Skip to content

Conversation

@adriandlam
Copy link
Member

No description provided.

@changeset-bot
Copy link

changeset-bot bot commented Oct 28, 2025

⚠️ No Changeset found

Latest commit: d3b42ef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

💥 An error occurred when fetching the changed packages and changesets in this PR
Some errors occurred when validating the changesets config:
The package or glob expression "@workflow/example-hono" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.

@vercel
Copy link
Contributor

vercel bot commented Oct 28, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
example-nextjs-workflow-turbopack Ready Ready Preview Comment Oct 28, 2025 6:12pm
example-nextjs-workflow-webpack Ready Ready Preview Comment Oct 28, 2025 6:12pm
example-workflow Ready Ready Preview Comment Oct 28, 2025 6:12pm
workbench-nitro-workflow Ready Ready Preview Comment Oct 28, 2025 6:12pm
1 Skipped Deployment
Project Deployment Preview Comments Updated (UTC)
workflow-docs Skipped Skipped Oct 28, 2025 6:12pm

@socket-security
Copy link

socket-security bot commented Oct 28, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​workflow@​4.0.1-beta.4711008496100
Addednpm/​@​types/​node@​20.19.231001008195100
Addednpm/​hono@​4.10.31001009796100

View full report

bundle: false,
});

this.buildClientLibrary();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
this.buildClientLibrary();
await this.buildClientLibrary();

The buildClientLibrary() call is missing the await keyword, causing the build method to potentially return before the client library is finished building. This creates a race condition.

View Details

Analysis

Missing await in LocalBuilder.build() causes race condition with client library generation

What fails: LocalBuilder.build() completes and returns before buildClientLibrary() finishes writing the client library file to disk. Callers awaiting build() may immediately try to access the client library before it's been written, causing file not found errors.

How to reproduce:

// In any code using LocalBuilder
const builder = new LocalBuilder(config);
await builder.build();
// At this point, the client library file may not exist yet because buildClientLibrary() is not awaited
const clientLib = fs.readFileSync(config.clientBundlePath, 'utf-8');

Result: Potential FileNotFoundError when trying to access the client library file immediately after build() completes.

Expected: The build() method should not resolve until all async operations, including the client library generation, are complete. Per the method signature async build(): Promise<void>, callers expect a fully completed build when the promise resolves.

Evidence:

  • buildClientLibrary() is defined as protected async buildClientLibrary(): Promise<void> in BaseBuilder
  • The same operation is correctly awaited in StandaloneBuilder: await this.buildClientLibrary();
  • The same operation is correctly awaited in VercelBuildOutputAPIBuilder: await this.buildClientLibrary();
  • All other async operations in LocalBuilder.build() are properly awaited (lines 34, 41, 48)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants