Who contributed to Vercel on May 18, 2026?

1 developer shipped this update, including anthonyshew.

What were the notable Vercel updates?

fix: Avoid UTF-8 panics at boundaries, fix: Preserve non-UTF-8 Git path boundaries, and fix: Preserve Bun alias child packages.

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

TURBOREPO HARDENS AGAINST OS-LEVEL CRASHES AND BAKE LOCKFILE BREAKAGE

By RepoJournal · Filed 06:01 UTC on May 18, 2026 · About Vercel

1 person shipped this

anthonyshew @anthonyshew 5 cited

Turborepo shipped four critical fixes overnight that prevent panics on non-UTF-8 paths, stop Bun lockfiles from rewrites, and close a symlink race condition in logging.

The most urgent: Rust panics when encountering non-UTF-8 bytes in environment variables or filesystem paths can now crash the daemon [1]. Turborepo now defers those panics until a package actually needs to process the bad path, and keeps OS-native representations instead of forcing UTF-8 conversion at the boundary. The same hardening applies to SCM parsing [2], where valid Unix Git paths containing non-UTF-8 bytes were breaking unrelated package hashes. That fix now preserves raw Git paths and only errors if a queried package actually includes one. Separately, Bun's duplicate alias requirement was causing `turbo prune --docker` to emit lockfiles Bun treated as stale, triggering rewrites even under `--frozen-lockfile` [3]. Structured log creation also had a TOCTOU window where symlinks could slip through validation before the file opened [4]. All four fixes are already in canary and stable. Finally, Turborepo now denies Clippy's unwrap/expect usage by default across the workspace [5], with gradual cleanup in progress. Next.js 16.3.0-canary.22 ships the turbo-tasks recomputation priority bump [6] that schedules cache misses ahead of invalidation work.

Action items

→ Upgrade turborepo to latest stable immediately if you ship non-UTF-8 paths or use Bun lockfiles vercel/turborepo [immediate]
→ Monitor canary releases for the turbo-tasks recomputation priority rollout vercel/next.js [monitor]
→ Review your daemon logs if you've seen recent crashes on edge-case file paths vercel/turborepo [plan]

References

[1] fix: Avoid UTF-8 panics at boundaries ↗ vercel/turborepo
[2] fix: Preserve non-UTF-8 Git path boundaries ↗ vercel/turborepo
[3] fix: Preserve Bun alias child packages ↗ vercel/turborepo
[4] fix: Make structured log symlink defense race-safe ↗ vercel/turborepo
[5] chore: Deny Rust panic extraction by default ↗ vercel/turborepo
[6] turbo-tasks: prioritize recomputed tasks with Recomputation priority (#93876) vercel/next.js

Quick answers

What shipped in Vercel on May 18, 2026?: Turborepo shipped four critical fixes overnight that prevent panics on non-UTF-8 paths, stop Bun lockfiles from rewrites, and close a symlink race condition in logging. In total, 9 commits, 8 pull requests, and 1 releases landed.
Who contributed to Vercel on May 18, 2026?: 1 developer shipped this update, including anthonyshew.
What were the notable Vercel updates?: fix: Avoid UTF-8 panics at boundaries, fix: Preserve non-UTF-8 Git path boundaries, and fix: Preserve Bun alias child packages.

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

+11

javascript 126 shipped 2-min read

@vercel 1 day ago

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

javascript 153 shipped 1-min read

@vercel 2 days ago

WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS

Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.

javascript 132 shipped 2-min read

@vercel 3 days ago

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

+12

javascript 145 shipped 2-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.