Workflow 4.8 overhauls delivery and sessions, Eve compacts traces, Turbopack cache defaults on

The month's loudest signal is workflow@4.8.0 [1], which bundles several correctness fixes across delivery, eventing, and VM execution. The core change stamps the creator environment into runInput and rejects cross-environment queue deliveries client-side [2], so a workflow can no longer silently accept an event from another sandbox or region. Relatedly, event creation is now gated on the loaded event count, and replays restart in-process when they detect divergence [3]. These fix a class of race conditions that previously corrupted event logs or allowed replays to continue along the wrong history. One engineering note: a world-postgres runner was added for the event-log race repro, shrinking the repro job 100x [4].

Alongside delivery correctness, workflow hardened the session and VM layers. resumeHook() now tolerates transient hook_received event write failures [5], and replay divergence recovery episodes are reported instead of suppressed [6]. The VM gained side-effect-free serialization of workflow values [7], removing side effects during serialization that could corrupt state. In the same period, workflow shipped a QuickJS VM with 25x faster boot [8], and event ordering was fixed [9]. These all land under the 4.8.0 release, which also carries the session API redesign and sandbox stops that Eve shipped mid-month.

Eve's story August is about consolidation. Session compaction shipped early [3], followed by a breaking session API redesign [10] and sandbox stops [9]. Eve also opened a real session root span and now windows long traces [12], meaning traces are no longer open-ended; they close at a bounded width, which makes them usable in production dashboards without unbounded memory. Tracing went public-only later in the month as privacy gates landed [13], and a session leak was patched [4].

Next.js spent August stabilizing its Turbopack build path. Turbopack's file system cache turned on by default for builds [10], a change that will affect every project that builds with Next.js 16.3.0. Later, export mangling shipped by default on canary , and the moment's edge: the Turbopack module registry moved out of unstable_eager [11], and the SWC plugin host moved off WASM . A deadlock that could hang builds was fixed [8].

The AI SDK rounded out the month with many provider and correctness patches, including Gemini 3.7 Flash as a chat model [4], Fireworks error envelope parsing [9], and expiration-aware file uploads for OpenAI [14]. Security reporting moved to HackerOne , and unsafe tool execution is blocked [11]. The vercel-py SDK standardized its payloads on TypeScript SDK shapes [6] and shipped a breaking compatibility change [12], so if you depend on it, check the changelog before upgrading.