Skip to content

Conversation

@adriandlam
Copy link
Member

@adriandlam adriandlam commented Nov 14, 2025

adds a new package @workflow/astro for supporting astro

waiting on Astro #14769 to be merged to resolve TypeError being thrown coming from undefined unhandled rejections

update: astro pr not needed if #384 is merged

@changeset-bot
Copy link

changeset-bot bot commented Nov 14, 2025

🦋 Changeset detected

Latest commit: cdfbe27

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
Name Type
@workflow/builders Patch
workflow Patch
@workflow/astro Patch
@workflow/cli Patch
@workflow/next Patch
@workflow/nitro Patch
@workflow/sveltekit Patch
@workflow/ai Patch
@workflow/world-testing Patch
@workflow/nuxt Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel
Copy link
Contributor

vercel bot commented Nov 14, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
example-nextjs-workflow-turbopack Ready Ready Preview Comment Nov 21, 2025 9:35pm
example-nextjs-workflow-webpack Ready Ready Preview Comment Nov 21, 2025 9:35pm
example-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-astro-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-express-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-hono-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-nitro-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-nuxt-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-sveltekit-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
workbench-vite-workflow Ready Ready Preview Comment Nov 21, 2025 9:35pm
1 Skipped Deployment
Project Deployment Preview Comments Updated (UTC)
workflow-docs Skipped Skipped Nov 21, 2025 9:35pm

@socket-security
Copy link

socket-security bot commented Nov 14, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​fumadocs-core@​16.0.14 ⏵ 16.0.1598 +110076 +196 +1100
Addednpm/​@​astrojs/​node@​9.5.01001008296100
Addednpm/​@​astrojs/​vercel@​9.0.1991008397100
Addednpm/​astro@​5.16.0971008898100
Addednpm/​srvx@​0.9.41001009996100
Updatednpm/​rollup@​4.53.2 ⏵ 4.53.39710010099100
Addednpm/​openai@​6.9.0100100100100100

View full report

@socket-security

This comment was marked as resolved.

Comment on lines +243 to +248
// Move past any routes with "continue: true" (like _astro cache headers)
while (
insertIndex < config.routes.length - 1 &&
config.routes[insertIndex + 1]?.continue === true
) {
insertIndex++;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// Move past any routes with "continue: true" (like _astro cache headers)
while (
insertIndex < config.routes.length - 1 &&
config.routes[insertIndex + 1]?.continue === true
) {
insertIndex++;
// If filesystem handler is not found, insert at the end of routes
if (insertIndex === -1) {
insertIndex = config.routes.length - 1;
} else {
// Move past any routes with "continue: true" (like _astro cache headers)
while (
insertIndex < config.routes.length - 1 &&
config.routes[insertIndex + 1]?.continue === true
) {
insertIndex++;
}

Missing error handling when the "filesystem" route handler is not found in Astro's vercel output configuration, which could cause workflow routes to be inserted at the incorrect position in the routes array.

View Details

Analysis

Missing error handling when filesystem route handler is not found in Astro Vercel output configuration

What fails: VercelBuilder.build() at line 239-252 in packages/astro/src/builder.ts uses findIndex() to locate the "filesystem" route handler without validating it exists. When the route is missing, findIndex() returns -1, causing workflow routes to be inserted at index 0 instead of after the filesystem handler.

How to reproduce: Create an Astro project with Vercel deployment where the config.json lacks a route with handle: 'filesystem'. This can occur if:

  1. Custom Astro/Vercel integration doesn't add the filesystem handler
  2. Routes array is empty or malformed
  3. Astro version generates config differently than expected

Run the builder:

const vercelBuilder = new VercelBuilder();
await vercelBuilder.build();

Result: When findIndex() returns -1:

  • Loop condition -1 < config.routes.length - 1 evaluates to true
  • insertIndex remains at -1
  • config.routes.splice(-1 + 1, 0, ...WORKFLOW_ROUTES) splices at index 0
  • Workflow routes are inserted at the beginning of the routes array, not after the filesystem handler

Expected: Workflow routes should be inserted after the filesystem handler or at a safe fallback position (end of routes array), ensuring proper route precedence.

Reference: JavaScript Array.findIndex() returns -1 when no element matches the predicate, as documented in MDN Array.prototype.findIndex()

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants