Who contributed to Vercel on July 29, 2026?

15 developers shipped this update, including github-actions[bot], Nathan Rajlich, Nathan Colosimo, VaguelySerious, Anthony Shew, DavidIlie, timneutkens, and sampoder, and 7 more.

What were the notable Vercel updates?

workflow@5.0.0-beta.37, fix(core): seal forwarded writes for workflow-body writables (#3155), and fix(core): seal forwarded writes for workflow-body writables.

WORKFLOW BREAKS DEPRECATED SETATTRIBUTES ALIASES; TURBOREPO LOCKS DOWN RELEASE AUTOMATION

Workflow 5.0.0-beta.37 removes the setAttributes deprecation aliases you've been warned about, while Turborepo cuts stored credentials entirely from its release pipeline.

Workflow shipped its breaking change window [1], dropping the `experimental_setAttributes` and `ExperimentalSetAttributesOptions` aliases that have been deprecated since earlier betas. If you're still using those names, your build breaks now. The real fix landed alongside this: sealing forwarded writes for workflow-body writables [2], which closes an encryption gap where workflow bodies weren't engaging the owner's public key optimization that motivated the whole rewrite [3]. Turborepo tightened its CI radically with two consecutive releases [4][5], replacing the expired `TURBOBOT` credential with ephemeral workflow tokens and a pinned semantic review gate, then deleting the legacy package authority system entirely [6] as part of the knowledge completion stack. Task hashing now uses resolution fingerprints instead of closure fields [7], removing a whole class of fallback logic. Next.js isolated Request Insights from user OpenTelemetry [8], keeping diagnostic spans in the local recorder while the user's active context stays unchanged. The team also surfaced Instant Insights as a detached root span with validation phases [9], persisted the verbose setting globally [10], and classified internal records to reduce noise [11]. Eve wired its AI lifecycle bridge per model attempt [20], completing the second phase of local observability for the AI SDK, after landing the provider-neutral primitives in the first pass [18]. Connection and instrumentation registries came online for all 39 integrations [17][19], turning manual setup into `eve add connection/<slug>` and `eve add instrumentation/<provider>` commands. Vercel's CLI replaced the workers-based queue subscribers with vercel-queue [12], keeping backwards compat while surfacing new features, and restructured the native binary release flow so `@vercel/vc-native-*` packages publish before the changesets release, resolving as optionalDependencies on first install [13]. The team also fixed a `--json` regression [14], rewired release detection to check changesets state instead of npm version [15], and shipped `vercel vcr build` and `vercel vcr push` subcommands [16].