Who contributed to Vercel on June 11, 2026?

2 developers shipped this update, including dnukumamras and felixarntz.

What were the notable Vercel updates?

fix(security): harden tool approval replay path against client-forged approvals (#15947), fix(security): harden tool approval replay path against client-forged approvals, and fix(workflow): reuse core tool-approval validation in WorkflowAgent (#15987).

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

VERCEL AI HARDENS TOOL APPROVAL AGAINST CLIENT FORGERY, FIXES CRITICAL WORKFLOW VALIDATION DRIFT

By RepoJournal · Filed 06:01 UTC on June 11, 2026 · About Vercel

2 people shipped this

dnukumamras @dnukumamras 1 cited

felixarntz @felixarntz 1 cited

A client-side attack on tool approval replay is now closed across both generateText and WorkflowAgent after the workflow package's validation logic drifted from the hardened core path.

The tool-approval replay mechanism in vercel/ai was reconstructing approved tool calls directly from client-supplied messages without re-validating schema, re-applying policy, or verifying the server actually issued the approval [1]. A malicious client could forge an assistant message with a pre-approved tool call and have the server execute it [2]. That fix landed in generateText and streamText, but WorkflowAgent.stream duplicated the collection logic independently and drifted, leaving the same vulnerability open [3]. Both paths now share the hardened validation, closing VULN-11497 end-to-end. Meanwhile, the harness agent API was leaking versioned HarnessV1* spec types into its public surface, coupling consumers to internal adapter details [4]. The type layer is now separated: consumers depend on stable HarnessAgent* names while the internal V1 spec stays decoupled [5]. On the infrastructure side, Vercel's connect package is cascading token cache evictions reactively when credentials go bad [6]. When a bearer is rejected by a resource server or an MCP server, it's dropped from cache without forcing a new consent flow, letting the next getToken refresh it automatically [7]. Go standalone functions' IPC proxy is being refactored into internals so Rust and other compiled languages can reuse the same transport layer, eventually deprecating the separate Vercel Rust crate [8]. React Router v7 SPA routing is fixed: subroute refreshes now serve index.html instead of targeting missing index output [9]. Python WSGI request bodies sent with Transfer-Encoding: chunked are no longer silently dropped [10].

Action items

→ Review tool approval flows in your AI agents if using generateText, streamText, or WorkflowAgent with client-supplied messages vercel/ai [immediate]
→ If you're consuming HarnessAgent types, confirm your imports use the new stable names instead of HarnessV1* specs vercel/ai [plan]
→ Deploy Turborepo security hardening for git argument injection and self-hosted login URL phishing [ref:22] [ref:23] vercel/turborepo [immediate]
→ Audit Turborepo query server deployments for Host header validation and CORS tightening [ref:25] vercel/turborepo [plan]

References

[1] fix(security): harden tool approval replay path against client-forged approvals (#15947) vercel/ai
[2] fix(security): harden tool approval replay path against client-forged approvals ↗ vercel/ai
[3] fix(workflow): reuse core tool-approval validation in WorkflowAgent (#15987) vercel/ai
[4] chore(harness): separate harness spec types (v1) from consumer-facing types (#15985) vercel/ai
[5] chore(harness): separate harness spec types (v1) from consumer-facing types ↗ vercel/ai
[6] [@vercel/connect] cascade token cache eviction via deleteTokenCacheEntry + connect() evict() (#16580) vercel/vercel
[7] [@vercel/connect] add opt-in revoke to connect() evict() (#16597) vercel/vercel
[8] [go] Refactor golang IPC proxy into internals so it can be reused. (#16556) vercel/vercel
[9] [remix] Fix React Router SPA catch-all (#16595) vercel/vercel
[10] [python] Decode chunked WSGI request bodies in python runtime. (#16594) vercel/vercel
[11] fix: Prevent git argument injection in SCM refs (#13055) vercel/turborepo
[12] fix: Block self-hosted login URLs from attempting to use Vercel's SSO (#13061) vercel/turborepo
[13] fix: Harden query server file access (#13053) vercel/turborepo

Quick answers

What shipped in Vercel on June 11, 2026?: A client-side attack on tool approval replay is now closed across both generateText and WorkflowAgent after the workflow package's validation logic drifted from the hardened core path. In total, 61 commits, 70 pull requests, and 27 releases landed.
Who contributed to Vercel on June 11, 2026?: 2 developers shipped this update, including dnukumamras and felixarntz.
What were the notable Vercel updates?: fix(security): harden tool approval replay path against client-forged approvals (#15947), fix(security): harden tool approval replay path against client-forged approvals, and fix(workflow): reuse core tool-approval validation in WorkflowAgent (#15987).

TURBOPACK RUNTIME FIXES SHIP AS NEXT.JS LOCKS DOWN APP SHELL STREAMING

Sampoder eliminated a high-severity deoptimization in Turbopack's chunk URL resolution that was bailing out on large import trees, while the team shipped per-segment prefetch offsets to squeeze more performance out of static rendering.

javascript 12 shipped 1-min read

@vercel 2 days ago

NEXT.JS PLUGS MEMORY LEAK IN EDGE RUNTIME, FIXES DEV OVERLAY ENCODING BUGS

A critical sandbox memory leak that causes step-like heap growth in self-hosted Next.js servers is patched, while dev overlay symbolication now correctly handles project paths with special characters.

javascript 31 shipped 2-min read

@vercel 3 days ago

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

+11

javascript 126 shipped 2-min read

@vercel 4 days ago

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

javascript 153 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.