┃  main 193  this 948  +755
150-200 ms  █┃                        main  10  this  63   +53
200-250 ms  ┃                         main   5  this   4    -1
250-300 ms  ┃                         main   2  this   0    -2
300-350 ms  ┃                         main   1  this   2    +1
350-400 ms  ┃                         main   1  this   0    -1
400-450 ms  ┃                         main   1  this   0    -1
650-700 ms  ┃                         main   1  this   0    -1

📜 Previous results (1)

`94f7bb6`

Tue, 13 Oct 2026 17:32:24 GMT · run logs

vercel / nextjs-turbopack

Metric	Scenario	Best (ms)	P75 (ms)	P90 (ms)	P99 (ms)	Samples
TTFS	step	411 (-77%) 💚	1916 🔴 (-4.4%)	1989 🔴 (-3.7%)	2275 🔴 (-3.2%)	30
TTFS	stream	1679 (-2.4%)	1930 🔴 (-3.8%)	1983 🔴 (-2.4%)	2082 🔴 (±0%)	30
TTFS	hook + stream	1704 (-15%)	2195 🔴 (-3.2%)	2230 🔴 (-6.5%)	2537 🔴 (+0.8%)	30
Fan-out TTFS	Promise.all(100 steps)	489 (-5.8%)	637 (-34%) 💚	770 (-47%) 💚	2262 (+3.8%)	10
Fan-out TTLS	Promise.all(100 steps)	2220 (+16%) 🔻	2662 (-32%) 💚	4221 (-21%) 💚	7706 (+11%)	10
STSO	1020 steps (inline)	62 (-27%) 💚	108 (+3.8%)	125 (-3.8%)	160 (-50%) 💚	1019
WO	1020 steps	108730 (-1.2%)	108730 (-1.2%)	108730 (-1.2%)	108730 (-1.2%)	1

ℹ️ Metric definitions & methodology

_{The collapsed STSO distribution section above buckets every step gap, split inline (same warm process — pure framework overhead) vs queue-hop (fresh process — dispatch, reinit, replay). █ = main, ┃ = this run, ░ = fill.}

_{Best/P75/P90/P99 deltas compare against the most recent benchmark run on main at the time of this run. 🔻 flags a delta worse than +15%, 💚 one better than −15%.}

_{Metrics — TTFS: time to first step body (in-deployment start() → first step body) · Fan-out TTFS: fan-out time to first step (in-deployment start() → first of the parallel step bodies to complete) · Fan-out TTLS: fan-out time to last step (in-deployment start() → last of the parallel step bodies to complete, i.e. when the Promise.all resolves) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored)}

_{Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · Promise.all(100 steps): 100 trivial no-op steps started together in a single Promise.all; Fan-out TTFS is the first of them to complete and Fan-out TTLS the last, both from the in-deployment clientStart, so their gap is the spread the runtime adds across the fan-out}

_{🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600}

_{All timestamps are deployment-side; runs are triggered in-deployment, so the CI runner and api.vercel.com sit outside every measured window. TTFS = start() → first step body (includes dispatch + any cold start); Fan-out TTFS/TTLS = first/last step completion of one Promise.all from the same anchor (the gap is the runtime’s fan-out spread); STSO/WO between step bodies. Streaming delivery performance is measured in durabench.}

_{Cold starts stay in the numbers (real bursty-workload latency, inflates P75+); Best is the warm floor.}

github-actions · 2026-10-13T17:23:06Z

Sim World

Simulated world deterministic testing for races. Traces

🟢 world-sim scenario book — 0 fail of 42 total

fence=per-spec

scenario	outcome	events	virt	replay
✅ `smoke-no-steps`	completed	3	0ms	ok
✅ `smoke-one-step`	completed	6	0ms	ok
✅ `hook-at-step-started`	completed	12	0ms	ok
✅ `hook-at-step-completed`	completed	12	0ms	ok
✅ `hook-at-hook-created`	completed	12	0ms	ok
✅ `deadline-hook-wins`	completed	7	1.0h	ok
✅ `deadline-expires`	completed	7	1.0h	ok
✅ `step-vs-timer-early-settlement`	completed	8	1.0h	ok
✅ `long-sleep`	completed	11	30.0d	ok
✅ `hook-never-arrives`	stalled	3	0ms	skipped
✅ `step-retries-twice`	completed	10	2.0s	ok
✅ `parallel-steps`	completed	9	0ms	ok
✅ `hook-on-execution-state`	completed	12	0ms	ok
✅ `peek-hook-before-branch`	completed	12	0ms	ok
✅ `peek-hook-after-branch`	completed	12	0ms	ok
✅ `peek-hook-at-registration`	completed	12	0ms	ok
✅ `race-hook-before-probe`	completed	12	0ms	ok
✅ `race-hook-after-probe`	completed	12	0ms	ok
✅ `race-duplicate-delivery`	completed	13	0ms	ok
✅ `attr-hook-before-step`	completed	11	0ms	ok
✅ `attr-hook-after-step`	completed	11	0ms	ok
✅ `attr-from-step-body`	completed	13	0ms	ok
✅ `fork-hook-after-timeout`	completed	14	1.0m	ok
✅ `fork-hook-before-timeout`	completed	14	1.0m	ok
✅ `count-hook-after-timeout`	completed	17	1.0m	ok
✅ `count-hook-before-timeout`	completed	20	1.0m	ok
✅ `stale-read-step-count-fork`	completed	20	1.0m	ok
✅ `stale-read-equal-step-counts`	completed	14	1.0m	ok
✅ `step-vs-step-fork`	completed	12	0ms	ok
✅ `step-vs-step-fork-fenced`	completed	12	0ms	ok
✅ `fence-catches-benign-direction`	completed	12	5ms	ok
✅ `in-flight-before-decision`	completed	17	1.0m	ok
✅ `in-flight-before-decision-counted`	completed	17	1.0m	ok
✅ `in-flight-after-decision`	completed	19	2.0m	ok
✅ `stale-read-step-count-fork-fenced`	completed	20	1.0m	ok
✅ `fork-hook-wins`	completed	13	1.0m	ok
✅ `fork-timeout-wins`	completed	13	1.0m	ok
✅ `unclaimed-payload-under-fork`	completed	17	1.0m	ok
✅ `claimed-payload-under-fork`	completed	17	1.0m	ok
✅ `writers-independent-step-bodies`	completed	12	0ms	ok
✅ `writers-scripted-tempo`	completed	12	0ms	ok
✅ `cancel-mid-step`	cancelled	7	0ms	skipped

Full trace: world-sim.txt

github-actions · 2026-10-13T17:28:14Z

Framework	Flow route	Step reg.	Framework output
hono	267.4 KiB (±0)	95.5 KiB (±0)	1.99 MiB (+685 B)
nextjs-turbopack	274.8 KiB (±0)	426 B (±0)	971.7 KiB (+286 B)

About these numbers

Sizes are gzip; parentheses show the change against main.
Flow route and Step reg. gate this job, on raw bytes rather than the gzip shown, at max(2%, 50.0 KiB). Framework output is informational.

ad9ae7c · run

VaguelySerious

(AI) Preliminary review: AI review: blocking issues found

VaguelySerious · 2026-10-13T17:32:46Z

  '@opentelemetry/api': 1.9.1
  rfc6902: 5.1.2
-  devalue: 5.9.2
+  devalue: 6.0.3


AI Review: Blocking

This is a workspace-wide overrides entry, not a catalog pin, so it forces devalue 6 onto every in-repo consumer, not only @workflow/core. @sveltejs/kit, svelte, astro, and nuxt all declare devalue: ^5.8.1, and kit, svelte, and astro call uneval(value, replacer) with the 5.x contract (the replacer returns a JS string, or uses its second argument as a nested uneval). On 6.x a string result throws TypeError: Invalid JavaScript fragment, and the second argument is now the js tag, so calling it as a function throws.

I reproduced this in workbench/sveltekit with a throwaway route whose +page.server.ts load returns { now: 'sync', later: new Promise(...) } (streamed data), then ran pnpm build and node build:

PR branch (devalue 6.0.3): the server logs [500] GET /zz-devalue-stream and TypeError: Cannot read properties of undefined (reading 'slice') from add_node. That's kit's error handler reading .path off the non-DevalueError. The page renders the 500 page.

main (devalue 5.9.2): 200, and both the sync value and the streamed value render.

The same code path is hit by transport hooks, Svelte's hydratable, and Astro content collections with URL or asset data. The current workbench pages don't use any of these, so CI probably stays green, but the next test or page that does will fail with a confusing error.

Scoping the bump fixes it. I verified both options keep core on 6.0.3 and kit on 5.9.2, and with the first one the streaming route returns 200 again:

'devalue@^5': 5.9.2

or

devalue: 5.9.2 '@workflow/core>devalue': 6.0.3

This only affects the repo's own install. Published @workflow/core resolves its own exact devalue@6.0.3 next to a user's framework copy, so apps aren't affected.

AI Review: Note

Fixed in ad9ae7c: the override is now 'devalue@^5': 5.9.2, so SvelteKit, Svelte, Astro and Nuxt stay on 5.9.2 and @workflow/core resolves its own 6.0.3 pin. I rebuilt workbench/sveltekit with the streamed-load route and it returns 200 again, with both values rendered.

VaguelySerious · 2026-10-13T17:32:46Z

+'@workflow/core': patch
+---
+
+Upgrade devalue to 6.0.3, which escapes large strings with native `JSON.stringify` instead of a per-character loop.


AI Review: Note

There's one behavior change users can observe, and it might be worth mentioning in the changeset. A lone surrogate in a serialized value (for example 'a\ud800b' as a start() argument) used to come back as a\uFFFDb after the UTF-8 round trip. On 6.0.3 it round-trips exactly. I checked this with dehydrateWorkflowArguments → hydrateWorkflowArguments from dist under each devalue version.

Cross-version compat looks fine. Payloads written with 5.9.2 (plain, Map/Set/Date/BigInt/RegExp/URL/-0/NaN, typed arrays/Buffer, Error, sparse and cyclic arrays, a 4.8 MB escape-heavy string) are byte-identical under 6.0.3 and hydrate on both versions in both directions. Old payloads that contain U+FFFD are already lossy and stay that way. A small unit test that pins the lone-surrogate round trip would guard the new behavior.

AI Review: Note

Fixed in ad9ae7c: the changeset now mentions the unpaired-surrogate change, and serialization.test.ts has a round-trip regression test. The test fails on 5.9.2 (a\ufffdb) and passes on 6.0.3.

The workspace-wide `devalue: 6.0.3` override forced devalue 6 onto SvelteKit, Svelte, Astro and Nuxt, which depend on `devalue: ^5` and call `uneval` with string-returning replacers that devalue 6 rejects (e.g. SvelteKit streamed `load` data returned a 500). Narrow the override to `devalue@^5` so frameworks stay on 5.9.2 while core keeps its own 6.0.3 pin. Also note the unpaired-surrogate round-trip change in the changeset and add a regression test for it. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: Peter Wielander <29887157+VaguelySerious@users.noreply.github.com>

changeset-bot · 2026-10-13T19:58:14Z

🦋 Changeset detected

Latest commit: ad9ae7c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 17 packages

Name	Type
@workflow/core	Patch
@workflow/builders	Patch
@workflow/cli	Patch
@workflow/next	Patch
@workflow/nitro	Patch
@workflow/vitest	Patch
@workflow/web-shared	Patch
@workflow/web	Patch
workflow	Patch
@workflow/world-testing	Patch
@workflow/astro	Patch
@workflow/nest	Patch
@workflow/rollup	Patch
@workflow/sveltekit	Patch
@workflow/vite	Patch
@workflow/nuxt	Patch
@workflow/world-vercel	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

VaguelySerious

AI review: no blocking issues

github-actions · 2026-10-13T21:11:12Z

No backport to stable for a04ecaa (AI decision).

This is a major-version dependency bump (devalue 5.9.2 → 6.0.3) whose stated motivation is performance — faster string escaping in stringify — not a vulnerability or a defect affecting stable, which puts it in the "routine dependency bump / performance optimization" category. It also carries devalue 6.0.0's breaking changes and a new workspace override scoping rule, which is exactly the kind of churn a maintenance line exists to avoid. The incidental unpaired-surrogate round-trip correction (previously replaced with U+FFFD) is the one fix-shaped part; if that corruption is considered material for 4.x users, a human can force this through via workflow_dispatch.

To override, re-run the Backport to stable workflow manually via workflow_dispatch and paste this commit SHA into the ref input:

a04ecaa6475ab729e8d0a445b00bef1490969658

Catches the docs up with SDK changes that shipped in the last day without (complete) docs updates. | Change | Source PR | Docs edit | | --- | --- | --- | | QuickJS runs with snapshotting are exempt from the default per-run event limit on the Local and Vercel Worlds, and `MAX_EVENTS_EXCEEDED` / `REPLAY_TIMEOUT` now have their own error pages | #4870 | The error-code table in Errors and retries, the log-growth note in Event sourcing, and the event-limit row in What's new now mention the QuickJS exemption and link to the new error pages. #4870 updated the errors index, Runtime tuning, Worlds, and Vercel World pages but not these | I reviewed the other PRs from the last day and they need no further docs: removing the experimental resilient step dispatch (#4818) updated its own docs and the variable no longer appears outside changelogs, the `setAttributes()` delivery-order fix (#4861) and terminal-inert replay (#4819) are bug fixes, reading step creation from `step_started` (#4866) is reader-side forward compatibility with no user-facing change yet, and the devalue upgrade (#4856), dependency bumps, and Version Packages PRs aren't documented behavior. The Workflows pricing and limits page in `vercel/front` gets the matching event-limit note in vercel/front#91076. ## Docs Preview | Page | Preview | | --- | --- | | Errors and retries | [Error codes](https://workflow-docs-git-workflow-docs-cleanup-wed-14-oct.vercel.sh/docs/foundations/errors-and-retries) | | Event sourcing | [How fast a log grows](https://workflow-docs-git-workflow-docs-cleanup-wed-14-oct.vercel.sh/docs/how-it-works/event-sourcing#how-fast-a-log-grows) | | What's new | [Breaking changes: Application code](https://workflow-docs-git-workflow-docs-cleanup-wed-14-oct.vercel.sh/docs/whats-new#application-code) | 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com> Co-authored-by: Pranay Prakash <1797812+pranaygp@users.noreply.github.com>

http-samc marked this pull request as ready for review October 13, 2026 17:16

http-samc requested a review from a team as a code owner October 13, 2026 17:16

vercel Bot deployed to Preview – workflow-docs October 13, 2026 17:17

View deployment

vercel Bot reviewed Oct 13, 2026

View reviewed changes

Comment thread pnpm-workspace.yaml Resolved

VaguelySerious reviewed Oct 13, 2026

View reviewed changes

VaguelySerious approved these changes Oct 13, 2026

View reviewed changes

vercel Bot deployed to Preview – workflow-docs October 13, 2026 20:02

View deployment

http-samc enabled auto-merge (squash) October 13, 2026 20:58

http-samc merged commit a04ecaa into main Oct 13, 2026
325 of 331 checks passed

http-samc deleted the bump-devalue-6 branch October 13, 2026 21:05

github-actions Bot mentioned this pull request Oct 13, 2026

Version Packages #4847

Merged

pranaygp mentioned this pull request Oct 14, 2026

[docs] Catch up docs with recently shipped SDK changes #4880

Merged

Conversation

http-samc commented Oct 13, 2026

Why

6.0.0 breaking changes, checked

Verification

Uh oh!

vercel Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 E2E Test Results

⚠️ Flaky E2E Tests (passed on retry)

🛠 Infra Events (absorbed by the harness)

E2E Test Summary

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Workflow Benchmarks

94f7bb6

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sim World

Uh oh!

Uh oh!

github-actions Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

VaguelySerious left a comment

Choose a reason for hiding this comment

Uh oh!

VaguelySerious Oct 13, 2026

Choose a reason for hiding this comment

AI Review: Blocking

Uh oh!

VaguelySerious Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

VaguelySerious Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

VaguelySerious Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

changeset-bot Bot commented Oct 13, 2026

🦋 Changeset detected

Uh oh!

VaguelySerious left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Oct 13, 2026 •

edited

Loading

socket-security Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading

`94f7bb6`

github-actions Bot commented Oct 13, 2026 •

edited

Loading

github-actions Bot commented Oct 13, 2026 •

edited

Loading