chore(deps): bump the vercel-workflow-runtime group across 1 directory with 2 updates

[dependabot]

Bumps the vercel-workflow-runtime group with 2 updates in the / directory: @vercel/sandbox and workflow.

Updates @vercel/sandbox from 1.10.0 to 2.0.1

Release notes

Sourced from @​vercel/sandbox's releases.

@​vercel/sandbox@​2.0.1

Patch Changes

• Add updatedAt getter to the Snapshot class (#208)

@​vercel/sandbox@​2.0.0

Major Changes

• Introduce named and long-lived sandboxes (#177)

Minor Changes

• Add L7 request matchers and forward URLs support to network policy rules. (#177)

• Support pagination (CLI and SDK) when listing sandboxes, snapshots, sessions (#177)

• Add defineSandboxProxy helper in @vercel/sandbox/proxy to easily implement network policies forwarding rules (#188)

• Rename sandbox to session, namedSandbox to sandbox (#177)

• Support keepLastSnapshots feature for CLI and SDK (#193)

• Add sandbox port replacement support through update. (#177)

• Support default snapshot expiration for persistent sandboxes (#177)

• Refactor the sandbox update and deprecate old network-policy update (#177)

• Support a new method: Sandbox.getOrCreate() (#177)

• Rename snapshotOnShutdown to persistent (#177)

• Automatically scale memory to vcpu when updating (#177)

• Move to cursor pagination. Support new sortyBy parameter for lists. Support new statusUpdatedAt filter (#177)

• Add Sandbox.fork(...) to the SDK and sandbox fork <source> to the CLI for forking an existing sandbox into a new one. (#205)

• Remove support for blocking parameter in .stop() and default to always blocking. Improve CLI output when stopping a sandbox. (#177)

• Lists now unwrap the json and return the items and pagination fields directly (#177)

• Support new onResume parameter in Sandbox.create and Sandbox.get (#177)

• Support snapshot tree pagination (#191)

Patch Changes

• Add support for tags (#177)

... (truncated)

Changelog

Sourced from @​vercel/sandbox's changelog.

2.0.1

Patch Changes

• Add updatedAt getter to the Snapshot class (#208)

2.0.0

Major Changes

• Introduce named and long-lived sandboxes (#177)

Minor Changes

• Add L7 request matchers and forward URLs support to network policy rules. (#177)

• Support pagination (CLI and SDK) when listing sandboxes, snapshots, sessions (#177)

• Add defineSandboxProxy helper in @vercel/sandbox/proxy to easily implement network policies forwarding rules (#188)

• Rename sandbox to session, namedSandbox to sandbox (#177)

• Support keepLastSnapshots feature for CLI and SDK (#193)

• Add sandbox port replacement support through update. (#177)

• Support default snapshot expiration for persistent sandboxes (#177)

• Refactor the sandbox update and deprecate old network-policy update (#177)

• Support a new method: Sandbox.getOrCreate() (#177)

• Rename snapshotOnShutdown to persistent (#177)

• Automatically scale memory to vcpu when updating (#177)

• Move to cursor pagination. Support new sortyBy parameter for lists. Support new statusUpdatedAt filter (#177)

• Add Sandbox.fork(...) to the SDK and sandbox fork <source> to the CLI for forking an existing sandbox into a new one. (#205)

• Remove support for blocking parameter in .stop() and default to always blocking. Improve CLI output when stopping a sandbox. (#177)

• Lists now unwrap the json and return the items and pagination fields directly (#177)

• Support new onResume parameter in Sandbox.create and Sandbox.get (#177)

• Support snapshot tree pagination (#191)

Patch Changes

... (truncated)

Commits

• b6f5274 Version Packages (#209)
• b09b960 fix(vercel-sandbox): add missing updatedAt getter to Snapshot class (#208)
• 6f7ee8e Exit beta release: @vercel/sandbox@1.x -> 2.0.0, sandbox@2.x -> 3.0.0 (#207)
• ebfab9a Version Packages (beta) (#206)
• 7d753e8 feat(vercel-sandbox,sandbox): add fork, remove --sandbox-snapshot (#205)
• 5835a48 Version Packages (beta) (#204)
• 864eb6f fix(vercel-sandbox): reject non-octet-stream responses in readFile (#202)
• 27b48f1 Version Packages (beta) (#199)
• 88cfb44 feat(sdk): add defineSandboxProxy helper (#188)
• f618e13 feat(vercel-sandbox,sandbox): introduce snapshot tree (#191)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vercel/sandbox since your current version.

Updates workflow from 4.2.4 to 4.2.5

Release notes

Sourced from workflow's releases.

workflow@4.2.5

@​workflow/core@​4.2.5

• #2029 a434184 @​pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.
• #2046 8407c1e @​pranaygp - Report corrupted event logs with a distinct CorruptedEventLogError type and CORRUPTED_EVENT_LOG run error code.
• #2056 7487430 @​VaguelySerious - Fix spurious "Event cursor missing after initial load" warning
• #2030 c347509 @​pranaygp - Validate step, wait, and hook lifecycle events against replay ownership metadata.
• #2060 ca5f355 @​pranaygp - Record fatal world response contract failures as non-retryable workflow errors.
• #1986 16f2c23 @​pranaygp - Fix local workflow port detection, make generated health endpoints respond to HEAD requests, materialize manual webhook response bodies before returning them, wait for step return stream serialization before completing the step, bound Vercel stream and health-check operations so stuck writes or queue sends retry or time out instead of hanging, and stabilize remote Vercel e2e checks around CLI inspection, sleep timing, and hook registration/disposal.
• #1935 6aabd6f @​TooTallNate - Preserve the this binding of bound step proxies across workflow serialization, so passing useStep(...).bind(thisArg) as a step argument no longer loses the receiver.

@​workflow/world@​4.1.2

• #2029 a434184 @​pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.
• #2046 8407c1e @​pranaygp - Report corrupted event logs with a distinct CorruptedEventLogError type and CORRUPTED_EVENT_LOG run error code.
• #1902 15e44b3 @​ziyak97 - Fix compatibility with Zod 4.4.x in WorkflowRunSchema by marking output, error, and completedAt as .optional() on non-final / cancelled / completed / failed run states.
• #2030 c347509 @​pranaygp - Validate step, wait, and hook lifecycle events against replay ownership metadata.

@​workflow/world-local@​4.1.2

• #2029 a434184 @​pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.
• #1985 76352f0 @​pranaygp - Improve the local queue error message when a Next.js proxy intercepts workflow routes.
• #1898 e428cdb @​VaguelySerious - Fix local-world recovery isolation in Vitest and support custom test directories
• #1829 5f50bbc @​TooTallNate - Fix path traversal via request-supplied IDs in the world-local storage backend.

@​workflow/world-postgres@​4.1.2

• #2029 a434184 @​pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.
• #2069 096adbf @​pranaygp - Fix race in events.create() where concurrent step_created / hook_created / wait_created writes with the same correlationId would persist duplicate event rows. Adds a unique partial index and surfaces the violation as EntityConflictError.
• #2019 be506cc @​VaguelySerious - workflow-postgres-setup now also bootstraps the graphile_worker schema, fixing potential race on setup when starting the app and a test runner at the same time

@​workflow/world-vercel@​4.2.0

• #1897 677867b @​VaguelySerious - Switch the workflow-server Deployment Protection bypass to OIDC Trusted Sources. The VERCEL_WORKFLOW_SERVER_PROTECTION_BYPASS env var is no longer used; the x-vercel-trusted-oidc-idp-token header is now sourced from getVercelOidcToken().
• #2029 a434184 @​pranaygp - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.
• #1999 a350e8d @​pranaygp - Release failed VQS workflow handler messages on the configured retry cadence.
• #2060 ca5f355 @​pranaygp - Record fatal world response contract failures as non-retryable workflow errors.
• #1986 16f2c23 @​pranaygp - Fix local workflow port detection, make generated health endpoints respond to HEAD requests, materialize manual webhook response bodies before returning them, wait for step return stream serialization before completing the step, bound Vercel stream and health-check operations so stuck writes or queue sends retry or time out instead of hanging, and stabilize remote Vercel e2e checks around CLI inspection, sleep timing, and hook registration/disposal.
• #1987 ecfccc3 @​karthikscale3 - Update to new queue client version

@​workflow/web@​4.1.6

• #1955 73e0c4d @​mitul-s - Show hook name on trace viewer + no toast on decrypt

@​workflow/web-shared@​4.1.6

• #1955 73e0c4d @​mitul-s - Show hook name on trace viewer + no toast on decrypt
• #2087 88070cf @​VaguelySerious - Fix the "Queued for" duration shown in the events list for retried steps. It now measures from step_created to the first step_started instead of the last, so the displayed value reflects actual queue time rather than queue time plus all retry waits.
• #1952 01cfe19 @​mitul-s - Fix old trace viewer layout to be in a row rather than column

... (truncated)

Changelog

Sourced from workflow's changelog.

4.2.5

Patch Changes

• #2056 7487430 Thanks @​VaguelySerious! - Fix spurious "Event cursor missing after initial load" warning

• #1986 16f2c23 Thanks @​pranaygp! - Fix local workflow port detection, make generated health endpoints respond to HEAD requests, materialize manual webhook response bodies before returning them, wait for step return stream serialization before completing the step, bound Vercel stream and health-check operations so stuck writes or queue sends retry or time out instead of hanging, and stabilize remote Vercel e2e checks around CLI inspection, sleep timing, and hook registration/disposal.

• Updated dependencies [a434184, 8407c1e, 7487430, c347509, 478a9c7, ca5f355, 9ebe5e4, 16f2c23, 5b6a581, 6aabd6f, 14326ad]:

  • @​workflow/core@​4.2.5
  • @​workflow/errors@​4.1.2
  • @​workflow/next@​4.0.6
  • @​workflow/sveltekit@​4.0.5
  • @​workflow/astro@​4.0.5
  • @​workflow/nest@​0.0.5
  • @​workflow/utils@​4.1.2
  • @​workflow/cli@​4.2.5
  • @​workflow/nitro@​4.0.6
  • @​workflow/typescript-plugin@​4.0.2
  • @​workflow/rollup@​4.0.5
  • @​workflow/nuxt@​4.0.6

Commits

• b93e7c3 Version Packages (#1921)
• cab6c14 Fix observability getWorld import docstring (#2032) (#2033)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pre-sales-agent	Error		May 28, 2026 5:21pm