RepoJournal
Vercel

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Thu 18 jun
  2. Fri 19 jun
  3. Sat 27 jun
  4. Sun 28 jun
  5. Mon 29 jun
  6. Tue 30 jun
  7. Wed 1 jul
  8. Thu 2 jul
  9. Fri 3 jul
  10. Sat 4 jul
  11. Sun 5 jul
  12. Mon 6 jul
  13. Tue 7 jul
  14. Wed 8 jul
  15. Thu 9 jul
  16. Fri 10 jul
  17. Sat 11 jul
  18. Mon 13 jul
  19. Tue 14 jul
  20. Wed 15 jul
  21. Thu 16 jul
  22. Fri 17 jul
  23. Sat 18 jul
  24. Sun 19 jul
  25. Mon 20 jul
  26. Tue 21 jul
  27. Wed 22 jul
  28. Thu 23 jul
  29. Fri 24 jul
  30. Today 25 jul
Topics: JavaScript Full archive →

The Wire · Showcase

MODELCONTEXTPROTOCOL REDOS PATCH SHIPS AS NEXT-DEVTOOLS TIGHTENS PLAYWRIGHT SCHEMA

By RepoJournal · Filed · About Vercel

Melkeydev gaojude
2 people shipped this
Melkeydev @Melkeydev 2 cited gaojude @gaojude 1 cited

A critical ReDoS vulnerability in your MCP dependencies just got patched, but your browser_eval wrapper is already broken by an upstream schema change.

Next-devtools-mcp shipped an emergency bump to @modelcontextprotocol/sdk 1.25.2 [1] that patches CVE-2026-0621, a ReDoS vulnerability in the UriTemplate class where nested quantifiers cause catastrophic backtracking on crafted resource URIs. Deploy this immediately if you're running devtools in production. Separately, @playwright/[email protected] renamed field schemas across browser_eval actions (ref becomes target, fill_form shape changed), breaking the wrapper's forwarding logic [2]. This landed and is already auto-installing, so your next browser_navigate or browser_click call will fail with InputValidationError unless you align your wrapper code. The team also added Chromium browser support for Linux arm64 , fixing a gap where certain platforms couldn't use browser_eval at all. On the CLI side, Vercel shipped step-up auth for vc env pull [3], letting you retry after a challenge_required response using device-code flow with stored refresh tokens. A separate PR simplified @vercel/vc-native's install model [4], moving to opencode-style postinstall to eliminate multiple platform binaries.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix(deps): bump @modelcontextprotocol/sdk to 1.25.2 (CVE-2026-0621 ReDoS) (#140) vercel/next-devtools-mcp
  2. [2] fix(browser_eval): align tool args with Playwright MCP 0.0.75 schema (target fields + fill_form) ↗ vercel/next-devtools-mcp
  3. [3] [CLI] changing logic for calling vc env pull with vca ↗ vercel/vercel
  4. [4] [CLI] Removing multiple installs for PNPM and NPM ↗ vercel/vercel

Quick answers

What shipped in Vercel on June 1, 2026?
A critical ReDoS vulnerability in your MCP dependencies just got patched, but your browser_eval wrapper is already broken by an upstream schema change. In total, 6 commits and 6 pull requests landed.
Who contributed to Vercel on June 1, 2026?
2 developers shipped this update, including gaojude and Melkeydev.
What were the notable Vercel updates?
fix(deps): bump @modelcontextprotocol/sdk to 1.25.2 (CVE-2026-0621 ReDoS) (#140), fix(browser_eval): align tool args with Playwright MCP 0.0.75 schema (target fields + fill_form), and [CLI] changing logic for calling vc env pull with vca.

More from @vercel

Vercel @vercel

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

timneutkens gnoff devjiwonchoi aurorascharff +11
javascript 126 shipped 2-min read
Vercel @vercel

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

Nathan Rajlich joeyhotz VaguelySerious Sam Poder +9
javascript 153 shipped 1-min read
Vercel @vercel

WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS

Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.

github-actions[bot] github-actions Lars Grammel Felix Arntz +9
javascript 132 shipped 2-min read
Vercel @vercel

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

github-actions[bot] jeremyphilemon Melkeydev healeycodes +12
javascript 145 shipped 2-min read

Daily updates, in your inbox

Follow Vercel

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

github-actions[bot] hntrl dependabot ak684 +6
ai-agents 28 shipped 1-min read
Local LLMs Local LLMs

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.

dhiltgen ParthSareen Xuan-Son Nguyen Johannes Gäßler +11
llms 210 shipped 2-min read
CachyOS @CachyOS

HYPRLAND V0.56 FIXES LAND, PACKAGE ECOSYSTEM ROLLS FORWARD

Hyprland configuration updated for v0.56 compatibility across multiple desks, while the AUR-derived ecosystem locked in four automated package bumps.

cantosun99 Jinra Aarrayy Valeri +7
infra 85 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

Barna Kovacs Alexander Gubarev SteffenDE José Valim +1
elixir 19 shipped 1-min read
Want every project, not just this one?