RepoJournal
Vercel @vercel
125 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-06-01
stories 12
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

MODELCONTEXTPROTOCOL REDOS PATCH SHIPS AS NEXT-DEVTOOLS TIGHTENS PLAYWRIGHT SCHEMA

By RepoJournal · Filed · About Vercel · Composed from the cited sources · methodology

Melkeydev gaojude
2 people shipped this
Melkeydev @Melkeydev 2 cited gaojude @gaojude 1 cited

A critical ReDoS vulnerability in your MCP dependencies just got patched, but your browser_eval wrapper is already broken by an upstream schema change.

Next-devtools-mcp shipped an emergency bump to @modelcontextprotocol/sdk 1.25.2 [1] that patches CVE-2026-0621, a ReDoS vulnerability in the UriTemplate class where nested quantifiers cause catastrophic backtracking on crafted resource URIs. Deploy this immediately if you're running devtools in production. Separately, @playwright/mcp@0.0.75 renamed field schemas across browser_eval actions (ref becomes target, fill_form shape changed), breaking the wrapper's forwarding logic [2]. This landed and is already auto-installing, so your next browser_navigate or browser_click call will fail with InputValidationError unless you align your wrapper code. The team also added Chromium browser support for Linux arm64 , fixing a gap where certain platforms couldn't use browser_eval at all. On the CLI side, Vercel shipped step-up auth for vc env pull [3], letting you retry after a challenge_required response using device-code flow with stored refresh tokens. A separate PR simplified @vercel/vc-native's install model [4], moving to opencode-style postinstall to eliminate multiple platform binaries.

$ ls vercel/reviews/ # the step-back reads

the week in review Turborepo adds Go workspace graph, fixes hashing the month in review Workflow 4.8 overhauls delivery and sessions, Eve compacts traces, Turbopack cache defaults on
Full archive → Weekly reviews →

Quick answers

What shipped in Vercel on June 1, 2026?
A critical ReDoS vulnerability in your MCP dependencies just got patched, but your browser_eval wrapper is already broken by an upstream schema change. In total, 6 commits and 6 pull requests landed.
Who contributed to Vercel on June 1, 2026?
2 developers shipped this update, including gaojude and Melkeydev.
What were the notable Vercel updates?
fix(deps): bump @modelcontextprotocol/sdk to 1.25.2 (CVE-2026-0621 ReDoS) (#140), fix(browser_eval): align tool args with Playwright MCP 0.0.75 schema (target fields + fill_form), and [CLI] changing logic for calling vc env pull with vca.
♥

$ log @vercel --recent

Turbopack GC gets a config key and the runtime sheds peer state 172 shipped xAI drops Chat Completions, eve breaks registry installs, Turbopack widens tree-shaking 155 shipped Next.js fixes cache warming env bug, eve gains audience hooks 167 shipped Turborepo patches Remix and Nuxt env hashing, shop ships Eve agent 10 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.