Skip to content

chore(deps): bump devalue, @workflow/core and workflow - #324

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-8a11216059
Open

chore(deps): bump devalue, @workflow/core and workflow#324
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-8a11216059

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor

Bumps devalue to 5.9.2 and updates ancestor dependencies devalue, @workflow/core and workflow. These dependencies need to be updated together.

Updates devalue from 5.8.1 to 5.9.2

Release notes

Sourced from devalue's releases.

v5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval
Changelog

Sourced from devalue's changelog.

5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval
Commits

Updates @workflow/core from 5.0.0-beta.25 to 5.0.0-beta.53

Release notes

Sourced from @​workflow/core's releases.

workflow@5.0.0-beta.53

@​workflow/core@​5.0.0-beta.53

  • #4175 56322af @​pranaygp - Fix an unhandled rejection that could exit the process when the encryption-key lookup for a forwarded writable stream failed (for example a run metadata read that timed out) before anything was written to that stream. The lookup now starts on the first write, and a failure rejects that stream instead.
  • #4179 5dbbcf9 @​karthikscale3 - Route unrecognized backend connection and stream failures through existing retry policies, preserving event-write retries and rebuilding shared event connections after repeated HTTP/2 failures. Keep invalid request headers and caller cancellations out of event-write retries. Include error cause chains in run-failure logs to expose underlying socket, DNS, and TLS failures.

@​workflow/world-postgres@​5.0.0-beta.44

  • #3712 5f723b3 @​himself65 - Fix readFromStream erroring when rows were written after the stream's first EOF marker. Rows past the first EOF are now ignored consistently across streams.get(), getChunks(), and getInfo().

@​workflow/world-vercel@​5.0.0-beta.48

  • #4179 5dbbcf9 @​karthikscale3 - Route unrecognized backend connection and stream failures through existing retry policies, preserving event-write retries and rebuilding shared event connections after repeated HTTP/2 failures. Keep invalid request headers and caller cancellations out of event-write retries. Include error cause chains in run-failure logs to expose underlying socket, DNS, and TLS failures.

workflow@5.0.0-beta.52

@​workflow/core@​5.0.0-beta.52

  • #4145 37f1011 @​pranaygp - Render the errorStack field as the log body when the message carries no stack of its own, so the run-failure log shows the stack instead of discarding it.
  • #4070 d427c47 @​torsello - Allow parentheses and square brackets in workflow names, so workflows can live in Next.js route groups (app/(dashboard)/…) and dynamic segments (app/[teamId]/…).

@​workflow/world@​5.0.0-beta.36

  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/world-local@​5.0.0-beta.45

  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/world-postgres@​5.0.0-beta.43

  • #4114 cc9a4cf @​komly - Queue deliveries no longer inherit fetch's 300s headers/body deadlines, which redelivered healthy long-running inline work while it was still executing. Deadlines can be set with WORKFLOW_POSTGRES_HEADERS_TIMEOUT_MS and WORKFLOW_POSTGRES_BODY_TIMEOUT_MS.
  • #4117 2883509 @​komly - Preserve error names, messages, stacks, and nested causes in Graphile Worker log metadata.
  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/world-vercel@​5.0.0-beta.47

  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/nest@​5.0.0-beta.52

workflow@5.0.0-beta.51

@​workflow/core@​5.0.0-beta.51

  • #3457 03455a2 @​TooTallNate - Carry immutable run identity on step-execution queue messages to skip the blocking runs.get before starting a step, fetching the run row only when continuing into replay. Messages without runContext keep the previous behavior.
  • #4098 fb9e275 @​pranaygp - Commit the batched fan-out's pre-claimed inline [step_created, step_started] pairs in their own leading chunk, ahead of the plain step/wait creates, so the write that gates the inline bodies stays small and commits faster. The pairs now fold only with two or more inline steps (a lone inline step keeps the lazy start), and a lone plain create beside them takes the single write.
  • #4099 788d4fb @​pranaygp - Skip re-publishing a pending step's execution message on a later replay pass when this same invocation already published it (a fresh delivery still re-enqueues unconditionally).
  • #4021 ec57aff @​VaguelySerious - When logging corrupt event logs due to replay divergence, specify the divergent events, and carry error message through retries
  • #4096 6cc851c @​pranaygp - Stop sending a slot snapshot (eventCount) on step executor writes, so a World no longer reads and returns a skipped-slot event page that the executor only discards.

... (truncated)

Changelog

Sourced from @​workflow/core's changelog.

5.0.0-beta.53

Patch Changes

  • #4175 56322af Thanks @​pranaygp! - Fix an unhandled rejection that could exit the process when the encryption-key lookup for a forwarded writable stream failed (for example a run metadata read that timed out) before anything was written to that stream. The lookup now starts on the first write, and a failure rejects that stream instead.

  • #4179 5dbbcf9 Thanks @​karthikscale3! - Route unrecognized backend connection and stream failures through existing retry policies, preserving event-write retries and rebuilding shared event connections after repeated HTTP/2 failures. Keep invalid request headers and caller cancellations out of event-write retries. Include error cause chains in run-failure logs to expose underlying socket, DNS, and TLS failures.

  • Updated dependencies [5dbbcf9]:

    • @​workflow/world-vercel@​5.0.0-beta.48

5.0.0-beta.52

Patch Changes

  • #4145 37f1011 Thanks @​pranaygp! - Render the errorStack field as the log body when the message carries no stack of its own, so the run-failure log shows the stack instead of discarding it.

  • #4070 d427c47 Thanks @​torsello! - Allow parentheses and square brackets in workflow names, so workflows can live in Next.js route groups (app/(dashboard)/…) and dynamic segments (app/[teamId]/…).

  • Updated dependencies [79e7436]:

    • @​workflow/world@​5.0.0-beta.36
    • @​workflow/world-local@​5.0.0-beta.45
    • @​workflow/world-vercel@​5.0.0-beta.47
    • @​workflow/errors@​5.0.0-beta.21

5.0.0-beta.51

Minor Changes

  • #3457 03455a2 Thanks @​TooTallNate! - Carry immutable run identity on step-execution queue messages to skip the blocking runs.get before starting a step, fetching the run row only when continuing into replay. Messages without runContext keep the previous behavior.

Patch Changes

  • #4098 fb9e275 Thanks @​pranaygp! - Commit the batched fan-out's pre-claimed inline [step_created, step_started] pairs in their own leading chunk, ahead of the plain step/wait creates, so the write that gates the inline bodies stays small and commits faster. The pairs now fold only with two or more inline steps (a lone inline step keeps the lazy start), and a lone plain create beside them takes the single write.

  • #4099 788d4fb Thanks @​pranaygp! - Skip re-publishing a pending step's execution message on a later replay pass when this same invocation already published it (a fresh delivery still re-enqueues unconditionally).

  • #4021 ec57aff Thanks @​VaguelySerious! - When logging corrupt event logs due to replay divergence, specify the divergent events, and carry error message through retries

  • #4096 6cc851c Thanks @​pranaygp! - Stop sending a slot snapshot (eventCount) on step executor writes, so a World no longer reads and returns a skipped-slot event page that the executor only discards.

  • #3891 c29200f Thanks @​NathanColosimo! - Route Workflow AI examples through AI Gateway and recommend WorkflowAgent for Workflow 5.

  • #3843 938c7ff Thanks @​Rich-Harris! - Bump devalue to 5.9.2 to address published security advisory.

  • #3838 e00b1a5 Thanks @​pranaygp! - Publish a fan-out's step-execution messages in one batched queue request instead of one per step, via a new optional Queue.queueBatch implemented on @vercel/queue's experimental_sendBatch.

  • #4106 357aa7c Thanks @​VaguelySerious! - The QuickJS engine now reports its log position on writes and feeds its VM from the events a World returns on the response, matching the node:vm engine.

  • #4066 3aa4c16 Thanks @​alangenfeld! - Add bounded trace attributes identifying lazy step-start claim strategies and ownership stamps.

  • #3941 c09c1bb Thanks @​alangenfeld! - Wait for writes queued by released step stream writers to reach durable storage before recording step completion.

... (truncated)

Commits
  • 6e8071d Version Packages (beta) (#4170)
  • 5dbbcf9 fix: retry backend connection failures and improve error logs (#4179)
  • 56322af fix(core): start forwarded writable key lookup on first write (#4175)
  • c896cbd Version Packages (beta) (#4142)
  • 37f1011 fix(core): render the error stack in the run-failure log (#4145)
  • d427c47 fix(core): allow Next.js route groups and dynamic segments in workflow names ...
  • fe8b27d Version Packages (beta) (#4071)
  • 03455a2 Carry run identity on step-dispatch messages; drop the blocking runs.get from...
  • fb9e275 perf(core): commit pre-claimed inline pairs in their own batch chunk (#4098)
  • 080c592 test: persist E2E flake history (#4120)
  • Additional commits viewable in compare view

Updates workflow from 5.0.0-beta.25 to 5.0.0-beta.53

Release notes

Sourced from workflow's releases.

workflow@5.0.0-beta.53

@​workflow/core@​5.0.0-beta.53

  • #4175 56322af @​pranaygp - Fix an unhandled rejection that could exit the process when the encryption-key lookup for a forwarded writable stream failed (for example a run metadata read that timed out) before anything was written to that stream. The lookup now starts on the first write, and a failure rejects that stream instead.
  • #4179 5dbbcf9 @​karthikscale3 - Route unrecognized backend connection and stream failures through existing retry policies, preserving event-write retries and rebuilding shared event connections after repeated HTTP/2 failures. Keep invalid request headers and caller cancellations out of event-write retries. Include error cause chains in run-failure logs to expose underlying socket, DNS, and TLS failures.

@​workflow/world-postgres@​5.0.0-beta.44

  • #3712 5f723b3 @​himself65 - Fix readFromStream erroring when rows were written after the stream's first EOF marker. Rows past the first EOF are now ignored consistently across streams.get(), getChunks(), and getInfo().

@​workflow/world-vercel@​5.0.0-beta.48

  • #4179 5dbbcf9 @​karthikscale3 - Route unrecognized backend connection and stream failures through existing retry policies, preserving event-write retries and rebuilding shared event connections after repeated HTTP/2 failures. Keep invalid request headers and caller cancellations out of event-write retries. Include error cause chains in run-failure logs to expose underlying socket, DNS, and TLS failures.

workflow@5.0.0-beta.52

@​workflow/core@​5.0.0-beta.52

  • #4145 37f1011 @​pranaygp - Render the errorStack field as the log body when the message carries no stack of its own, so the run-failure log shows the stack instead of discarding it.
  • #4070 d427c47 @​torsello - Allow parentheses and square brackets in workflow names, so workflows can live in Next.js route groups (app/(dashboard)/…) and dynamic segments (app/[teamId]/…).

@​workflow/world@​5.0.0-beta.36

  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/world-local@​5.0.0-beta.45

  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/world-postgres@​5.0.0-beta.43

  • #4114 cc9a4cf @​komly - Queue deliveries no longer inherit fetch's 300s headers/body deadlines, which redelivered healthy long-running inline work while it was still executing. Deadlines can be set with WORKFLOW_POSTGRES_HEADERS_TIMEOUT_MS and WORKFLOW_POSTGRES_BODY_TIMEOUT_MS.
  • #4117 2883509 @​komly - Preserve error names, messages, stacks, and nested causes in Graphile Worker log metadata.
  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/world-vercel@​5.0.0-beta.47

  • #3707 79e7436 @​unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@​workflow/nest@​5.0.0-beta.52

workflow@5.0.0-beta.51

@​workflow/core@​5.0.0-beta.51

  • #3457 03455a2 @​TooTallNate - Carry immutable run identity on step-execution queue messages to skip the blocking runs.get before starting a step, fetching the run row only when continuing into replay. Messages without runContext keep the previous behavior.
  • #4098 fb9e275 @​pranaygp - Commit the batched fan-out's pre-claimed inline [step_created, step_started] pairs in their own leading chunk, ahead of the plain step/wait creates, so the write that gates the inline bodies stays small and commits faster. The pairs now fold only with two or more inline steps (a lone inline step keeps the lazy start), and a lone plain create beside them takes the single write.
  • #4099 788d4fb @​pranaygp - Skip re-publishing a pending step's execution message on a later replay pass when this same invocation already published it (a fresh delivery still re-enqueues unconditionally).
  • #4021 ec57aff @​VaguelySerious - When logging corrupt event logs due to replay divergence, specify the divergent events, and carry error message through retries
  • #4096 6cc851c @​pranaygp - Stop sending a slot snapshot (eventCount) on step executor writes, so a World no longer reads and returns a skipped-slot event page that the executor only discards.

... (truncated)

Changelog

Sourced from workflow's changelog.

5.0.0-beta.53

Patch Changes

  • Updated dependencies [56322af, 5dbbcf9]:
    • @​workflow/core@​5.0.0-beta.53
    • @​workflow/cli@​5.0.0-beta.53
    • @​workflow/next@​5.0.0-beta.53
    • @​workflow/nitro@​5.0.0-beta.53
    • @​workflow/typescript-plugin@​5.0.0-beta.5
    • @​workflow/astro@​5.0.0-beta.53
    • @​workflow/nest@​5.0.0-beta.53
    • @​workflow/rollup@​5.0.0-beta.53
    • @​workflow/sveltekit@​5.0.0-beta.53
    • @​workflow/nuxt@​5.0.0-beta.53

5.0.0-beta.52

Patch Changes

  • Updated dependencies [93e76fc, 37f1011, d427c47]:
    • @​workflow/nest@​5.0.0-beta.52
    • @​workflow/core@​5.0.0-beta.52
    • @​workflow/cli@​5.0.0-beta.52
    • @​workflow/next@​5.0.0-beta.52
    • @​workflow/nitro@​5.0.0-beta.52
    • @​workflow/typescript-plugin@​5.0.0-beta.5
    • @​workflow/errors@​5.0.0-beta.21
    • @​workflow/astro@​5.0.0-beta.52
    • @​workflow/rollup@​5.0.0-beta.52
    • @​workflow/sveltekit@​5.0.0-beta.52
    • @​workflow/nuxt@​5.0.0-beta.52

5.0.0-beta.51

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump devalue, @workflow/core and workflow
aefaad1 
Bumps [devalue](https://github.com/sveltejs/devalue) to 5.9.2 and updates ancestor dependencies [devalue](https://github.com/sveltejs/devalue), [@workflow/core](https://github.com/vercel/workflow/tree/HEAD/packages/core) and [workflow](https://github.com/vercel/workflow/tree/HEAD/packages/workflow). These dependencies need to be updated together.


Updates `devalue` from 5.8.1 to 5.9.2
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.8.1...v5.9.2)

Updates `@workflow/core` from 5.0.0-beta.25 to 5.0.0-beta.53
- [Release notes](https://github.com/vercel/workflow/releases)
- [Changelog](https://github.com/vercel/workflow/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/vercel/workflow/commits/@workflow/core@5.0.0-beta.53/packages/core)

Updates `workflow` from 5.0.0-beta.25 to 5.0.0-beta.53
- [Release notes](https://github.com/vercel/workflow/releases)
- [Changelog](https://github.com/vercel/workflow/blob/main/packages/workflow/CHANGELOG.md)
- [Commits](https://github.com/vercel/workflow/commits/workflow@5.0.0-beta.53/packages/workflow)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.9.2
  dependency-type: indirect
- dependency-name: "@workflow/core"
  dependency-version: 5.0.0-beta.53
  dependency-type: direct:production
- dependency-name: workflow
  dependency-version: 5.0.0-beta.53
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 18, 2026
@ecc-tools

ecc-tools Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

ECC Tools / Security Evidence

Commit: aefaad17b720ae17fd7b6839494c54e160062ad4

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 2 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

@coderabbitai

coderabbitai Bot commented Sep 18, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a6f80c38-d6e4-48c9-a3f7-deef17ff0bb1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ecc-tools

ecc-tools Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

ECC Tools / PR Risk Taxonomy

Commit: aefaad17b720ae17fd7b6839494c54e160062ad4

PR taxonomy review recommended (neutral)

Detected 2 PR taxonomy bucket(s): Install Manifest Integrity, CI/CD Recommendation.

Scanned 2 changed file(s).

Roadmap taxonomy buckets:

Install Manifest Integrity

Install manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance.

Signals:

  • 1 install or manifest path(s) changed

Paths:

  • package-lock.json

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

  • 1 CI or workflow path(s) changed

Paths:

  • package-lock.json

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

@ecc-tools

ecc-tools Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

ECC Tools / Reference Set Readiness

Commit: aefaad17b720ae17fd7b6839494c54e160062ad4

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 2 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area Status Evidence / Next Step
Deep analyzer corpus Missing Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison Missing Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus Missing Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus Missing Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility Missing Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence Missing Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence Missing Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

@ecc-tools

ecc-tools Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

ECC Tools / Hosted Promotion Readiness

Commit: aefaad17b720ae17fd7b6839494c54e160062ad4

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 2 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants