Skip to content

Strengthen deterministic VM seed with additional run metadata#1269

Merged
pranaygp merged 2 commits into
mainfrom
fix/vuln-7038-strengthen-prng-seed
Mar 5, 2026
Merged

Strengthen deterministic VM seed with additional run metadata#1269
pranaygp merged 2 commits into
mainfrom
fix/vuln-7038-strengthen-prng-seed

Conversation

@pranaygp
Copy link
Copy Markdown
Contributor

@pranaygp pranaygp commented Mar 5, 2026

Summary

  • Derives the PRNG seed from runId, workflowName, and startedAt instead of runId alone
  • Makes the seed harder to predict from any single piece of publicly exposed run information

Test plan

  • Existing unit tests updated and passing

🤖 Generated with Claude Code

@TooTallNate @pranaygp
Strengthen deterministic VM seed with additional run metadata
7e8059c 
Derive the PRNG seed from runId, workflowName, and startedAt instead of
runId alone. This makes the seed harder to predict from any single
piece of publicly exposed run information.
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Mar 5, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
example-nextjs-workflow-turbopack Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
example-nextjs-workflow-webpack Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
example-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-astro-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-express-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-fastify-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-hono-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-nitro-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-nuxt-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-sveltekit-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workbench-vite-workflow Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workflow-docs Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workflow-nest Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm
workflow-swc-playground Ready Ready Preview, Comment, Open in v0 Mar 5, 2026 6:48pm

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Mar 5, 2026 •
edited
Loading

🦋 Changeset detected

Latest commit: 61f6baa

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages
Name Type
@workflow/core Patch
@workflow/builders Patch
@workflow/cli Patch
@workflow/next Patch
@workflow/nitro Patch
@workflow/web-shared Patch
workflow Patch
@workflow/world-testing Patch
@workflow/astro Patch
@workflow/nest Patch
@workflow/rollup Patch
@workflow/sveltekit Patch
@workflow/vite Patch
@workflow/nuxt Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pranaygp pranaygp requested a review from TooTallNate March 5, 2026 18:36
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 5, 2026 •
edited
Loading

🧪 E2E Test Results

❌ Some tests failed

Summary

Passed Failed Skipped Total
✅ ▲ Vercel Production 538 0 67 605
❌ 💻 Local Development 564 12 84 660
❌ 📦 Local Production 564 12 84 660
❌ 🐘 Local Postgres 564 12 84 660
❌ 🪟 Windows 51 1 3 55
❌ 🌍 Community Worlds 116 49 15 180
❌ 📋 Other 135 3 27 165
Total 2532 89 364 2985

❌ Failed Tests

💻 Local Development (12 failed)

astro-stable (1 failed):

  • webhookWorkflow

express-stable (1 failed):

  • webhookWorkflow

fastify-stable (1 failed):

  • webhookWorkflow

hono-stable (1 failed):

  • webhookWorkflow

nextjs-turbopack-canary (1 failed):

  • webhookWorkflow

nextjs-turbopack-stable (1 failed):

  • webhookWorkflow

nextjs-webpack-canary (1 failed):

  • webhookWorkflow

nextjs-webpack-stable (1 failed):

  • webhookWorkflow

nitro-stable (1 failed):

  • webhookWorkflow

nuxt-stable (1 failed):

  • webhookWorkflow

sveltekit-stable (1 failed):

  • webhookWorkflow

vite-stable (1 failed):

  • webhookWorkflow
📦 Local Production (12 failed)

astro-stable (1 failed):

  • webhookWorkflow

express-stable (1 failed):

  • webhookWorkflow

fastify-stable (1 failed):

  • webhookWorkflow

hono-stable (1 failed):

  • webhookWorkflow

nextjs-turbopack-canary (1 failed):

  • webhookWorkflow

nextjs-turbopack-stable (1 failed):

  • webhookWorkflow

nextjs-webpack-canary (1 failed):

  • webhookWorkflow

nextjs-webpack-stable (1 failed):

  • webhookWorkflow

nitro-stable (1 failed):

  • webhookWorkflow

nuxt-stable (1 failed):

  • webhookWorkflow

sveltekit-stable (1 failed):

  • webhookWorkflow

vite-stable (1 failed):

  • webhookWorkflow
🐘 Local Postgres (12 failed)

astro-stable (1 failed):

  • webhookWorkflow

express-stable (1 failed):

  • webhookWorkflow

fastify-stable (1 failed):

  • webhookWorkflow

hono-stable (1 failed):

  • webhookWorkflow

nextjs-turbopack-canary (1 failed):

  • webhookWorkflow

nextjs-turbopack-stable (1 failed):

  • webhookWorkflow

nextjs-webpack-canary (1 failed):

  • webhookWorkflow

nextjs-webpack-stable (1 failed):

  • webhookWorkflow

nitro-stable (1 failed):

  • webhookWorkflow

nuxt-stable (1 failed):

  • webhookWorkflow

sveltekit-stable (1 failed):

  • webhookWorkflow

vite-stable (1 failed):

  • webhookWorkflow
🪟 Windows (1 failed)

nextjs-turbopack (1 failed):

  • webhookWorkflow
🌍 Community Worlds (49 failed)

mongodb (1 failed):

  • webhookWorkflow

turso (48 failed):

  • addTenWorkflow
  • addTenWorkflow
  • wellKnownAgentWorkflow (.well-known/agent)
  • should work with react rendering in step
  • promiseAllWorkflow
  • promiseRaceWorkflow
  • promiseAnyWorkflow
  • importedStepOnlyWorkflow
  • hookWorkflow
  • webhookWorkflow
  • sleepingWorkflow
  • parallelSleepWorkflow
  • nullByteWorkflow
  • workflowAndStepMetadataWorkflow
  • fetchWorkflow
  • promiseRaceStressTestWorkflow
  • error handling error propagation workflow errors nested function calls preserve message and stack trace
  • error handling error propagation workflow errors cross-file imports preserve message and stack trace
  • error handling error propagation step errors basic step error preserves message and stack trace
  • error handling error propagation step errors cross-file step error preserves message and function names in stack
  • error handling retry behavior regular Error retries until success
  • error handling retry behavior FatalError fails immediately without retries
  • error handling retry behavior RetryableError respects custom retryAfter delay
  • error handling retry behavior maxRetries=0 disables retries
  • error handling retry behavior workflow completes despite transient 5xx on step_completed
  • error handling catchability FatalError can be caught and detected with FatalError.is()
  • hookCleanupTestWorkflow - hook token reuse after workflow completion
  • concurrent hook token conflict - two workflows cannot use the same hook token simultaneously
  • hookDisposeTestWorkflow - hook token reuse after explicit disposal while workflow still running
  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
  • stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
  • closureVariableWorkflow - nested step functions with closure variables
  • spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
  • health check (queue-based) - workflow and step endpoints respond to health check messages
  • pathsAliasWorkflow - TypeScript path aliases resolve correctly
  • Calculator.calculate - static workflow method using static step methods from another class
  • AllInOneService.processNumber - static workflow method using sibling static step methods
  • ChainableService.processWithThis - static step methods using this to reference the class
  • thisSerializationWorkflow - step function invoked with .call() and .apply()
  • customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE
  • instanceMethodStepWorkflow - instance methods with "use step" directive
  • crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context
  • stepFunctionAsStartArgWorkflow - step function reference passed as start() argument
  • cancelRun - cancelling a running workflow
  • cancelRun via CLI - cancelling a running workflow
  • pages router addTenWorkflow via pages router
  • pages router promiseAllWorkflow via pages router
  • pages router sleepingWorkflow via pages router
📋 Other (3 failed)

e2e-local-dev-nest-stable (1 failed):

  • webhookWorkflow

e2e-local-postgres-nest-stable (1 failed):

  • webhookWorkflow

e2e-local-prod-nest-stable (1 failed):

  • webhookWorkflow

Details by Category

✅ ▲ Vercel Production
App Passed Failed Skipped
✅ astro 48 0 7
✅ example 48 0 7
✅ express 48 0 7
✅ fastify 48 0 7
✅ hono 48 0 7
✅ nextjs-turbopack 53 0 2
✅ nextjs-webpack 53 0 2
✅ nitro 48 0 7
✅ nuxt 48 0 7
✅ sveltekit 48 0 7
✅ vite 48 0 7
❌ 💻 Local Development
App Passed Failed Skipped
❌ astro-stable 45 1 9
❌ express-stable 45 1 9
❌ fastify-stable 45 1 9
❌ hono-stable 45 1 9
❌ nextjs-turbopack-canary 51 1 3
❌ nextjs-turbopack-stable 51 1 3
❌ nextjs-webpack-canary 51 1 3
❌ nextjs-webpack-stable 51 1 3
❌ nitro-stable 45 1 9
❌ nuxt-stable 45 1 9
❌ sveltekit-stable 45 1 9
❌ vite-stable 45 1 9
❌ 📦 Local Production
App Passed Failed Skipped
❌ astro-stable 45 1 9
❌ express-stable 45 1 9
❌ fastify-stable 45 1 9
❌ hono-stable 45 1 9
❌ nextjs-turbopack-canary 51 1 3
❌ nextjs-turbopack-stable 51 1 3
❌ nextjs-webpack-canary 51 1 3
❌ nextjs-webpack-stable 51 1 3
❌ nitro-stable 45 1 9
❌ nuxt-stable 45 1 9
❌ sveltekit-stable 45 1 9
❌ vite-stable 45 1 9
❌ 🐘 Local Postgres
App Passed Failed Skipped
❌ astro-stable 45 1 9
❌ express-stable 45 1 9
❌ fastify-stable 45 1 9
❌ hono-stable 45 1 9
❌ nextjs-turbopack-canary 51 1 3
❌ nextjs-turbopack-stable 51 1 3
❌ nextjs-webpack-canary 51 1 3
❌ nextjs-webpack-stable 51 1 3
❌ nitro-stable 45 1 9
❌ nuxt-stable 45 1 9
❌ sveltekit-stable 45 1 9
❌ vite-stable 45 1 9
❌ 🪟 Windows
App Passed Failed Skipped
❌ nextjs-turbopack 51 1 3
❌ 🌍 Community Worlds
App Passed Failed Skipped
✅ mongodb-dev 3 0 2
❌ mongodb 51 1 3
✅ redis-dev 3 0 2
✅ redis 52 0 3
✅ turso-dev 3 0 2
❌ turso 4 48 3
❌ 📋 Other
App Passed Failed Skipped
❌ e2e-local-dev-nest-stable 45 1 9
❌ e2e-local-postgres-nest-stable 45 1 9
❌ e2e-local-prod-nest-stable 45 1 9

📋 View full workflow run

❌ Some E2E test jobs failed:

  • Vercel Prod: success
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: failure
  • Windows: failure

Check the workflow run for details.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 5, 2026 •
edited
Loading

📊 Benchmark Results

📈 Comparing against baseline from main branch. Green 🟢 = faster, Red 🔺 = slower.

workflow with no steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
💻 Local 🥇 Express 0.027s (-18.2% 🟢) 1.005s (~) 0.979s 10 1.00x
💻 Local Nitro 0.034s (+29.6% 🔺) 1.006s (~) 0.972s 10 1.27x
🌐 Redis Next.js (Turbopack) 0.037s (-19.9% 🟢) 1.005s (~) 0.968s 10 1.39x
💻 Local Next.js (Turbopack) 0.042s (+2.2%) 1.006s (~) 0.964s 10 1.56x
🐘 Postgres Next.js (Turbopack) 0.048s 1.011s 0.964s 10 1.79x
🐘 Postgres Nitro 0.057s (-1.2%) 1.013s (~) 0.956s 10 2.14x
🐘 Postgres Express 0.057s (+9.2% 🔺) 1.013s (~) 0.956s 10 2.14x
🌐 MongoDB Next.js (Turbopack) 0.111s (-8.0% 🟢) 1.008s (~) 0.897s 10 4.16x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 1.242s (+60.1% 🔺) 6.963s (+77.1% 🔺) 5.721s 10 1.00x
▲ Vercel Express 1.584s (+94.3% 🔺) 6.204s (+43.5% 🔺) 4.620s 10 1.28x
▲ Vercel Next.js (Turbopack) 1.673s (+83.6% 🔺) 6.524s (+60.1% 🔺) 4.851s 10 1.35x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 1 step

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
💻 Local 🥇 Express 1.072s (-2.8%) 2.007s (~) 0.934s 10 1.00x
🌐 Redis Next.js (Turbopack) 1.091s (-1.3%) 2.007s (~) 0.916s 10 1.02x
💻 Local Next.js (Turbopack) 1.097s (~) 2.006s (~) 0.909s 10 1.02x
💻 Local Nitro 1.107s (+3.6%) 2.007s (~) 0.899s 10 1.03x
🐘 Postgres Next.js (Turbopack) 1.120s 2.012s 0.892s 10 1.04x
🐘 Postgres Express 1.133s (+1.3%) 2.013s (~) 0.880s 10 1.06x
🐘 Postgres Nitro 1.133s (~) 2.013s (~) 0.880s 10 1.06x
🌐 MongoDB Next.js (Turbopack) 1.288s (-0.6%) 2.008s (~) 0.720s 10 1.20x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Next.js (Turbopack) 2.702s (+11.1% 🔺) 7.044s (+36.9% 🔺) 4.342s 10 1.00x
▲ Vercel Nitro 3.017s (+12.7% 🔺) 7.600s (+19.0% 🔺) 4.582s 10 1.12x
▲ Vercel Express 3.419s (+29.6% 🔺) 7.921s (+38.5% 🔺) 4.502s 10 1.27x

🔍 Observability: Next.js (Turbopack) | Nitro | Express

workflow with 10 sequential steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🌐 Redis 🥇 Next.js (Turbopack) 10.494s (-1.3%) 11.023s (~) 0.529s 3 1.00x
💻 Local Express 10.526s (-2.3%) 11.025s (~) 0.499s 3 1.00x
💻 Local Next.js (Turbopack) 10.681s (~) 11.023s (~) 0.342s 3 1.02x
🐘 Postgres Next.js (Turbopack) 10.760s 11.043s 0.283s 3 1.03x
💻 Local Nitro 10.804s (+3.0%) 11.023s (~) 0.219s 3 1.03x
🐘 Postgres Nitro 10.868s (~) 11.047s (~) 0.179s 3 1.04x
🐘 Postgres Express 10.894s (+0.9%) 11.048s (~) 0.154s 3 1.04x
🌐 MongoDB Next.js (Turbopack) 12.200s (-0.6%) 13.020s (~) 0.819s 3 1.16x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Next.js (Turbopack) 18.826s (+8.7% 🔺) 24.641s (+15.7% 🔺) 5.815s 2 1.00x
▲ Vercel Express 18.835s (+10.5% 🔺) 24.267s (+20.5% 🔺) 5.431s 2 1.00x
▲ Vercel Nitro 18.973s (+11.3% 🔺) 24.564s (+23.9% 🔺) 5.592s 2 1.01x

🔍 Observability: Next.js (Turbopack) | Express | Nitro

workflow with 25 sequential steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🌐 Redis 🥇 Next.js (Turbopack) 26.192s (-1.6%) 27.051s (~) 0.859s 3 1.00x
💻 Local Express 26.541s (-2.4%) 27.054s (-3.6%) 0.513s 3 1.01x
🐘 Postgres Next.js (Turbopack) 26.787s 27.058s 0.271s 3 1.02x
💻 Local Next.js (Turbopack) 26.901s (~) 27.051s (~) 0.150s 3 1.03x
🐘 Postgres Nitro 27.006s (~) 27.069s (~) 0.063s 3 1.03x
🐘 Postgres Express 27.051s (~) 27.399s (+1.2%) 0.348s 3 1.03x
💻 Local Nitro 27.226s (+2.9%) 28.052s (+3.7%) 0.826s 3 1.04x
🌐 MongoDB Next.js (Turbopack) 30.297s (-0.9%) 31.032s (~) 0.735s 2 1.16x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 44.931s (+1.1%) 48.629s (-3.4%) 3.698s 2 1.00x
▲ Vercel Express 45.320s (+0.5%) 50.639s (~) 5.319s 2 1.01x
▲ Vercel Next.js (Turbopack) 46.870s (+2.5%) 50.510s (+0.8%) 3.640s 2 1.04x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

workflow with 50 sequential steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🌐 Redis 🥇 Next.js (Turbopack) 52.343s (-1.2%) 53.098s (~) 0.754s 2 1.00x
🐘 Postgres Next.js (Turbopack) 53.568s 54.100s 0.532s 2 1.02x
🐘 Postgres Express 53.879s (~) 54.108s (~) 0.229s 2 1.03x
🐘 Postgres Nitro 53.907s (~) 54.099s (~) 0.192s 2 1.03x
💻 Local Express 54.410s (-3.1%) 55.103s (-3.5%) 0.693s 2 1.04x
💻 Local Next.js (Turbopack) 55.497s (~) 56.100s (~) 0.603s 2 1.06x
💻 Local Nitro 56.266s (+3.5%) 57.106s (+3.6%) 0.841s 2 1.07x
🌐 MongoDB Next.js (Turbopack) 60.605s (-0.6%) 61.062s (~) 0.458s 2 1.16x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 94.041s (-3.4%) 100.402s (+1.3%) 6.361s 1 1.00x
▲ Vercel Express 94.881s (-2.0%) 97.824s (-2.1%) 2.943s 1 1.01x
▲ Vercel Next.js (Turbopack) 101.342s (+2.6%) 105.374s (+2.6%) 4.032s 1 1.08x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Promise.all with 10 concurrent steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🌐 Redis 🥇 Next.js (Turbopack) 1.197s (-3.6%) 2.006s (~) 0.809s 15 1.00x
💻 Local Express 1.337s (-6.7% 🟢) 2.005s (~) 0.668s 15 1.12x
🐘 Postgres Next.js (Turbopack) 1.370s 2.011s 0.641s 15 1.14x
🐘 Postgres Nitro 1.376s (+1.6%) 2.011s (~) 0.635s 15 1.15x
🐘 Postgres Express 1.378s (+1.3%) 2.012s (~) 0.634s 15 1.15x
💻 Local Next.js (Turbopack) 1.408s (~) 2.005s (~) 0.597s 15 1.18x
💻 Local Nitro 1.424s (+6.3% 🔺) 2.006s (~) 0.582s 15 1.19x
🌐 MongoDB Next.js (Turbopack) 2.139s (-1.0%) 3.008s (~) 0.869s 10 1.79x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 2.537s (-29.2% 🟢) 5.481s (-3.5%) 2.944s 6 1.00x
▲ Vercel Express 3.051s (+0.7%) 6.056s (+2.8%) 3.005s 5 1.20x
▲ Vercel Next.js (Turbopack) 3.131s (-15.7% 🟢) 6.020s (-2.5%) 2.889s 5 1.23x

🔍 Observability: Nitro | Express | Next.js (Turbopack)

Promise.all with 25 concurrent steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🐘 Postgres 🥇 Next.js (Turbopack) 1.987s 2.513s 0.527s 12 1.00x
🐘 Postgres Nitro 2.008s (-4.0%) 2.682s (+3.3%) 0.674s 12 1.01x
🐘 Postgres Express 2.087s (+9.4% 🔺) 2.750s (+14.7% 🔺) 0.663s 11 1.05x
💻 Local Express 2.317s (-11.9% 🟢) 3.007s (~) 0.690s 10 1.17x
🌐 Redis Next.js (Turbopack) 2.408s (-3.3%) 3.008s (~) 0.600s 10 1.21x
💻 Local Next.js (Turbopack) 2.595s (+2.4%) 3.008s (~) 0.413s 10 1.31x
💻 Local Nitro 2.711s (+17.8% 🔺) 3.007s (~) 0.297s 10 1.36x
🌐 MongoDB Next.js (Turbopack) 4.604s (-4.7%) 5.177s (~) 0.573s 6 2.32x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Express 3.092s (-29.9% 🟢) 6.081s (-32.9% 🟢) 2.988s 5 1.00x
▲ Vercel Nitro 3.169s (-9.3% 🟢) 5.849s (-15.1% 🟢) 2.680s 6 1.02x
▲ Vercel Next.js (Turbopack) 3.647s (+3.6%) 6.584s (-13.6% 🟢) 2.937s 5 1.18x

🔍 Observability: Express | Nitro | Next.js (Turbopack)

Promise.all with 50 concurrent steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🐘 Postgres 🥇 Next.js (Turbopack) 3.938s 4.593s 0.655s 7 1.00x
🌐 Redis Next.js (Turbopack) 3.978s (-5.3% 🟢) 4.260s (-15.0% 🟢) 0.281s 8 1.01x
🐘 Postgres Express 4.152s (+16.9% 🔺) 4.742s (+6.4% 🔺) 0.589s 7 1.05x
🐘 Postgres Nitro 4.188s (+22.8% 🔺) 4.747s (+14.6% 🔺) 0.559s 7 1.06x
💻 Local Express 6.202s (-18.2% 🟢) 7.016s (-12.5% 🟢) 0.814s 5 1.57x
💻 Local Next.js (Turbopack) 7.453s (+9.5% 🔺) 8.015s (+6.7% 🔺) 0.562s 4 1.89x
💻 Local Nitro 8.253s (+33.4% 🔺) 9.025s (+28.6% 🔺) 0.772s 4 2.10x
🌐 MongoDB Next.js (Turbopack) 9.819s (-3.5%) 10.348s (-3.1%) 0.529s 3 2.49x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Express 3.482s (-4.9%) 6.760s (-4.4%) 3.278s 5 1.00x
▲ Vercel Next.js (Turbopack) 3.605s (-7.0% 🟢) 6.131s (-7.6% 🟢) 2.525s 5 1.04x
▲ Vercel Nitro 4.610s (+25.0% 🔺) 7.725s (+25.9% 🔺) 3.115s 4 1.32x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Promise.race with 10 concurrent steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🌐 Redis 🥇 Next.js (Turbopack) 1.199s (-3.1%) 2.006s (~) 0.807s 15 1.00x
💻 Local Express 1.352s (-7.0% 🟢) 2.005s (~) 0.653s 15 1.13x
🐘 Postgres Next.js (Turbopack) 1.377s 2.011s 0.634s 15 1.15x
🐘 Postgres Express 1.391s (+3.5%) 2.013s (~) 0.621s 15 1.16x
🐘 Postgres Nitro 1.417s (+4.3%) 2.012s (~) 0.596s 15 1.18x
💻 Local Next.js (Turbopack) 1.467s (+4.1%) 2.006s (~) 0.539s 15 1.22x
💻 Local Nitro 1.480s (+9.6% 🔺) 2.005s (~) 0.525s 15 1.23x
🌐 MongoDB Next.js (Turbopack) 2.205s (+1.6%) 3.007s (~) 0.803s 10 1.84x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 2.693s (-5.5% 🟢) 5.630s (+4.9%) 2.936s 6 1.00x
▲ Vercel Next.js (Turbopack) 2.710s (-12.8% 🟢) 6.253s (-10.8% 🟢) 3.544s 5 1.01x
▲ Vercel Express 2.995s (-10.3% 🟢) 5.020s (-23.6% 🟢) 2.025s 6 1.11x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 25 concurrent steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🐘 Postgres 🥇 Express 2.002s (-1.7%) 2.518s (+1.6%) 0.515s 12 1.00x
🐘 Postgres Nitro 2.035s (+1.5%) 2.601s (~) 0.566s 12 1.02x
🐘 Postgres Next.js (Turbopack) 2.075s 2.512s 0.437s 12 1.04x
💻 Local Express 2.377s (-13.3% 🟢) 3.008s (~) 0.631s 10 1.19x
🌐 Redis Next.js (Turbopack) 2.392s (-4.5%) 3.008s (~) 0.616s 10 1.19x
💻 Local Next.js (Turbopack) 2.784s (+4.2%) 3.109s (+3.4%) 0.325s 10 1.39x
💻 Local Nitro 2.832s (+20.1% 🔺) 3.009s (~) 0.176s 10 1.41x
🌐 MongoDB Next.js (Turbopack) 4.752s (+1.1%) 5.176s (~) 0.424s 6 2.37x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 2.753s (-22.2% 🟢) 5.667s (-42.7% 🟢) 2.914s 6 1.00x
▲ Vercel Next.js (Turbopack) 2.777s (-33.3% 🟢) 5.192s (-48.5% 🟢) 2.415s 6 1.01x
▲ Vercel Express 3.138s (-1.3%) 6.157s (-40.7% 🟢) 3.019s 5 1.14x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Promise.race with 50 concurrent steps

💻 Local Development

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
🐘 Postgres 🥇 Express 3.515s (-5.6% 🟢) 4.310s (-2.1%) 0.795s 7 1.00x
🐘 Postgres Nitro 3.526s (~) 4.449s (+4.2%) 0.922s 7 1.00x
🐘 Postgres Next.js (Turbopack) 3.741s 4.305s 0.564s 7 1.06x
🌐 Redis Next.js (Turbopack) 3.964s (-7.1% 🟢) 4.296s (-14.3% 🟢) 0.332s 7 1.13x
💻 Local Express 6.849s (-15.8% 🟢) 7.015s (-20.0% 🟢) 0.166s 5 1.95x
💻 Local Next.js (Turbopack) 7.503s (-0.6%) 7.767s (-3.1%) 0.264s 4 2.13x
💻 Local Nitro 8.117s (+20.2% 🔺) 9.021s (+28.6% 🔺) 0.904s 4 2.31x
🌐 MongoDB Next.js (Turbopack) 9.749s (-1.1%) 10.346s (~) 0.597s 3 2.77x

▲ Production (Vercel)

World Framework Workflow Time Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Nitro 3.729s (~) 6.337s (-20.6% 🟢) 2.607s 5 1.00x
▲ Vercel Next.js (Turbopack) 3.816s (~) 6.448s (-22.9% 🟢) 2.632s 5 1.02x
▲ Vercel Express 4.386s (-37.5% 🟢) 6.530s (-46.3% 🟢) 2.143s 5 1.18x

🔍 Observability: Nitro | Next.js (Turbopack) | Express

Stream Benchmarks (includes TTFB metrics)
workflow with stream

💻 Local Development

World Framework Workflow Time TTFB Slurp Wall Time Overhead Samples vs Fastest
💻 Local 🥇 Express 0.108s (-36.8% 🟢) 1.003s (~) 0.009s (-18.4% 🟢) 1.015s (~) 0.907s 10 1.00x
🌐 Redis Next.js (Turbopack) 0.117s (-18.7% 🟢) 1.000s (~) 0.001s (-7.7% 🟢) 1.007s (~) 0.890s 10 1.08x
💻 Local Next.js (Turbopack) 0.150s (+3.4%) 1.002s (~) 0.011s (~) 1.017s (~) 0.867s 10 1.40x
🐘 Postgres Next.js (Turbopack) 0.177s 1.001s 0.002s 1.012s 0.835s 10 1.65x
💻 Local Nitro 0.179s (+70.0% 🔺) 1.003s (~) 0.011s (+16.3% 🔺) 1.017s (~) 0.839s 10 1.66x
🐘 Postgres Express 0.195s (+5.2% 🔺) 0.996s (~) 0.002s (-21.1% 🟢) 1.013s (~) 0.818s 10 1.81x
🐘 Postgres Nitro 0.198s (+7.9% 🔺) 0.997s (+0.5%) 0.002s (+7.1% 🔺) 1.013s (~) 0.815s 10 1.84x
🌐 MongoDB Next.js (Turbopack) 0.512s (+3.4%) 0.930s (-2.2%) 0.001s (-13.3% 🟢) 1.009s (~) 0.497s 10 4.75x

▲ Production (Vercel)

World Framework Workflow Time TTFB Slurp Wall Time Overhead Samples vs Fastest
▲ Vercel 🥇 Express 2.274s (+12.4% 🔺) 4.949s (+44.9% 🔺) 0.156s (+55.3% 🔺) 6.334s (+38.1% 🔺) 4.060s 10 1.00x
▲ Vercel Next.js (Turbopack) 2.348s (+4.7%) 4.687s (+26.3% 🔺) 0.213s (+303.2% 🔺) 6.575s (+43.2% 🔺) 4.227s 10 1.03x
▲ Vercel Nitro 2.397s (+23.1% 🔺) 4.630s (+26.0% 🔺) 0.060s (-3.4%) 6.395s (+27.9% 🔺) 3.997s 10 1.05x

🔍 Observability: Express | Next.js (Turbopack) | Nitro

Summary

Fastest Framework by World

Winner determined by most benchmark wins

World 🥇 Fastest Framework Wins
💻 Local Express 12/12
🐘 Postgres Next.js (Turbopack) 10/12
▲ Vercel Nitro 7/12
Fastest World by Framework

Winner determined by most benchmark wins

Framework 🥇 Fastest World Wins
Express 💻 Local 7/12
Next.js (Turbopack) 🌐 Redis 8/12
Nitro 🐘 Postgres 8/12
Column Definitions
  • Workflow Time: Runtime reported by workflow (completedAt - createdAt) - primary metric
  • TTFB: Time to First Byte - time from workflow start until first stream byte received (stream benchmarks only)
  • Slurp: Time from first byte to complete stream consumption (stream benchmarks only)
  • Wall Time: Total testbench time (trigger workflow + poll for result)
  • Overhead: Testbench overhead (Wall Time - Workflow Time)
  • Samples: Number of benchmark iterations run
  • vs Fastest: How much slower compared to the fastest configuration for this benchmark

Worlds:

  • 💻 Local: In-memory filesystem world (local development)
  • 🐘 Postgres: PostgreSQL database world (local development)
  • ▲ Vercel: Vercel production/preview deployment
  • 🌐 Turso: Community world (local development)
  • 🌐 MongoDB: Community world (local development)
  • 🌐 Redis: Community world (local development)
  • 🌐 Jazz: Community world (local development)

📋 View full workflow run

@pranaygp pranaygp marked this pull request as ready for review March 5, 2026 18:37
@pranaygp pranaygp requested a review from a team as a code owner March 5, 2026 18:37
Copilot AI review requested due to automatic review settings March 5, 2026 18:37
@TooTallNate TooTallNate marked this pull request as draft March 5, 2026 18:37
@TooTallNate TooTallNate marked this pull request as ready for review March 5, 2026 18:37
@pranaygp
Copy link
Copy Markdown
Contributor Author

pranaygp commented Mar 5, 2026

e2e test failures unrelated to this change (also on main rn). will fix e2e tests separately

@pranaygp pranaygp merged commit a7ae7e9 into main Mar 5, 2026
60 of 102 checks passed
@pranaygp pranaygp deleted the fix/vuln-7038-strengthen-prng-seed branch March 5, 2026 19:03
@vercel-release-bot vercel-release-bot mentioned this pull request Mar 5, 2026
Merged
@pranaygp pranaygp review requested due to automatic review settings March 23, 2026 23:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TooTallNate TooTallNate TooTallNate approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pranaygp @TooTallNate