Hardcoded dep version make it hard to patch vulnerabilities

3rd party dependencies like

$ bun audit

nanoid  >=4.0.0 <5.1.16
  workflow › @workflow/nitro › @workflow/builders › @workflow/core › nanoid
  high: nanoid: non-secure generators can loop indefinitely with negative size - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
  high: nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8

undici  >=7.0.0 <7.29.0
  workflow › @workflow/core › @workflow/world-vercel › undici
  moderate: undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
  high: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives - https://github.com/advisories/GHSA-4cwx-7wf7-3272
  moderate: undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
  moderate: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives - https://github.com/advisories/GHSA-jr45-8vmc-qm54
  moderate: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm

come with vulnerabilities that cannot be easily patched by upgrading workflow (since the version is fixed!), we need to manually add overrides to the package.json. This is not a scalable solution since we may have multiple versions of the same package and we only need to upgrade one.

Is there any plan to patch these and keep track of the potential vulnerabilities that workflow ships with?

Start with package.json and run bun audit to inspect the reported nanoid and undici dependency paths and their fixed versions. Review how workflow dependencies are declared and overridden; done means the vulnerability handling is defined without relying on manually adding separate package overrides for each affected dependency.