RepoJournal
Vercel

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Thu 18 jun
  2. Fri 19 jun
  3. Sat 27 jun
  4. Sun 28 jun
  5. Mon 29 jun
  6. Tue 30 jun
  7. Wed 1 jul
  8. Thu 2 jul
  9. Fri 3 jul
  10. Sat 4 jul
  11. Sun 5 jul
  12. Mon 6 jul
  13. Tue 7 jul
  14. Wed 8 jul
  15. Thu 9 jul
  16. Fri 10 jul
  17. Sat 11 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Fri 17 jul
  23. Sat 18 jul
  24. Sun 19 jul
  25. Mon 20 jul
  26. Tue 21 jul
  27. Wed 22 jul
  28. Thu 23 jul
  29. Fri 24 jul
  30. Today 25 jul
Topics: JavaScript Full archive →

The Wire · Showcase

WORKFLOW HARDENS AGAINST SUPPLY CHAIN ATTACKS, TURBOREPO PATCHES CSRF AND SHELL INJECTION

By RepoJournal · Filed · About Vercel

anthonyshew pranaygp dnwpark JohnPhamous HugoRCD gnoff aurorascharff
8 people shipped this
anthonyshew @anthonyshew 3 cited pranaygp @pranaygp 2 cited dnwpark @dnwpark 1 cited JohnPhamous @JohnPhamous 1 cited HugoRCD @HugoRCD 1 cited gnoff @gnoff 1 cited aurorascharff @aurorascharff 1 cited unstubbable @unstubbable 1 cited

Vercel shipped critical security fixes across Workflow and Turborepo while shipping new CLI features and hardening the entire platform against repository-controlled execution.

The most urgent story: Turborepo 2.9.13 landed three security patches [1][2][3] that block CSRF attacks on self-hosted deployments, disable VS Code extension commands in untrusted workspaces, and prevent malicious `yarnPath` values from executing during detection. Separately, Workflow closed a supply chain vulnerability [4] that would have let fork PR submitters execute arbitrary shell on CI runners by hardening how community world matrix fields flow through reusable workflows. On the builder front, Vercel shipped DetectEntrypointFn [5], a normalized entrypoint detector that lets services auto-detect their runtime entry point across Python, Node, and Go without guessing. The CLI got a polish pass with a simplified `vc setup` flow [6] and dropped the feature gate on `vercel connect` [7], pushing it to all users as a beta command. Workflow also fixed a DX nightmare where Next.js proxies reading request bodies broke queue logging with detached ArrayBuffer errors [8], plus added rendered link validation to catch broken homepage navigation [9]. Chat SDK shipped queue-debounce concurrency [10] for burst message handling, a dedicated `chat/ai` subpath to keep optional dependencies out of bundles [11], and first-class Vue and Svelte web adapter support [12]. Next.js hardened Instant Insights to silence duplicate validation warnings when dev render errors already surface [13], fixed a bug where `new Date()` was mislabeled as `Date.now()` in the error overlay [14], and shipped the long-awaited middleware rewrite fix for Server Actions [15][16].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix: Validate auth callback state ↗ vercel/turborepo
  2. [2] fix: Harden VS Code extension command execution ↗ vercel/turborepo
  3. [3] fix: Avoid project-local Yarn during detection ↗ vercel/turborepo
  4. [4] CI: drop setup-command input from reusable community-world workflows (#1828) vercel/workflow
  5. [5] Add normalized entrypoint detector for runtime builders ↗ vercel/vercel
  6. [6] [cli] refresh vc setup flow + aligned-label output ↗ vercel/vercel
  7. [7] [cli] connect: drop FF_CONNEX_ENABLED gate, mark beta in help (#16334) vercel/vercel
  8. [8] [codex] Fix detached ArrayBuffer proxy DX ↗ vercel/workflow
  9. [9] Validate homepage links in docs link lint ↗ vercel/workflow
  10. [10] feat(chat): add queue-debounce concurrency strategy (#495) vercel/chat
  11. [11] feat(chat): add `chat/ai` subpath for AI SDK utilities (#492) vercel/chat
  12. [12] feat(web-adapter): first class support for Vue and Svelte ↗ vercel/chat
  13. [13] Instant Insights: only report non-validatable if dev render is error free ↗ vercel/next.js
  14. [14] Fix `Date.now()` cause shadowing in sync IO error overlay ↗ vercel/next.js
  15. [15] Fix server action forwarding loop with middleware rewrites ↗ vercel/next.js
  16. [16] Fix server action forwarding loop with middleware rewrites (#93792) vercel/next.js

Quick answers

What shipped in Vercel on May 15, 2026?
Vercel shipped critical security fixes across Workflow and Turborepo while shipping new CLI features and hardening the entire platform against repository-controlled execution. In total, 30 commits, 40 pull requests, and 3 releases landed.
Who contributed to Vercel on May 15, 2026?
8 developers shipped this update, including anthonyshew, dnwpark, JohnPhamous, pranaygp, HugoRCD, gnoff, aurorascharff, and unstubbable.
What were the notable Vercel updates?
fix: Validate auth callback state, fix: Harden VS Code extension command execution, and fix: Avoid project-local Yarn during detection.

More from @vercel

Vercel @vercel

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

timneutkens gnoff devjiwonchoi aurorascharff +11
javascript 126 shipped 2-min read
Vercel @vercel

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

Nathan Rajlich joeyhotz VaguelySerious Sam Poder +9
javascript 153 shipped 1-min read
Vercel @vercel

WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS

Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.

github-actions[bot] github-actions Lars Grammel Felix Arntz +9
javascript 132 shipped 2-min read
Vercel @vercel

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

github-actions[bot] jeremyphilemon Melkeydev healeycodes +12
javascript 145 shipped 2-min read

Daily updates, in your inbox

Follow Vercel

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

github-actions[bot] hntrl dependabot ak684 +6
ai-agents 28 shipped 1-min read
Local LLMs Local LLMs

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.

dhiltgen ParthSareen Xuan-Son Nguyen Johannes Gäßler +11
llms 210 shipped 2-min read
CachyOS @CachyOS

HYPRLAND V0.56 FIXES LAND, PACKAGE ECOSYSTEM ROLLS FORWARD

Hyprland configuration updated for v0.56 compatibility across multiple desks, while the AUR-derived ecosystem locked in four automated package bumps.

cantosun99 Jinra Aarrayy Valeri +7
infra 85 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

Barna Kovacs Alexander Gubarev SteffenDE José Valim +1
elixir 19 shipped 1-min read
Want every project, not just this one?