Who contributed to Vercel on July 26, 2026?

4 developers shipped this update, including petehunt, gaearon, unstubbable, and github-actions[bot].

What were the notable Vercel updates?

fix(sandbox): release one-shot timeout ids after they run, Fix dev overlay symbolication for project paths needing percent-encoding, and Read chunk source maps from disk in the dev validation worker.

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

NEXT.JS PLUGS MEMORY LEAK IN EDGE RUNTIME, FIXES DEV OVERLAY ENCODING BUGS

By RepoJournal · Filed 06:55 UTC on July 26, 2026 · About Vercel

4 people shipped this

gaearon @gaearon 2 cited

unstubbable @unstubbable 2 cited

github-actions[bot] @github-actions[bot] 2 cited

petehunt @petehunt 1 cited

A critical sandbox memory leak that causes step-like heap growth in self-hosted Next.js servers is patched, while dev overlay symbolication now correctly handles project paths with special characters.

Next.js shipped a fix for a heap growth bug in the Edge runtime sandbox where one-shot `setTimeout` calls tracked by `TimeoutsManager` are never released after firing, causing monotonic resource accumulation and eventual OOM in long-lived standalone servers [1]. The same build addresses two dev overlay breaks: Turbopack's source map symbolication now handles percent-encoded project paths correctly by properly normalizing encoding before comparing file URIs [2], and the dev validation worker reads chunk source maps from disk to correctly map dynamic imports and server component chunks that Node.js never loads into its isolate cache [3]. A related fix disables the dev validation worker entirely when using Webpack instead of Turbopack, since Webpack keeps source maps in the compiler rather than on disk [4]. On the tooling side, an internal skill was added to benchmark React and Next PRs in sandboxes, running interleaved comparisons against mergebase and caching reusable builds between test runs [5]. On the AI SDK front, five patch releases cascaded across Google Vertex, Anthropic, Anthropic AWS, and Amazon Bedrock to propagate an Anthropic fix that now correctly reports thinking tokens as reasoning token usage [6], while Bedrock also dropped tool `strict` and `output_config.format` parameters that Claude models reject [7].

Action items

→ Upgrade Next.js immediately if running self-hosted or standalone mode to stop heap growth vercel/next.js [immediate]
→ Update @ai-sdk/anthropic to 4.0.21 for correct token usage reporting on Claude models vercel/ai [plan]
→ Monitor dev overlay symbolication in local builds after upgrading, especially in paths with spaces or special characters vercel/next.js [monitor]

References

[1] fix(sandbox): release one-shot timeout ids after they run ↗ vercel/next.js
[2] Fix dev overlay symbolication for project paths needing percent-encoding ↗ vercel/next.js
[3] Read chunk source maps from disk in the dev validation worker ↗ vercel/next.js
[4] Run dev validation in process when using Webpack ↗ vercel/next.js
[5] [internal] Add a skill for benching changes in a sandbox ↗ vercel/next.js
[6] @ai-sdk/[email protected] ↗ vercel/ai
[7] @ai-sdk/[email protected] ↗ vercel/ai

Quick answers

What shipped in Vercel on July 26, 2026?: A critical sandbox memory leak that causes step-like heap growth in self-hosted Next.js servers is patched, while dev overlay symbolication now correctly handles project paths with special characters. In total, 10 commits, 10 pull requests, and 11 releases landed.
Who contributed to Vercel on July 26, 2026?: 4 developers shipped this update, including petehunt, gaearon, unstubbable, and github-actions[bot].
What were the notable Vercel updates?: fix(sandbox): release one-shot timeout ids after they run, Fix dev overlay symbolication for project paths needing percent-encoding, and Read chunk source maps from disk in the dev validation worker.

NEXT.JS OPTIMIZES APP ROUTING ENTRY POINTS WHILE WORKFLOW CUTS STREAM LATENCY 20 PERCENT

Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.

+11

javascript 126 shipped 2-min read

@vercel 2 days ago

TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT

Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.

javascript 153 shipped 1-min read

@vercel 3 days ago

WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS

Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.

javascript 132 shipped 2-min read

@vercel 4 days ago

NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS

Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.

+12

javascript 145 shipped 2-min read

Elsewhere on the wire

AI Agents about 5 hours ago

OPENHANDS CUTS EVENT NOISE, CLINE SCRUBS DEAD CODE ACROSS TWO DESKS

OpenHands shipped a filter to stop forwarding unrequested automation events, while Cline burned down five legacy UI bugs in one sprint.

ai-agents 14 shipped 1-min read

Local LLMs about 5 hours ago

LLAMA.CPP LOCKS DOWN WASM, ADDS MCP STDIO, HEXAGON GETS IM2COL ACCELERATION

llama.cpp disabled OpenMP for Emscripten builds to fix WASM compilation, while shipping full MCP stdio support and unlocking 1.5x to 3.5x latency gains on Hexagon vision models.

llms 139 shipped 2-min read

@CachyOS about 5 hours ago

LINUX 7.1.5 AND 6.18.40 SHIP WITH UPSTREAM REBASES AND DRIVER FIXES

CachyOS dropped two kernel releases overnight, pulling in upstream stability patches and refining the apple-bce driver stack for T2 Macs.

infra 61 shipped 1-min read

Elixir & Phoenix about 5 hours ago

ELIXIR STRIPS REDUNDANT GUARDS, FIXES TUPLE PROJECTION BUG

Barna Kovacs landed three optimization PRs removing dead code from core Enum and Calendar modules, while a separate fix addresses a flawed tuple projection algorithm that was producing inconsistent type representations.