Skip to content

build(deps): Bump devalue and workflow in /thermodynamic-daemon/thermo-workflow - #11

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/thermodynamic-daemon/thermo-workflow/multi-cdfad2ba53
Open

build(deps): Bump devalue and workflow in /thermodynamic-daemon/thermo-workflow#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/thermodynamic-daemon/thermo-workflow/multi-cdfad2ba53

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026 •
edited by blacksmith-sh Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps devalue to 5.9.2 and updates ancestor dependency workflow. These dependencies need to be updated together.

Updates devalue from 5.8.1 to 5.9.2

Release notes

Sourced from devalue's releases.

v5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval
Changelog

Sourced from devalue's changelog.

5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval
Commits

Updates workflow from 4.6.0 to 4.8.9

Release notes

Sourced from workflow's releases.

workflow@4.8.9

@​workflow/core@​4.8.9

@​workflow/world-postgres@​4.3.7

  • #4111 f72c6a6 @​komly - Fix run creation and slot allocation not happening transactionally
  • #4114 9595a5a @​komly - Queue deliveries no longer inherit fetch's 300s headers/body deadlines, which redelivered healthy long-running inline work while it was still executing. Deadlines can be set with WORKFLOW_POSTGRES_HEADERS_TIMEOUT_MS and WORKFLOW_POSTGRES_BODY_TIMEOUT_MS.
  • #4117 ee29d15 @​komly - Preserve error names, messages, stacks, and nested causes in Graphile Worker log metadata.
  • #4113 73465bc @​komly - Fix stream cursors not being advanced for skipped chunks, so repeated notifications cannot consume the requested start offset twice
  • #4125 d86d752 @​VaguelySerious - Fix stream readers leaking EventEmitter listeners on EOF, initial query failure, and World close, and fail pending readers when the World is closed.
  • #3712 e3862bc @​himself65 - Fix readFromStream erroring when rows were written after the stream's first EOF marker. Rows past the first EOF are now ignored consistently across readFromStream(), getStreamChunks(), and getStreamInfo().

@​workflow/builders@​4.1.14

  • #3795 46851a3 @​TooTallNate - Deduplicate identical pnpm peer-variant copies of a package instead of failing the build with a duplicate step/workflow ID error. Different implementations that map to the same ID still fail.

workflow@4.8.8

@​workflow/world-vercel@​4.7.4

  • #4044 4607916 @​VaguelySerious - Honor WORKFLOW_NODE_HTTP on the queue client's transport, so a deployment whose bundled undici is unusable can still acknowledge queue messages instead of redelivering them until the invocation is killed.
  • #4049 5f2fb36 @​VaguelySerious - Give the queue client its own connection pool and a total per-request deadline, so a stalled queue acknowledgement fails fast instead of holding the invocation until the platform kills it.

workflow@4.8.7

@​workflow/world-vercel@​4.7.3

  • #4045 0e56bb8 @​karthikscale3 - Classify HTTP/2 response stream timeouts as retryable transport failures so start() can return the queued run through resilient start.

workflow@4.8.6

@​workflow/world-local@​4.4.1

  • #3824 41abe2d @​AndrewBarba - Abort active local queue deliveries when the World closes, including when transport timeouts are disabled.

@​workflow/world-vercel@​4.7.2

  • #4041 0deceda @​karthikscale3 - Recycle the events HTTP/2 connection pool when a streamed response body fails after its headers arrive.
  • #3844 7024b5b @​VaguelySerious - Authenticate deploymentId: "latest" with the deployment's own OIDC identity instead of an ambient VERCEL_TOKEN, and scope the request to the configured team, fixing spurious 404s when resolving the latest deployment

@​workflow/web-shared@​4.1.22

@​workflow/swc-plugin@​4.1.3

  • #3971 0b9867e @​TooTallNate - Register class expressions through an IIFE that closes over the class instead of module-level code that references it by name, fixing the unresolvable AnonymousClass reference emitted for shapes such as var Foo = class { ... } in pre-bundled packages.

@​workflow/next@​4.1.10

... (truncated)

Changelog

Sourced from workflow's changelog.

4.8.9

Patch Changes

4.8.8

Patch Changes

  • Updated dependencies []:
    • @​workflow/cli@​4.3.12
    • @​workflow/core@​4.8.8
    • @​workflow/next@​4.1.12
    • @​workflow/nitro@​4.1.14
    • @​workflow/typescript-plugin@​4.0.3
    • @​workflow/astro@​4.0.23
    • @​workflow/nest@​4.0.24
    • @​workflow/rollup@​4.0.23
    • @​workflow/sveltekit@​4.0.23
    • @​workflow/nuxt@​4.0.24

4.8.7

Patch Changes

  • Updated dependencies []:
    • @​workflow/cli@​4.3.11
    • @​workflow/core@​4.8.7
    • @​workflow/next@​4.1.11
    • @​workflow/nitro@​4.1.13
    • @​workflow/typescript-plugin@​4.0.3
    • @​workflow/astro@​4.0.22
    • @​workflow/nest@​4.0.23
    • @​workflow/rollup@​4.0.22
    • @​workflow/sveltekit@​4.0.22
    • @​workflow/nuxt@​4.0.23

4.8.6

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

@dependabot
build(deps): Bump devalue and workflow
2ff7be6 
Bumps [devalue](https://github.com/sveltejs/devalue) to 5.9.2 and updates ancestor dependency [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow). These dependencies need to be updated together.


Updates `devalue` from 5.8.1 to 5.9.2
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.8.1...v5.9.2)

Updates `workflow` from 4.6.0 to 4.8.9
- [Release notes](https://github.com/vercel/workflow/releases)
- [Changelog](https://github.com/vercel/workflow/blob/workflow@4.8.9/packages/workflow/CHANGELOG.md)
- [Commits](https://github.com/vercel/workflow/commits/workflow@4.8.9/packages/workflow)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.9.2
  dependency-type: indirect
- dependency-name: workflow
  dependency-version: 4.8.9
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 18, 2026
claude[bot]
claude Bot reviewed Sep 18, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, comment @claude review on this pull request, or push a new commit, to trigger a review.

@sonarqubecloud

sonarqubecloud Bot commented Sep 18, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claude claude[bot] claude[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants