RepoJournal
Vercel

@vercel

Next.js + the Vercel platform — frontend infrastructure for the web

What actually shipped in Vercel, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Mon 15 jun
  2. Tue 16 jun
  3. Wed 17 jun
  4. Thu 18 jun
  5. Fri 19 jun
  6. Sat 27 jun
  7. Sun 28 jun
  8. Mon 29 jun
  9. Tue 30 jun
  10. Wed 1 jul
  11. Thu 2 jul
  12. Fri 3 jul
  13. Sat 4 jul
  14. Sun 5 jul
  15. Mon 6 jul
  16. Tue 7 jul
  17. Wed 8 jul
  18. Thu 9 jul
  19. Fri 10 jul
  20. Sat 11 jul
  21. Mon 13 jul
  22. Tue 14 jul
  23. Wed 15 jul
  24. Thu 16 jul
  25. Fri 17 jul
  26. Sat 18 jul
  27. Sun 19 jul
  28. Mon 20 jul
  29. Tue 21 jul
  30. Today 22 jul
Topics: JavaScript Full archive →

The Wire · Showcase

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

By RepoJournal · Filed · About Vercel

Sebastian "Sebbie" Silbermann github-actions[bot] jeremyphilemon Melkeydev shalabhc VaguelySerious AndrewBarba
16 people shipped this
Sebastian "Sebbie" Silbermann @eps1lon 5 cited github-actions[bot] @github-actions[bot] 2 cited jeremyphilemon @jeremyphilemon 1 cited Melkeydev @Melkeydev 1 cited shalabhc @shalabhc 1 cited VaguelySerious @VaguelySerious 1 cited AndrewBarba @AndrewBarba 1 cited benjamincanac @benjamincanac 1 cited ruiconti @ruiconti 1 cited colecorrente @colecorrente 1 cited CamdenA21 @CamdenA21 1 cited bensabic @bensabic 1 cited healeycodes @healeycodes Pranay Prakash @pranaygp ctgowrie @ctgowrie dependabot @dependabot

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

The Next.js team rolled out fixes for origin header spoofing in custom servers [1], improper encoding of exotic rewrite parameters [2], fetch cache key collisions on Request objects [3], byte-alignment bugs in binary fetch bodies [4], and unvalidated server reference lookups in the client manifest [5]. None of these are trivial. Meanwhile on the CLI side, [email protected] [6] ships new `ai-gateway budgets` commands [7] to set per-team and per-project spend caps, following the same pattern as the `ai-gateway rules` interface. The CLI also hardened its sensitive environment variable handling across all commands that fetch secrets [8], not just `vercel env pull`, so device-code re-auth now works uniformly in `vercel dev`, `vercel build`, `vercel link`, and OIDC flows. On the runtime side, the Workflow SDK now enforces the published per-run event limit [10] and fixes unbounded retries on timed-out steps [11], closing two operational pain points. The Python package [9] shipped a refactor to simplify distribution handling. Vercel Eve fixed an auth challenge advertisement bug [12] so Basic-auth prompts actually appear in browsers, ported the Nuxt integration to stable services routing [13], and overhauled the summarizer input for AI agent compaction to preserve full task context instead of truncating at 280 chars [14]. Chat picked up attachment-only message handling [15], custom token factory forwarding for Teams [16], and a new `chat/workflow` export for durable human-in-the-loop approvals [17].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Set correct origin for internal redirects in custom server (#96011) vercel/next.js
  2. [2] Ensure exotic rewrite param values are properly encoded (#96010) vercel/next.js
  3. [3] fix(fetch-cache): key fetch(Request, init) by the effective request (#96009) vercel/next.js
  4. [4] fix(incremental-cache): byte-exact fetch cache key for binary bodies (#96008) vercel/next.js
  5. [5] Validate server reference IDs during manifest lookup (#96007) vercel/next.js
  6. [6] [email protected] ↗ vercel/vercel
  7. [7] feat: add ai-gateway budgets set/list/remove commands ↗ vercel/vercel
  8. [8] [CLI] adding and fixing the handling of all vc env pull commands ↗ vercel/vercel
  9. [9] @vercel/[email protected] ↗ vercel/vercel
  10. [10] Implement `max_events` per run limit ↗ vercel/workflow
  11. [11] [core] Enforce maxRetries for steps that time out ↗ vercel/workflow
  12. [12] fix(eve): auth - advertise configured routeAuth challenges ↗ vercel/eve
  13. [13] fix(eve/nuxt): migrate Vercel production routing to the stable services model ↗ vercel/eve
  14. [14] fix(eve): eviction-first compaction with full-fidelity summarizer input ↗ vercel/eve
  15. [15] fix(chat): keep attachment/link-only messages in toAiMessages ↗ vercel/chat
  16. [16] feat(teams): forward a custom token factory to the Teams SDK ↗ vercel/chat
  17. [17] feat(chat): durable human-in-the-loop approvals via chat/workflow ↗ vercel/chat

Quick answers

What shipped in Vercel on July 22, 2026?
Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests. In total, 68 commits, 68 pull requests, and 9 releases landed.
Who contributed to Vercel on July 22, 2026?
16 developers shipped this update, including github-actions[bot], jeremyphilemon, Melkeydev, healeycodes, Pranay Prakash, shalabhc, VaguelySerious, and Sebastian "Sebbie" Silbermann, and 8 more.
What were the notable Vercel updates?
Set correct origin for internal redirects in custom server (#96011), Ensure exotic rewrite param values are properly encoded (#96010), and fix(fetch-cache): key fetch(Request, init) by the effective request (#96009).

More from @vercel

Vercel @vercel

WORKFLOW BETA REGRESSION FIXED, BENCHMARKS NOW SHOW WHAT MATTERS

The hook.resume() breakdown that tanked [email protected] has regression coverage in place [ref:1], and your performance dashboards just got a major readability upgrade [ref:2].

pranaygp VaguelySerious molebox Walter Korman +13
javascript 152 shipped 1-min read
Vercel @vercel

NEXT.JS PULLS LATEST REACT CANARY, EVE SHIPS TEMPLATE REDESIGN

Next.js v16.3.0-canary.90 landed overnight with fresh React internals, while the Eve site got a ground-up design refresh that adds per-template pages.

allenzhou101 vercel-release-bot next-js-bot[bot]
javascript 6 shipped 1-min read
Vercel @vercel

PASSPORT IDENTITY VERIFICATION LANDS, EVE HANDLES SCHEMA CHAOS, WORKFLOW CACHES PORT LOOKUPS

Passport ships identity token verification [ref:1], Eve stops failing turns on unsupported JSON Schemas [ref:6], and Workflow cuts port discovery overhead by 83% [ref:10].

github-actions[bot] github-actions AndrewBarba allenzhou101 +1
javascript 12 shipped 1-min read
Vercel @vercel

EVE SHIPS HITL FIXES AND EXTENSION DISTRIBUTIONS; NEXT.JS TURBOPACK OPTIMIZES SSR

Eve fixed a critical bug where user approval controls submitted after request resolution were misdirected to newer pending requests, and shipped source-backed extension distributions that let packages publish agent-shaped JavaScript without turning Eve's internals into a public ABI.

ruiconti ctgowrie AndrewBarba Samarth Chitgopekar +12
javascript 101 shipped 2-min read

Daily updates, in your inbox

Follow Vercel

What actually shipped in Vercel, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

CachyOS @cachyos

PROTON 11.0 SHIPS WITH LOW-LATENCY VKD3D, MIRROR NETWORK EXPANDS

Proton 11.0 lands experimental low-latency graphics support while CachyOS adds a Hungary mirror to its distribution tier.

Turi Balázs cantosun99 github-actions github-actions[bot] +1
infra 45 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR TOOLING FIXES LAND AHEAD OF SYSTEM COMPATIBILITY PUSH

The compiler stops misinterpreting profile flags, string reversal handles invalid UTF8 correctly, and Ecto gains fragment column selection in a wave of fixes that shores up core library reliability.

Alexander Gubarev Frank Hunleth greg-rychlewski
elixir 11 shipped 1-min read
.NET @dotnet

COMPLEX NUMBERS NOW IEEE 754 COMPLIANT, SKILLS EVALS GO VALLY-ONLY, UNSAFE EVOLVES

Complex<T> just shipped conformance to C23 Annex G special values, dotnet/skills completed its migration to the Vally eval harness, and the language is tightening unsafe semantics ahead of C# 13.

tannergooding matouskozak EgorBo AbhitejJohn +7
dotnet 141 shipped 2-min read
Spring @spring-projects

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.

Stéphane Nicoll Manu Sridharan filiphr Tran Ngoc Nhan +2
java 17 shipped 1-min read
Want every project, not just this one?