Skip to content

[swc-playground] Update to Next.js v16.3.4 - #4018

Merged
TooTallNate merged 1 commit into
mainfrom
naterajlich/vuln-14177-dependency-vulnerability-next16211-in
Sep 8, 2026
Merged

TooTallNate merged 1 commit into
mainfrom
naterajlich/vuln-14177-dependency-vulnerability-next16211-in

Conversation

@TooTallNate

Copy link
Copy Markdown
Member

No description provided.

@TooTallNate
TooTallNate requested a review from a team as a code owner September 8, 2026 19:49
Copilot AI lite review requested due to automatic review settings September 8, 2026 19:49
@changeset-bot

changeset-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 59f2fbf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vercel

vercel Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
example-nextjs-workflow-turbopack Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
example-nextjs-workflow-webpack Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
example-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-astro-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-express-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-fastify-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-hono-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-nestjs-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-nitro-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-nuxt-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-python-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-sveltekit-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-tanstack-start-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workbench-vite-workflow Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workflow-docs Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workflow-swc-playground Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workflow-tarballs Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC
workflow-web Ready Ready Preview, v0 Sep 8, 2026 7:55pm UTC

@github-actions

github-actions Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

✅ All tests passed

⚠️ Flaky E2E Tests (passed on retry)

These tests failed at least once and passed on a retry. A recurring entry here is a real race worth investigating.

  • cancelRun via CLI - cancelling a running workflow (nextjs-turbopack)
  • cancelRun via CLI - cancelling a running workflow (nextjs-webpack)
  • cancelRun via CLI - cancelling a running workflow (nitro)
  • step-return-value serialization failure is catchable in workflow code (nextjs-turbopack)

🛠 Infra Events (absorbed by the harness)

Platform anomalies the e2e harness detected and worked around (e.g. a run the queue never picked up, replaced by a fresh run). Clustered timestamps indicate a backend blip; a steady drip indicates a platform issue worth escalating.

  • cold-start-warmup · suite warmup (tanstack-start) · at 19:56:54Z · abandoned wrun_01M219FRRYRF0YHDNV9QY5H9SN
  • run-pickup-stall · step-argument serialization failure is catchable in workflow code (nuxt) · at 19:57:51Z · abandoned wrun_01M219HWJB0B6THZ13B6J38ZFW
  • run-pickup-stall · Calculator.calculate - static workflow method using static step methods from another class (fastify) · at 19:58:08Z · abandoned wrun_01M219JD1TW1QE7ZSXARTMNHCT
  • run-pickup-stall · hookCleanupTestWorkflow - hook token reuse after workflow completion (nextjs-webpack) · at 20:00:58Z · abandoned wrun_01M219QK5YFM84THFKPRANFPF1
  • run-pickup-stall · concurrent hook token conflict - two workflows cannot use the same hook token simultaneously (nextjs-webpack) · at 20:01:01Z · abandoned wrun_01M219QNR0VDT67Z31YP0T6WKN

E2E Test Summary

Summary
Passed Failed Skipped Total
✅ ▲ Vercel Production 3636 0 684 4320
✅ 💻 Local Development 3922 0 558 4480
✅ 📦 Local Production 3922 0 558 4480
✅ 🐘 Local Postgres 3922 0 558 4480
✅ 🪟 Windows 320 0 0 320
✅ 🌐 Cross-language Conformance 68 0 73 141
✅ vercel-http-transport 817 0 143 960
✅ vercel-multi-region 27 0 0 27
✅ vercel-ws-transport 553 0 87 640
Total 17187 0 2661 19848
Details by Category

✅ ▲ Vercel Production

App Passed Failed Skipped
✅ astro-node 132 0 28
✅ astro-quickjs 132 0 28
✅ example-node 132 0 28
✅ example-quickjs 132 0 28
✅ express-node 132 0 28
✅ express-quickjs 132 0 28
✅ fastify-node 132 0 28
✅ fastify-quickjs 132 0 28
✅ hono-node 132 0 28
✅ hono-quickjs 132 0 28
✅ nest-node 132 0 28
✅ nest-quickjs 132 0 28
✅ nextjs-turbopack-node 157 0 3
✅ nextjs-turbopack-quickjs 157 0 3
✅ nextjs-webpack-node 157 0 3
✅ nextjs-webpack-quickjs 157 0 3
✅ nitro-node 132 0 28
✅ nitro-quickjs 132 0 28
✅ nuxt-node 132 0 28
✅ nuxt-quickjs 132 0 28
✅ python-node 66 0 94
✅ sveltekit-node 151 0 9
✅ sveltekit-quickjs 151 0 9
✅ tanstack-start-node 132 0 28
✅ tanstack-start-quickjs 132 0 28
✅ vite-node 132 0 28
✅ vite-quickjs 132 0 28

✅ 💻 Local Development

App Passed Failed Skipped
✅ astro-stable-node 134 0 26
✅ astro-stable-quickjs 134 0 26
✅ express-stable-node 134 0 26
✅ express-stable-quickjs 134 0 26
✅ fastify-stable-node 134 0 26
✅ fastify-stable-quickjs 134 0 26
✅ hono-stable-node 134 0 26
✅ hono-stable-quickjs 134 0 26
✅ nest-stable-node 134 0 26
✅ nest-stable-quickjs 134 0 26
✅ nextjs-turbopack-canary-node 141 0 19
✅ nextjs-turbopack-canary-quickjs 141 0 19
✅ nextjs-turbopack-stable-node 160 0 0
✅ nextjs-turbopack-stable-quickjs 160 0 0
✅ nextjs-webpack-canary-node 141 0 19
✅ nextjs-webpack-canary-quickjs 141 0 19
✅ nextjs-webpack-stable-node 160 0 0
✅ nextjs-webpack-stable-quickjs 160 0 0
✅ nitro-stable-node 134 0 26
✅ nitro-stable-quickjs 134 0 26
✅ nuxt-stable-node 134 0 26
✅ nuxt-stable-quickjs 134 0 26
✅ sveltekit-stable-node 153 0 7
✅ sveltekit-stable-quickjs 153 0 7
✅ tanstack-start-node 134 0 26
✅ tanstack-start-quickjs 134 0 26
✅ vite-stable-node 134 0 26
✅ vite-stable-quickjs 134 0 26

✅ 📦 Local Production

App Passed Failed Skipped
✅ astro-stable-node 134 0 26
✅ astro-stable-quickjs 134 0 26
✅ express-stable-node 134 0 26
✅ express-stable-quickjs 134 0 26
✅ fastify-stable-node 134 0 26
✅ fastify-stable-quickjs 134 0 26
✅ hono-stable-node 134 0 26
✅ hono-stable-quickjs 134 0 26
✅ nest-stable-node 134 0 26
✅ nest-stable-quickjs 134 0 26
✅ nextjs-turbopack-canary-node 141 0 19
✅ nextjs-turbopack-canary-quickjs 141 0 19
✅ nextjs-turbopack-stable-node 160 0 0
✅ nextjs-turbopack-stable-quickjs 160 0 0
✅ nextjs-webpack-canary-node 141 0 19
✅ nextjs-webpack-canary-quickjs 141 0 19
✅ nextjs-webpack-stable-node 160 0 0
✅ nextjs-webpack-stable-quickjs 160 0 0
✅ nitro-stable-node 134 0 26
✅ nitro-stable-quickjs 134 0 26
✅ nuxt-stable-node 134 0 26
✅ nuxt-stable-quickjs 134 0 26
✅ sveltekit-stable-node 153 0 7
✅ sveltekit-stable-quickjs 153 0 7
✅ tanstack-start-node 134 0 26
✅ tanstack-start-quickjs 134 0 26
✅ vite-stable-node 134 0 26
✅ vite-stable-quickjs 134 0 26

✅ 🐘 Local Postgres

App Passed Failed Skipped
✅ astro-stable-node 134 0 26
✅ astro-stable-quickjs 134 0 26
✅ express-stable-node 134 0 26
✅ express-stable-quickjs 134 0 26
✅ fastify-stable-node 134 0 26
✅ fastify-stable-quickjs 134 0 26
✅ hono-stable-node 134 0 26
✅ hono-stable-quickjs 134 0 26
✅ nest-stable-node 134 0 26
✅ nest-stable-quickjs 134 0 26
✅ nextjs-turbopack-canary-node 141 0 19
✅ nextjs-turbopack-canary-quickjs 141 0 19
✅ nextjs-turbopack-stable-node 160 0 0
✅ nextjs-turbopack-stable-quickjs 160 0 0
✅ nextjs-webpack-canary-node 141 0 19
✅ nextjs-webpack-canary-quickjs 141 0 19
✅ nextjs-webpack-stable-node 160 0 0
✅ nextjs-webpack-stable-quickjs 160 0 0
✅ nitro-stable-node 134 0 26
✅ nitro-stable-quickjs 134 0 26
✅ nuxt-stable-node 134 0 26
✅ nuxt-stable-quickjs 134 0 26
✅ sveltekit-stable-node 153 0 7
✅ sveltekit-stable-quickjs 153 0 7
✅ tanstack-start-node 134 0 26
✅ tanstack-start-quickjs 134 0 26
✅ vite-stable-node 134 0 26
✅ vite-stable-quickjs 134 0 26

✅ 🪟 Windows

App Passed Failed Skipped
✅ nextjs-turbopack-node 160 0 0
✅ nextjs-turbopack-quickjs 160 0 0

✅ 🌐 Cross-language Conformance

App Passed Failed Skipped
✅ python 68 0 73

✅ vercel-http-transport

App Passed Failed Skipped
✅ example 132 0 28
✅ express 132 0 28
✅ hono 132 0 28
✅ nextjs-turbopack 157 0 3
✅ nitro 132 0 28
✅ vite 132 0 28

✅ vercel-multi-region

App Passed Failed Skipped
✅ nextjs-turbopack 27 0 0

✅ vercel-ws-transport

App Passed Failed Skipped
✅ example 132 0 28
✅ express 132 0 28
✅ nextjs-turbopack 157 0 3
✅ vite 132 0 28

📋 View full workflow run

@github-actions

github-actions Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

📊 Workflow Benchmarks

commit 59f2fbf · Tue, 08 Sep 2026 20:08:23 GMT · run logs

Backend: vercel · app: nextjs-turbopack

Metric Scenario Best (ms) P75 (ms) P90 (ms) P99 (ms) Samples
TTFS step 1068 (+442%) 🔻 1228 🔴 (+15%) 🔻 1239 🔴 (+14%) 1385 🔴 (+16%) 🔻 30
TTFS stream 1094 (+522%) 🔻 1247 🔴 (+23%) 🔻 1264 🔴 (+23%) 🔻 1338 🔴 (+29%) 🔻 30
TTFS hook + stream 466 (-57%) 💚 1576 🔴 (+33%) 🔻 1604 🔴 (+25%) 🔻 5338 🔴 (+169%) 🔻 30
Fan-out TTFS Promise.all(100 steps) 586 (-1.3%) 1156 (-33%) 💚 2172 (+24%) 🔻 2499 (+36%) 🔻 10
Fan-out TTLS Promise.all(100 steps) 2187 (+39%) 🔻 4382 (+15%) 5203 (+32%) 🔻 8764 (-19%) 💚 10
STSO 1020 steps (inline) 92 (-11%) 132 (-7.0%) 151 (-9.0%) 722 (+138%) 🔻 1019
WO 1020 steps 142877 (-3.1%) 142877 (-3.1%) 142877 (-3.1%) 142877 (-3.1%) 1
CRTT first chunk (pooled) 56 (-14%) 108 (-19%) 💚 178 (-0.6%) 223 (-18%) 💚 28

Streams

Scenario CRTT 1st p75 p90 p99 CDV max iters
paced control (100/s, 60B) 69.5 (-20%) 115 (-26%) 157 (-29%) 261 (-34%) 88.5 (-44%) 10
size sweep (100/s, 160B-12KB) 69 (-29%) 114 (-57%) 156 (-69%) 299 (-68%) 104 (-57%) 10
replay gateway-gpt-5.4-nano-2000t (1x) 78 (-24%) 143 (-20%) 395 (+17%) 846 (+27%) 175 (-46%) 3
replay eve-gpt-5.6-sol-2000t (1x) 98.5 (-41%) 116 (-23%) 150 (-25%) 360 (-13%) 292 (-25%) 2
replay eve-gpt-5.6-sol-2000t (2x) 167 (+20%) 138 (-44%) 173 (-51%) 277 (-45%) 195 (-47%) 3
📈 STSO distribution vs main (inline / queue-hop histograms)

1020 steps (inline)

Cumulative STSO time: main 147324ms → this run 142750ms (Δ -4574ms, -3%)

   50-100 ms  ┃                         main   0  this   1    +1
  100-150 ms  ██████████████████████░┃  main 819  this 904   +85
  150-200 ms  █┃██                      main 159  this  82   -77
  200-250 ms  ┃                         main  23  this  11   -12
  250-300 ms  ┃                         main   7  this   4    -3
  300-350 ms  ┃                         main   4  this   1    -3
  350-400 ms  ┃                         main   2  this   1    -1
  400-450 ms  ┃                         main   1  this   1    +0
  450-500 ms  ┃                         main   2  this   0    -2
  500-550 ms  ┃                         main   1  this   2    +1
  700-750 ms  ┃                         main   0  this   4    +4
  750-800 ms  ┃                         main   0  this   1    +1
  800-850 ms  ┃                         main   0  this   2    +2
  850-900 ms  ┃                         main   0  this   1    +1
1150-1200 ms  ┃                         main   0  this   1    +1
1200-1250 ms  ┃                         main   0  this   1    +1
1300-1350 ms  ┃                         main   0  this   1    +1
1500-1550 ms  ┃                         main   0  this   1    +1
3750-3800 ms  ┃                         main   1  this   0    -1
📈 CRTT drill-down vs main (RTT distributions & profiles)
variant  RTT 1ms→5s+             avg         p50         p90         p99     n
control  ······█▆▁····   98.6 (-23%)   93 (-24%)  157 (-29%)  261 (-34%)  3000
sweep    ·····▁█▆▁····   99.7 (-45%)   94 (-31%)  156 (-69%)  299 (-68%)  3000
gw 1x    ·····▁█▅▁▁···  119.1 (-20%)   92 (-27%)  395 (+17%)  846 (+27%)  5295
eve 1x   ·····▁█▆▁▁···  100.7 (-24%)   92 (-21%)  150 (-25%)  360 (-13%)  5186
eve 2x   ·····▁▅█▁····  118.5 (-38%)  109 (-36%)  173 (-51%)  277 (-45%)  7779

RTT over stream progress (avg per tenth of stream, bars scaled min→max):

control  ▇▃▄▄█▄▃▂▂▁  91–111ms
sweep    █▄▁▄▂▂▂▁▁▂  91–128ms
gw 1x    █▇▃▂▁▁▁▂▂▁  88–207ms
eve 1x   ▂▁▃▅█▄▅▇▃▃  85–121ms
eve 2x   ▁▁▁▁▁▃▅█▄▃  107–153ms

RTT by chunk size (avg per log size bin, ~160B → ~12KB serialized, bars scaled min→max):

sweep  ▇██▆▄▂▁  97–102ms

Delivery jitter over stream progress (avg positive CDV per tenth of stream, bars scaled min→max):

control  ▂▁▂▃█▇▃▃▂▂  27–31ms
sweep    ▁▇▅█▆▄▅▅▄▄  30–47ms
gw 1x    ██▄▂▁▁▂▂▂▂  26–40ms
eve 1x   ▂▁▃▃▇▂▇█▂▆  18–25ms
eve 2x   ▅▃▁▁█▅▇▆▃█  18–23ms
ℹ️ Metric definitions & methodology

Streams: first-chunk RTT (the stream-open path, before any buffering/backpressure), CRTT percentiles, and worst delivery stall (CDV max). Cells are medians across iterations; per-run values in the artifacts. No 🔴/🟢 marks until targets attach.

The collapsed STSO distribution section above buckets every step gap, split inline (same warm process — pure framework overhead) vs queue-hop (fresh process — dispatch, reinit, replay). █ = main, ┃ = this run, ░ = fill.

The collapsed CRTT drill-down: per-variant RTT histograms (fixed log bins, · = empty) and mean RTT/positive-CDV profile lines over stream progress and chunk size. Histograms, avgs, and profiles merge exactly across runs; p50–p99 are percentile-of-percentiles. Per-index rows live in the artifacts.

Best/P75/P90/P99 deltas compare against the most recent benchmark run on main at the time of this run. 🔻 flags a delta worse than +15%, 💚 one better than −15%.

Metrics — TTFS: time to first step body (in-deployment start() → first step body) · Fan-out TTFS: fan-out time to first step (in-deployment start() → first of the parallel step bodies to complete) · Fan-out TTLS: fan-out time to last step (in-deployment start() → last of the parallel step bodies to complete, i.e. when the Promise.all resolves) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · CRTT: chunk round-trip time (per-chunk write → read latency, one clock domain: deployment → stream backend → same deployment) · CDV: chunk delay variation / delivery jitter (inter-arrival gap minus inter-write gap per seq-adjacent pair; skew-free; the row is each run's MAX positive value, so one stall moves it)

Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · Promise.all(100 steps): 100 trivial no-op steps started together in a single Promise.all; Fan-out TTFS is the first of them to complete and Fan-out TTLS the last, both from the in-deployment clientStart, so their gap is the spread the runtime adds across the fan-out · paced control (100/s, 60B): the control: 300 tiny (~60B) deltas metronome-paced at 100/s — zero workload structure, so it reads the transport floor and flush cadence, and disambiguates transport-wide vs workload-specific when a replay row moves · size sweep (100/s, 160B-12KB): same pacing as the control with deltas padded in rotation across seven log-spaced sizes (~160B–12KB) — rotation decouples size from stream position, so it isolates whether chunk size causes latency · replay gateway-gpt-5.4-nano-2000t (1x): raw provider SSE cadence captured at the AI gateway boundary (gpt-5.4-nano, the most popular gateway model; per-token deltas p50 208B = the modal production chunk size), replayed exactly as measured — the typical customer's workload; its CDV is the typical customer's real delivery jitter · replay eve-gpt-5.6-sol-2000t (1x): a captured eve turn (gpt-5.6-sol, the most-used demanding eve model; ~2000 output tokens = production p50 turn length) replayed exactly as measured — eve's envelope protocol re-ships the cumulative message so sizes ramp 142B→13KB; the demanding outlier tenant's reality · replay eve-gpt-5.6-sol-2000t (2x): the same eve capture at 2x — the headroom/stress row; real fast-tier models emit the same chunk sizes at proportionally higher rate, so time compression is a faithful speed model · first chunk (pooled): every run's seq-0 RTT pooled across all stream scenarios — the first chunk precedes any workload differentiation, so pooling samples one shared stream-open path with exact percentiles

Replay cadences (semantic sha256) — eve-gpt-5.6-sol-2000t eaf22f5946e7c61f3c65c7006d550df180cfabd4e706254a09f22aec0cfb420d · gateway-gpt-5.4-nano-2000t 6f24ac518b6b83ff1d0e85a5fe78230db192716d66a7fc6b2fe022752001d041

🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600

All timestamps are deployment-side; runs are triggered in-deployment, so the CI runner and api.vercel.com sit outside every measured window. TTFS = start() → first step body (includes dispatch + any cold start); Fan-out TTFS/TTLS = first/last step completion of one Promise.all from the same anchor (the gap is the runtime’s fan-out spread); STSO/WO between step bodies; CRTT inside the workflow (excludes the api.vercel.com read path).

Cold starts stay in the numbers (real bursty-workload latency, inflates P75+); Best is the warm floor.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The dependency bump is valid and isolated to the playground’s package manifest with no issues identified in the changed lines.

Pull request overview

Updates the swc-playground workbench app to use a newer pinned Next.js version, keeping the playground aligned with recent Next.js runtime behavior for compiler/plugin experimentation.

Changes:

  • Bump next dependency in workbench/swc-playground from 16.2.11 to 16.3.4.
  • Minor dependency list reordering to keep JSON formatting consistent (trailing comma / placement of workflow).
File summaries
File Description
workbench/swc-playground/package.json Updates the Next.js version used by the SWC playground app and adjusts dependency ordering/formatting accordingly.
Review details
  • Files reviewed: 1/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Sim World

Simulated world deterministic testing for races. Traces

🟠 world-sim scenario book — 1 fail of 41 total

fence=per-spec

scenario outcome events virt replay violations
✅ smoke-no-steps completed 3 0ms ok 0
✅ smoke-one-step completed 6 0ms ok 0
✅ hook-at-step-started completed 12 0ms ok 0
✅ hook-at-step-completed completed 12 0ms ok 0
✅ hook-at-hook-created completed 12 0ms ok 0
✅ deadline-hook-wins completed 7 1.0h ok 0
✅ deadline-expires completed 7 1.0h ok 0
✅ long-sleep completed 11 30.0d ok 0
✅ hook-never-arrives stalled 3 0ms skipped 0
✅ step-retries-twice completed 10 2.0s ok 0
✅ parallel-steps completed 9 0ms ok 0
✅ hook-on-execution-state completed 12 0ms ok 0
✅ peek-hook-before-branch completed 12 0ms ok 0
✅ peek-hook-after-branch completed 12 0ms ok 0
✅ peek-hook-at-registration completed 12 0ms ok 0
✅ race-hook-before-probe completed 12 0ms ok 0
✅ race-hook-after-probe completed 12 0ms ok 0
✅ race-duplicate-delivery completed 13 0ms ok 0
✅ attr-hook-before-step completed 11 0ms ok 0
✅ attr-hook-after-step completed 11 0ms ok 0
✅ attr-from-step-body completed 13 0ms ok 0
✅ fork-hook-after-timeout completed 14 1.0m ok 0
✅ fork-hook-before-timeout completed 14 1.0m ok 0
✅ count-hook-after-timeout completed 17 1.0m ok 0
✅ count-hook-before-timeout completed 20 1.0m ok 0
✅ stale-read-step-count-fork completed 20 1.0m ok 0
✅ stale-read-equal-step-counts completed 14 1.0m ok 0
✅ step-vs-step-fork completed 12 0ms ok 0
✅ step-vs-step-fork-fenced completed 12 0ms ok 0
✅ fence-catches-benign-direction completed 12 5ms ok 0
✅ in-flight-before-decision completed 17 1.0m ok 0
❌ in-flight-before-decision-counted completed 17 1.0m ok 0
✅ in-flight-after-decision completed 19 2.0m ok 0
✅ stale-read-step-count-fork-fenced completed 20 1.0m ok 0
✅ fork-hook-wins completed 13 1.0m ok 0
✅ fork-timeout-wins completed 13 1.0m ok 0
✅ unclaimed-payload-under-fork completed 17 1.0m ok 0
✅ claimed-payload-under-fork completed 17 1.0m ok 0
✅ writers-independent-step-bodies completed 12 0ms ok 0
✅ writers-scripted-tempo completed 12 0ms ok 0
✅ cancel-mid-step cancelled 7 0ms skipped 0

Full trace: world-sim.txt

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor
Framework Flow route Step reg. Framework output
hono 201.6 KiB (±0) 40.8 KiB (±0) 1.77 MiB (±0)
nextjs-turbopack 207.0 KiB (±0) 439 B (±0) 768.8 KiB (+55 B)
About these numbers

Sizes are gzip; parentheses show the change against main.
Flow route and Step reg. gate this job, on raw bytes rather than the gzip shown, at max(2%, 50.0 KiB). Framework output is informational.

59f2fbf · run

@TooTallNate
TooTallNate merged commit b30ed49 into main Sep 8, 2026
187 checks passed
@TooTallNate
TooTallNate deleted the naterajlich/vuln-14177-dependency-vulnerability-next16211-in branch September 8, 2026 20:20
@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

No backport to stable for b30ed49 (AI decision).

This is a routine dependency bump (Next.js 16.2.11 -> 16.3.4) for the internal workbench/swc-playground demo app plus the resulting pnpm-lock.yaml churn, with no indication it addresses a security vulnerability or a bug affecting stable. Routine, non-security dependency upgrades are explicitly out of scope for the maintenance line, and nothing in any published package changes.

To override, re-run the Backport to stable workflow manually via workflow_dispatch and paste this commit SHA into the ref input:

b30ed49187a0d637de25fac461a6fc9c8c2973a6

pranaygp added a commit that referenced this pull request Sep 9, 2026
…c-workflow-source

* origin/main: (22 commits)
  feat(streams): add writer session seam (#3832)
  docs: document WORKFLOW_NODE_HTTP in the v4 World docs (#4050)
  [world-vercel] Honor WORKFLOW_NODE_HTTP on the queue transport (#4044)
  feat(streams): add WebSocket capability gate (#3764)
  fix(world-local): retry JSON reads on Windows (#4051)
  [core] Add the wake-loop scenario to the event log race repro (#4017)
  [ci] Cap concurrent Vercel E2E action repo-wide (10 by default) (#4039)
  Add `Run#getWritable()` for appending to another run's stream (#3972)
  feat(streams): add WebSocket v1 client protocol contract (#3763)
  [swc-playground] Update to Next.js v16.3.4 (#4018)
  [core] Add a retention option to start() (#3787)
  fix(swc-plugin): register class expressions via an IIFE instead of by name (#3971)
  [docs] Fix prose typos across v4/v5 docs and the SWC plugin README (#3948)
  Validate pending changesets in CI so a bad one fails the PR, not the Release job (#3964)
  Version Packages (beta) (#3919)
  Classify Workflow stream failures (#3850)
  Drop the ignored @workflow/world-sim package from the hook_conflict delta changeset (#3963)
  Add attribute inspection to the CLI (#3950)
  [core] Settle a hook's awaiter in-process instead of re-invoking, on creation and on conflict (#3938)
  Use the storage APIs for run detail views (#3944)
  ...

This branch was successfully deployed

18 active deployments
Preview – workflow-swc-playground — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – example-nextjs-workflow-webpack — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-fastify-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workflow-docs — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – example-nextjs-workflow-turbopack — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-nuxt-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-tanstack-start-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-vite-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-sveltekit-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – example-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-astro-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-hono-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-nitro-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-express-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-nestjs-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workflow-tarballs — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workflow-web — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Preview – workbench-python-workflow — 59f2fbf6 Deployed Sep 8, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants