Update all examples to workflow 5.0.1 by VaguelySerious · Pull Request #52 · vercel/workflow-examples

VaguelySerious · 2026-09-30T23:15:02Z

Updates all 17 examples from workflow 4.3.1 to 5.0.1, including the v5 code changes validated in #51.

workflow, @workflow/ai, @workflow/world-local, @workflow/world-postgres → 5.0.1. @workflow/swc-plugin stays at 5.0.0 (no 5.0.1 was published).
v5 code changes (cherry-picked from [DO NOT MERGE] Test all examples against workflow 5.0.0-beta.40 pre-release tarballs #51): await getWorld() in instrumentation, custom-adapter on the v5 standalone bundle layout, ffmpeg-processing requires rollup >= 4.62.4
Lockfiles regenerated (pnpm 10, matching Vercel builds)

5.0.1 includes the SDK fixes found while running these examples: the 5.x @workflow/ai publish (vercel/workflow#4548), errors with a read-only stack (vercel/workflow#4549), and nuxt dev (vercel/workflow#4551).

Fixes found by running every example on 5.0:

hono, ffmpeg-processing: nitro 3.0.1-alpha.1 → 3.0.260903-beta. On alpha.1, nitro dev tree-shakes the world registration and every start() throws "world runtime was not initialized".
tanstack-start: lockfile re-resolved. The previously pinned nitro-nightly build 404s the flow route, so runs stay pending.
postgres, flight-booking-app: workflow-postgres-setup was replaced by bootstrap in 5.0
birthday-card-generator, kitchen-sink: model IDs the AI Gateway no longer serves
hono: start script pointed at a nonexistent file

Verification

Each example was started locally, a workflow triggered, and the run checked to reach its expected terminal state (workflow inspect runs, or the Postgres table).

On 5.0.1:

All 17 install from the committed lockfiles (--frozen-lockfile) and build
Dev: nextjs, nuxt, hono, nitro, astro, sveltekit, tanstack-start, vite ✅ (nuxt dev was broken on 5.0.0)
Prod: nextjs, nuxt, hono, nitro, vite, tanstack-start ✅

On 5.0.0, with the same example code (not re-run on 5.0.1):

actors (two hook events, state count = 10), custom-adapter (bun, completes after webhook resume), postgres (world-postgres), ffmpeg-processing (dev + prod, m4a via Vercel Sandbox)
flight-booking-app (two chat turns via hook), ai-sdk-workflow-patterns (all 5 patterns), rag-agent (store + retrieve via pgvector), birthday-card-generator (through RSVP webhook, sleep, final step), kitchen-sink (in a scratch Next app; withCreateHook not run, needs a real OpenAI key)

astro and sveltekit build with Vercel adapters and have no local prod server.

Known issues (not fixed here)

rag-agent: db:migrate never creates the embeddings table (pre-existing; drizzle-kit push works around it).

Supersedes #51.

🤖 Generated with Claude Code

`getWorld()` returns a Promise<World> as of v5, so `getWorld().start?.()` no longer type-checks (and silently no-ops at runtime). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The example has no build script, so the earlier sweep never exercised it. Running it surfaced four v5 changes: - `flow.js` / `webhook.js` are now `flow.mjs` / `webhook.mjs`, ESM with named exports only, so the default imports resolved to undefined. - `step.js` became `__step_registrations.mjs`, an internal module that `flow.mjs` imports. The `POST /.well-known/workflow/v1/step` route is deleted rather than repointed. - The SWC plugin's `client` mode was removed and merged into `step`. - `@swc/core` and `@workflow/swc-plugin` were never declared. They resolved through bun's flat node_modules; under pnpm they do not. Verified end to end: the run starts, all steps execute, and the webhook link is issued. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The nitro build failed with "replacement content must be a string" from rollup's ImportExpression.render. It is a rollup 4.53.3 bug, reproducible only when @vercel/oidc 3.0.5 and 3.8.2 are both in the tree: rollup renders the dynamic imports in oidc 3.0.5's get-vercel-oidc-token.js while their target modules are assigned to no chunk, so a Module object reaches MagicString.overwrite instead of a string. The stale lockfile was holding rollup at 4.53.3 and @vercel/sandbox at 1.0.4 (whose ^3.0.5 oidc range was pinned to literally 3.0.5). Raising the rollup floor to ^4.62.4 encodes the actual constraint; the regenerated lockfile also floats sandbox to 1.10.2, which drops the 3.0.5 copy. The lockfile was regenerated against a scratch pnpm store so its tarball entries carry integrity hashes, which makes it installable again. No Workflow SDK change is involved: the example needs no source changes for v5, and relaxing world-vercel's @vercel/oidc pin does not fix it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Bumps workflow, @workflow/world-local, @workflow/world-postgres and @workflow/swc-plugin to 5.0.0 and refreshes lockfiles. @workflow/ai is pinned to 5.0.0-beta.16: the 5.0.0 version on npm is a stale publish that peers on workflow ^4.3.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel · 2026-09-30T23:15:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
birthday-card-generator	Ready	Preview, v0	Oct 1, 2026 11:08pm UTC
flight-booking-app	Ready	Preview, v0	Oct 1, 2026 11:08pm UTC

pnpm 11 ignores the package.json pnpm field and dropped the overrides block, breaking frozen installs on Vercel (pnpm 10). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel

Additional Suggestion:

README instrumentation.ts example calls getWorld().start?.() without awaiting getWorld(), so under workflow v5 the world is never started

socket-security · 2026-09-30T23:30:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
nitro-nightly@4.0.0-20251010-091516-7cafddba ⏵ 3.0.1-20260928-103646-f72e2ba6	^-30		^-1	⁺¹
@types/react-dom@19.3.0
@tanstack/devtools-vite@0.7.0 ⏵ 0.8.5	⁺¹		^-3	⁺¹
@tanstack/react-router-devtools@1.167.0 ⏵ 1.167.2			⁺⁶
@tanstack/router-plugin@1.168.18 ⏵ 1.168.42
@types/react@19.3.0
vitest@4.1.5 ⏵ 4.1.11	⁺¹	⁺²	⁺¹	⁺²
@tanstack/react-router-ssr-query@1.167.1 ⏵ 1.167.3			⁺⁵	⁺³
@types/node@22.20.4
nitro@3.0.260903-beta
vite@8.0.10 ⏵ 8.3.1	⁺¹	⁺¹⁸	⁺¹
tailwindcss@4.2.4 ⏵ 4.3.3
react@19.2.5 ⏵ 19.3.0	⁺¹		⁺¹
@workflow/ai@4.1.2 ⏵ 5.0.1	⁺¹³		⁺¹	⁺¹
@tailwindcss/typography@0.5.19 ⏵ 0.5.20
@tanstack/react-router@1.170.15 ⏵ 1.170.41	⁺¹		⁺⁴
@tanstack/react-start@1.168.25 ⏵ 1.168.60			⁺⁵	⁺¹
@tailwindcss/vite@4.2.4 ⏵ 4.3.3	⁺¹		⁺¹
@testing-library/react@16.3.2 ⏵ 16.3.3	⁺¹
@testing-library/dom@10.4.1 ⏵ 10.4.2	⁺¹
@vitejs/plugin-react@6.0.1 ⏵ 6.1.1			⁺¹
@tanstack/react-devtools@0.10.5 ⏵ 0.10.13			⁺⁵
react-dom@19.2.5 ⏵ 19.3.0			⁺¹
rollup@4.61.1 ⏵ 4.63.5	⁺¹
@workflow/world-postgres@4.1.4 ⏵ 5.0.1	⁺¹⁶		⁺¹	⁺¹
workflow@4.3.1 ⏵ 5.0.1			⁺¹⁵	⁺¹

View full report

- hono, ffmpeg-processing: bump nitro to 3.0.260903-beta. With 3.0.1-alpha.1, nitro dev tree-shakes workflow's world registration and every start() fails with "world runtime was not initialized". - tanstack-start: re-resolve the lockfile. The pinned nitro-nightly build 404s the workflow flow route, so runs stay pending. - postgres, flight-booking-app: workflow-postgres-setup moved to bootstrap. - birthday-card-generator, kitchen-sink: replace model IDs the AI Gateway no longer serves. - hono: start script pointed at a file nitro never emits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

5.0.1 publishes the 5.x @workflow/ai, fixes nuxt dev, and keeps step errors whose stack is read-only (postgres.js). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

socket-security · 2026-10-01T23:07:52Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	High CVE: npm `devalue`: stringifyAsync can cause an unhandled rejection despite a caught returned promise CVE: GHSA-x5rw-q4pp-hg5g devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise (HIGH) Affected versions: >= 5.8.0 < 5.9.3 Patched version: 5.9.3 From: tanstack-start/pnpm-lock.yaml → `npm/workflow@5.0.1` → `npm/devalue@5.9.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/devalue@5.9.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

VaguelySerious and others added 4 commits September 30, 2026 16:00

Await getWorld() before start() for v5

0b3a335

`getWorld()` returns a Promise<World> as of v5, so `getWorld().start?.()` no longer type-checks (and silently no-ops at runtime). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

vercel Bot deployed to Preview – birthday-card-generator September 30, 2026 23:15 View deployment

Regenerate pnpm lockfiles with pnpm 10

a64a63d

pnpm 11 ignores the package.json pnpm field and dropped the overrides block, breaking frozen installs on Vercel (pnpm 10). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel Bot reviewed Sep 30, 2026

View reviewed changes

Comment thread flight-booking-app/pnpm-lock.yaml

vercel Bot deployed to Preview – birthday-card-generator September 30, 2026 23:18 View deployment

vercel Bot deployed to Preview – flight-booking-app September 30, 2026 23:19 View deployment

vercel Bot deployed to Preview – birthday-card-generator October 1, 2026 00:42 View deployment

vercel Bot deployed to Preview – flight-booking-app October 1, 2026 00:42 View deployment

Update all examples to workflow 5.0.1

04b0b7d

5.0.1 publishes the 5.x @workflow/ai, fixes nuxt dev, and keeps step errors whose stack is read-only (postgres.js). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

VaguelySerious force-pushed the peter/workflow-5.0.0 branch from 0d957da to 04b0b7d Compare October 1, 2026 23:07

VaguelySerious changed the title ~~Update all examples to workflow 5.0.0~~ Update all examples to workflow 5.0.1 Oct 1, 2026

vercel Bot deployed to Preview – birthday-card-generator October 1, 2026 23:07 View deployment

vercel Bot deployed to Preview – flight-booking-app October 1, 2026 23:08 View deployment

VaguelySerious merged commit 00d6c08 into main Oct 1, 2026
7 checks passed

Navigation Menu

Repository navigation

Update all examples to workflow 5.0.1 - #52

Update all examples to workflow 5.0.1#52
VaguelySerious merged 7 commits into
mainfrom
peter/workflow-5.0.0

VaguelySerious commented Sep 30, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

vercel Bot left a comment

Uh oh!

Uh oh!

socket-security Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 1, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

VaguelySerious commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Verification

Known issues (not fixed here)

Uh oh!

vercel Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

socket-security Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 1, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

VaguelySerious commented Sep 30, 2026 •

edited

Loading

vercel Bot commented Sep 30, 2026 •

edited

Loading

socket-security Bot commented Sep 30, 2026 •

edited

Loading