RepoJournal
Vercel

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 27 jun
  2. Sun 28 jun
  3. Mon 29 jun
  4. Tue 30 jun
  5. Wed 1 jul
  6. Thu 2 jul
  7. Fri 3 jul
  8. Sat 4 jul
  9. Sun 5 jul
  10. Mon 6 jul
  11. Tue 7 jul
  12. Wed 8 jul
  13. Thu 9 jul
  14. Fri 10 jul
  15. Sat 11 jul
  16. Mon 13 jul
  17. Tue 14 jul
  18. Wed 15 jul
  19. Thu 16 jul
  20. Fri 17 jul
  21. Sat 18 jul
  22. Sun 19 jul
  23. Mon 20 jul
  24. Tue 21 jul
  25. Wed 22 jul
  26. Thu 23 jul
  27. Fri 24 jul
  28. Sat 25 jul
  29. Sun 26 jul
  30. Mon 27 jul
Topics: JavaScript Full archive →

The Wire · Showcase

CRITICAL CORS VULNERABILITY PATCHED ACROSS AI AND WORKFLOW, DEPENDABOT NOW RESTORES AUTOMATION

By RepoJournal · Filed · About Vercel

pranaygp gr2m
2 people shipped this
pranaygp @pranaygp 3 cited gr2m @gr2m 1 cited

Hono's CORS middleware was reflecting credentials to arbitrary origins—both vercel/ai and vercel/workflow patched it overnight, and you need to upgrade before your next deploy.

CVE-2026-54290 (CVSS 7.1) hit hono versions before 4.12.25 [1] [2], where the CORS middleware with credentials enabled would echo back any request Origin header and send Access-Control-Allow-Credentials: true, exposing authenticated endpoints to cross-origin requests. Both repos deployed fixes immediately [1] [2]. Meanwhile, vercel/ai switched from Renovate to Dependabot [3], restoring automated dependency updates across main and two release branches now that Renovate is gone. On the security hardening front, vercel/ai also locked down GitHub Actions token permissions [4] and attached SLSA provenance to releases [5], pushing the OSSF Scorecard from 0/10 on token scoping to passing. Astro users in vercel/workflow got hit separately—CVE-2026-54299 requires bumping to 6.4.6 with no 5.x backport available [6]. Over in vercel/workflow, the payload compression RFC landed [7], cutting stored bytes by 73-89% using zstd with gzip fallback, and a critical SWC plugin fix [8] prevents dead-code elimination from stripping identifier references buried in destructuring defaults. The workflow CLI now prints deep links to observability dashboards [9], letting agents hand users clickable URLs instead of dashboard guesses.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix(devtools): bump hono to ^4.12.25 (CVE-2026-54290) (#16166) vercel/ai
  2. [2] fix(deps): upgrade hono to 4.12.25 to resolve CVE-2026-54290 (#2462) vercel/workflow
  3. [3] ci: add Dependabot config, migrating from Renovate (#16174)lm vercel/ai
  4. [4] ci: restrict GitHub Actions workflow token permissions (#16172) vercel/ai
  5. [5] ci: attach SLSA provenance to GitHub Releases for OSSF Scorecard ↗ vercel/ai
  6. [6] fix(deps): upgrade astro to 6.4.6 to resolve CVE-2026-54299 (#2457) vercel/workflow
  7. [7] RFC: compress serialized payload refs — zstd (gzip fallback), specVersion 5 ↗ vercel/workflow
  8. [8] fix(swc-plugin): count destructuring-default references in DCE usage analysis ↗ vercel/workflow
  9. [9] feat(cli): print run deep links with `--url`, fix dashboard route ↗ vercel/workflow

Quick answers

What shipped in Vercel on June 17, 2026?
Hono's CORS middleware was reflecting credentials to arbitrary origins—both vercel/ai and vercel/workflow patched it overnight, and you need to upgrade before your next deploy. In total, 35 commits, 38 pull requests, and 11 releases landed.
Who contributed to Vercel on June 17, 2026?
2 developers shipped this update, including gr2m and pranaygp.
What were the notable Vercel updates?
fix(devtools): bump hono to ^4.12.25 (CVE-2026-54290) (#16166), fix(deps): upgrade hono to 4.12.25 to resolve CVE-2026-54290 (#2462), and ci: add Dependabot config, migrating from Renovate (#16174)lm.

More from @vercel

Vercel @vercel

TURBOPACK RUNTIME FIXES SHIP AS NEXT.JS LOCKS DOWN APP SHELL STREAMING

Sampoder eliminated a high-severity deoptimization in Turbopack's chunk URL resolution that was bailing out on large import trees, while the team shipped per-segment prefetch offsets to squeeze more performance out of static rendering.

sampoder acdlite timneutkens ctgowrie +2
javascript 12 shipped 1-min read
Vercel @vercel

NEXT.JS PLUGS MEMORY LEAK IN EDGE RUNTIME, FIXES DEV OVERLAY ENCODING BUGS

A critical sandbox memory leak that causes step-like heap growth in self-hosted Next.js servers is patched, while dev overlay symbolication now correctly handles project paths with special characters.

petehunt gaearon unstubbable github-actions[bot]
javascript 31 shipped 2-min read
Vercel @vercel

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

timneutkens gnoff devjiwonchoi aurorascharff +11
javascript 126 shipped 2-min read
Vercel @vercel

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

Nathan Rajlich joeyhotz VaguelySerious Sam Poder +9
javascript 153 shipped 1-min read

Daily updates, in your inbox

Follow Vercel

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

langchain-oss-model-profiles langchain-oss-model-profiles[bot] saoudrizwan
ai-agents 16 shipped 2-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

github-actions[bot] dhiltgen timkhronos Pascal +10
llms 125 shipped 1-min read
CachyOS @CachyOS

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

Piotr Gorski github-actions Vladislav Nepogodin ptr1337 +7
infra 97 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

Benjamin Milde Alexander Gubarev lukaszsamson makoto-developer
elixir 10 shipped 1-min read
Want every project, not just this one?

We use privacy-friendly analytics (Google Analytics, IP-anonymized) to see which pages help readers. No ads, and we never sell your data. See our Privacy Policy.