RepoJournal
Vercel

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Wed 17 jun
  2. Thu 18 jun
  3. Fri 19 jun
  4. Sat 27 jun
  5. Sun 28 jun
  6. Mon 29 jun
  7. Tue 30 jun
  8. Wed 1 jul
  9. Thu 2 jul
  10. Fri 3 jul
  11. Sat 4 jul
  12. Sun 5 jul
  13. Mon 6 jul
  14. Tue 7 jul
  15. Wed 8 jul
  16. Thu 9 jul
  17. Fri 10 jul
  18. Sat 11 jul
  19. Mon 13 jul
  20. Tue 14 jul
  21. Wed 15 jul
  22. Thu 16 jul
  23. Fri 17 jul
  24. Sat 18 jul
  25. Sun 19 jul
  26. Mon 20 jul
  27. Tue 21 jul
  28. Wed 22 jul
  29. Thu 23 jul
  30. Today 24 jul
Topics: JavaScript Full archive →

The Wire · Showcase

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

By RepoJournal · Filed · About Vercel

Nathan Rajlich jeffsee55 joeyhotz VaguelySerious gaearon Melkeydev Andrew Barba
13 people shipped this
Nathan Rajlich @TooTallNate 2 cited jeffsee55 @jeffsee55 2 cited joeyhotz @joeyhotz 1 cited VaguelySerious @VaguelySerious 1 cited gaearon @gaearon 1 cited Melkeydev @Melkeydev 1 cited Andrew Barba @AndrewBarba 1 cited Sam Poder @sampoder aurorascharff @aurorascharff MOHAMMED WASIM KHAN @wasim-builds ricardo-agz @ricardo-agz gscho @gscho OwenKephart @OwenKephart

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

Workflow patched two dependency vulnerabilities in a single commit push: Next upgraded to 16.2.11 to address CVE-2026-64641 [1], and PostCSS bumped to 8.5.12 to address CVE-2026-45623 [2], with an override ensuring transitive PostCSS versions get patched too. Eve added a security fix [9] that keeps workflow failures private, closing an unspecified exposure vector. Beyond security, Workflow's HTTP delivery now aborts stalled requests on shutdown [3], fixing a graceful-termination hang in self-hosted deployments with short grace periods. Benchmark improvements shipped across both Workflow and Next: Workflow added SO (Stream Overhead) scenario modeling token-streaming with 300 fake chunks at 100/sec [4], while Next's render-pipeline bench now reports TTFB per route and Flight payload attribution [5]. CLI got three forward-looking improvements: team scope now persists across re-login to prevent accidental resource creation in personal accounts [6], native binary trampoline got an opt-in config gate ahead of full integration [7], and first deploys now warn when assigned to production without explicit `--prod` flag [8].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix: upgrade next to 16.2.11 to address CVE-2026-64641 (#3071) vercel/workflow
  2. [2] fix: upgrade postcss to >=8.5.12 to address CVE-2026-45623 (#3067) vercel/workflow
  3. [3] fix(world-postgres): abort stalled HTTP delivery on shutdown ↗ vercel/workflow
  4. [4] [benchmarks] Add SO (stream overhead) scenario + collapse PR-comment smallprint ↗ vercel/workflow
  5. [5] [Bench] Add client-trace attribution pass and document metrics to render-pipeline ↗ vercel/next.js
  6. [6] [cli] Preserve team scope across re-login and un-wedge `vc switch` from stale teams ↗ vercel/vercel
  7. [7] [CLI] Add opt-in config for native binary trampoline ↗ vercel/vercel
  8. [8] feat(cli): add notice for first deploy assigned to production ↗ vercel/vercel
  9. [9] fix(eve): security - keep workflow failures private (#1124) vercel/eve

Quick answers

What shipped in Vercel on July 24, 2026?
Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility. In total, 75 commits, 74 pull requests, and 4 releases landed.
Who contributed to Vercel on July 24, 2026?
13 developers shipped this update, including Nathan Rajlich, joeyhotz, VaguelySerious, Sam Poder, gaearon, aurorascharff, MOHAMMED WASIM KHAN, and Melkeydev, and 5 more.
What were the notable Vercel updates?
fix: upgrade next to 16.2.11 to address CVE-2026-64641 (#3071), fix: upgrade postcss to >=8.5.12 to address CVE-2026-45623 (#3067), and fix(world-postgres): abort stalled HTTP delivery on shutdown.

More from @vercel

Vercel @vercel

WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS

Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.

github-actions[bot] github-actions Lars Grammel Felix Arntz +9
javascript 132 shipped 2-min read
Vercel @vercel

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

github-actions[bot] jeremyphilemon Melkeydev healeycodes +12
javascript 145 shipped 2-min read
Vercel @vercel

WORKFLOW BETA REGRESSION FIXED, BENCHMARKS NOW SHOW WHAT MATTERS

The hook.resume() breakdown that tanked [email protected] has regression coverage in place [ref:1], and your performance dashboards just got a major readability upgrade [ref:2].

pranaygp VaguelySerious molebox Walter Korman +13
javascript 152 shipped 1-min read
Vercel @vercel

NEXT.JS PULLS LATEST REACT CANARY, EVE SHIPS TEMPLATE REDESIGN

Next.js v16.3.0-canary.90 landed overnight with fresh React internals, while the Eve site got a ground-up design refresh that adds per-template pages.

allenzhou101 vercel-release-bot next-js-bot[bot]
javascript 6 shipped 1-min read

Daily updates, in your inbox

Follow Vercel

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

github-actions[bot] ccurme ak684 tofarr +2
ai-agents 62 shipped 1-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

Jesse Gross github-actions[bot] yuyue0225sc davidjpyu +8
llms 157 shipped 2-min read
CachyOS @CachyOS

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

github-actions Vladislav Nepogodin loathingKernel cantosun99 +2
infra 57 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

AlexGx Eurico Nicacio SteffenDE lukaszsamson +1
elixir 23 shipped 2-min read
Want every project, not just this one?