Skip to content

chore(deps): bump the temporal group with 5 updates#321

Merged
btravers merged 2 commits into
mainfrom
dependabot/npm_and_yarn/temporal-d384eb51e3
Jul 20, 2026
Merged

chore(deps): bump the temporal group with 5 updates#321
btravers merged 2 commits into
mainfrom
dependabot/npm_and_yarn/temporal-d384eb51e3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the temporal group with 5 updates:

Package From To
@temporalio/client 1.19.0 1.20.2
@temporalio/common 1.19.0 1.20.2
@temporalio/testing 1.19.0 1.20.2
@temporalio/worker 1.19.0 1.20.2
@temporalio/workflow 1.19.0 1.20.2

Updates @temporalio/client from 1.19.0 to 1.20.2

Release notes

Sourced from @​temporalio/client's releases.

v1.20.2

What's Changed

Full Changelog: temporalio/sdk-typescript@v1.20.1...v1.20.2

v1.20.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

v1.20.0

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

Full Changelog: temporalio/sdk-typescript@v1.19.0...v1.20.0

v1.19.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

Changelog

Sourced from @​temporalio/client's changelog.

[1.20.2] - 2026-07-08

Fixed

  • langsmith: resolve workflow interceptor module by absolute path

[1.20.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).

[1.20.0] - 2026-07-07

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

[1.19.2] - 2026-07-13

Fixed

  • Workflow Bundler: further strengthening of the __webpack_module_cache__ replacement logic, addressing regressions introduced by the fix in 1.19.1.

[1.19.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).
Commits

Updates @temporalio/common from 1.19.0 to 1.20.2

Release notes

Sourced from @​temporalio/common's releases.

v1.20.2

What's Changed

Full Changelog: temporalio/sdk-typescript@v1.20.1...v1.20.2

v1.20.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

v1.20.0

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

Full Changelog: temporalio/sdk-typescript@v1.19.0...v1.20.0

v1.19.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

Changelog

Sourced from @​temporalio/common's changelog.

[1.20.2] - 2026-07-08

Fixed

  • langsmith: resolve workflow interceptor module by absolute path

[1.20.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).

[1.20.0] - 2026-07-07

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

[1.19.2] - 2026-07-13

Fixed

  • Workflow Bundler: further strengthening of the __webpack_module_cache__ replacement logic, addressing regressions introduced by the fix in 1.19.1.

[1.19.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).
Commits

Updates @temporalio/testing from 1.19.0 to 1.20.2

Release notes

Sourced from @​temporalio/testing's releases.

v1.20.2

What's Changed

Full Changelog: temporalio/sdk-typescript@v1.20.1...v1.20.2

v1.20.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

v1.20.0

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

Full Changelog: temporalio/sdk-typescript@v1.19.0...v1.20.0

v1.19.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

Changelog

Sourced from @​temporalio/testing's changelog.

[1.20.2] - 2026-07-08

Fixed

  • langsmith: resolve workflow interceptor module by absolute path

[1.20.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).

[1.20.0] - 2026-07-07

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

[1.19.2] - 2026-07-13

Fixed

  • Workflow Bundler: further strengthening of the __webpack_module_cache__ replacement logic, addressing regressions introduced by the fix in 1.19.1.

[1.19.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).
Commits

Updates @temporalio/worker from 1.19.0 to 1.20.2

Release notes

Sourced from @​temporalio/worker's releases.

v1.20.2

What's Changed

Full Changelog: temporalio/sdk-typescript@v1.20.1...v1.20.2

v1.20.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

v1.20.0

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

Full Changelog: temporalio/sdk-typescript@v1.19.0...v1.20.0

v1.19.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

Changelog

Sourced from @​temporalio/worker's changelog.

[1.20.2] - 2026-07-08

Fixed

  • langsmith: resolve workflow interceptor module by absolute path

[1.20.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).

[1.20.0] - 2026-07-07

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

[1.19.2] - 2026-07-13

Fixed

  • Workflow Bundler: further strengthening of the __webpack_module_cache__ replacement logic, addressing regressions introduced by the fix in 1.19.1.

[1.19.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).
Commits

Updates @temporalio/workflow from 1.19.0 to 1.20.2

Release notes

Sourced from @​temporalio/workflow's releases.

v1.20.2

What's Changed

Full Changelog: temporalio/sdk-typescript@v1.20.1...v1.20.2

v1.20.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

v1.20.0

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

Full Changelog: temporalio/sdk-typescript@v1.19.0...v1.20.0

v1.19.1

Backport temporalio/sdk-typescript#2169 to address temporalio/sdk-typescript#2170

Changelog

Sourced from @​temporalio/workflow's changelog.

[1.20.2] - 2026-07-08

Fixed

  • langsmith: resolve workflow interceptor module by absolute path

[1.20.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).

[1.20.0] - 2026-07-07

Added

  • New @temporalio/langsmith package for tracing Temporal apps to LangSmith. It hooks the client, Workflow, and Activity interceptors so a Workflow and the Activities it runs show up as a single LangSmith run tree.

Changed

  • protobufjs bumped to ^7.6.4
  • Updated Core to 5df57f6d. Package-visible changes from this update include:
    • NativeConnection initialization now retries without gRPC gzip compression if the server cannot decompress the eager GetSystemInfo call.
    • Workflow replay now honors SDK flags already recorded in history even when the server does not advertise SDK metadata support.
    • OTLP metric export failures from Core's periodic metric reader are now logged through Core telemetry.
  • @temporalio/openai-agents: Query handlers and update validators now derive trace span IDs from the SDK's replay-safe random source instead of a private seeded PRNG. This removes the old seed-collision workaround and gives read-only handlers distinct, well-formed span IDs.

[1.19.2] - 2026-07-13

Fixed

  • Workflow Bundler: further strengthening of the __webpack_module_cache__ replacement logic, addressing regressions introduced by the fix in 1.19.1.

[1.19.1] - 2026-07-07

Fixed

  • Workflow Bundler: fix a bug in our replacement of __webpack_module_cache__ logic introduced by webpack 5.108.0, resulting in breaking workflow context isolation (fix #2170).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the temporal group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@temporalio/client](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/client) | `1.19.0` | `1.20.2` |
| [@temporalio/common](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/common) | `1.19.0` | `1.20.2` |
| [@temporalio/testing](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/testing) | `1.19.0` | `1.20.2` |
| [@temporalio/worker](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/worker) | `1.19.0` | `1.20.2` |
| [@temporalio/workflow](https://github.com/temporalio/sdk-typescript/tree/HEAD/packages/workflow) | `1.19.0` | `1.20.2` |


Updates `@temporalio/client` from 1.19.0 to 1.20.2
- [Release notes](https://github.com/temporalio/sdk-typescript/releases)
- [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.20.2/packages/client)

Updates `@temporalio/common` from 1.19.0 to 1.20.2
- [Release notes](https://github.com/temporalio/sdk-typescript/releases)
- [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.20.2/packages/common)

Updates `@temporalio/testing` from 1.19.0 to 1.20.2
- [Release notes](https://github.com/temporalio/sdk-typescript/releases)
- [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.20.2/packages/testing)

Updates `@temporalio/worker` from 1.19.0 to 1.20.2
- [Release notes](https://github.com/temporalio/sdk-typescript/releases)
- [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.20.2/packages/worker)

Updates `@temporalio/workflow` from 1.19.0 to 1.20.2
- [Release notes](https://github.com/temporalio/sdk-typescript/releases)
- [Changelog](https://github.com/temporalio/sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](https://github.com/temporalio/sdk-typescript/commits/v1.20.2/packages/workflow)

---
updated-dependencies:
- dependency-name: "@temporalio/client"
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: temporal
- dependency-name: "@temporalio/common"
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: temporal
- dependency-name: "@temporalio/testing"
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: temporal
- dependency-name: "@temporalio/worker"
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: temporal
- dependency-name: "@temporalio/workflow"
  dependency-version: 1.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: temporal
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 20, 2026
@btravers

Copy link
Copy Markdown
Collaborator

@copilot fix CI

…nerabilities

- brace-expansion@2 → 2.1.2 (GHSA-3jxr-9vmj-r5cp, via testcontainers)
- brace-expansion@5 → 5.0.7 (GHSA-3jxr-9vmj-r5cp, via typedoc)
- js-yaml@3 → ^3.15.0 via read-yaml-file (GHSA-52cp-r559-cp3m)
- js-yaml@4 → >=4.3.0 via @changesets/parse (GHSA-52cp-r559-cp3m)

pnpm audit --audit-level=high now exits 0

Copilot AI commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

@copilot fix CI

Fixed in 6e2d78d. The Security Audit job was failing due to 4 high-severity unignored vulnerabilities in transitive dependencies:

  • GHSA-3jxr-9vmj-r5cp (brace-expansion): two version lines — 2.1.1 via testcontainers and 5.0.6 via typedoc — bumped to 2.1.2 and 5.0.7 using version-selector overrides ("brace-expansion@2": "2.1.2" and "brace-expansion@5": "5.0.7")
  • GHSA-52cp-r559-cp3m (js-yaml): 4.2.0 via @changesets/parse bumped to 4.3.0; 3.14.2 via read-yaml-file bumped to 3.15.0 using scoped overrides

pnpm audit --audit-level=high now exits 0.

Copilot AI requested a review from btravers July 20, 2026 22:42
@btravers
btravers enabled auto-merge (rebase) July 20, 2026 22:44
@btravers
btravers merged commit 81261c9 into main Jul 20, 2026
10 checks passed
@btravers
btravers deleted the dependabot/npm_and_yarn/temporal-d384eb51e3 branch July 20, 2026 22:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants