RepoJournal
Vercel

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Wed 22 jul
  2. Thu 23 jul
  3. Fri 24 jul
  4. Sat 25 jul
  5. Sun 26 jul
  6. Mon 27 jul
  7. Tue 28 jul
  8. Wed 29 jul
  9. Thu 30 jul
  10. Fri 31 jul
  11. Sat 1 aug
  12. Sun 2 aug
  13. Mon 3 aug
  14. Tue 4 aug
  15. Wed 5 aug
  16. Thu 6 aug
  17. Fri 7 aug
  18. Sat 8 aug
  19. Sun 9 aug
  20. Mon 10 aug
  21. Tue 11 aug
  22. Wed 12 aug
  23. Thu 13 aug
  24. Fri 14 aug
  25. Sat 15 aug
  26. Sun 16 aug
  27. Mon 17 aug
  28. Tue 18 aug
  29. Wed 19 aug
  30. Today 20 aug
Topics: JavaScript Full archive →

The Wire · Showcase

MCP OAuth hardening lands, Fireworks structured outputs fixed

By RepoJournal · Filed · About Vercel

dglsparsons Aayush Kapoor ai-sdk-factory[bot] Kevin Dawkins VaguelySerious ruiconti benpankow
15 people shipped this
dglsparsons @dglsparsons 3 cited Aayush Kapoor @aayush-kapoor 1 cited ai-sdk-factory[bot] @ai-sdk-factory[bot] 1 cited Kevin Dawkins @kkdawkins 1 cited VaguelySerious @VaguelySerious 1 cited ruiconti @ruiconti 1 cited benpankow @benpankow 1 cited fantix @fantix 1 cited Brice Lechatellier @gdaybrice Mohamed Rebai @MohamedRebai41 mitul-s @mitul-s alangenfeld @alangenfeld chadhietala @chadhietala ctgowrie @ctgowrie OwenKephart @OwenKephart

AI SDK patches a security hole in OAuth client registration while unlocking structured outputs for Fireworks models.

Vercel's AI SDK shipped a breaking MCP update hardening OAuth client registration against the latest protocol requirements, including RFC 9207 `iss` validation and mandatory `application_type` [1]. This pairs with a Fireworks fix that finally enables structured outputs for chat models, ending silent degradation of JSON schema requests [2]. And if you've wrestled with LangGraph tool-call ID collisions, the SDK now preserves tool lifecycles when provider IDs repeat across steps [3]. Over in the workflow engine, a 100-line core diff pins draw order to event-log order, killing the residual `CORRUPTED_EVENT_LOG` class that plagued slot-mode runs [4]. For Terraform users, the provider now imports webhooks without forcing secret rotation and keeps firewall config IDs intact [5][6]. The release notes for the firewall fix say the provider can "mistake the edit for a removal plus insertion," but that's fixed too [7]. Rounding out the stack, Eve's approval flow stops duplicating pending approvals and restores Slack approval settlement feedback [8][9], while vercel-py lets you attach metadata to hooks for richer workflow context [10]. Across 22 stories and 51 commits, this is a day of correctness and security.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] feat(mcp): harden oauth client registration according to latest protocol (#19043) vercel/ai
  2. [2] fix(fireworks): enable structured outputs for chat models (#19025) vercel/ai
  3. [3] fix: preserve LangGraph tool lifecycles when provider tool call IDs repeat across steps (#18837) vercel/ai
  4. [4] [core] Pin draw order to event-log order: retire delivery barriers through one ordered dispenser ↗ vercel/workflow
  5. [5] Add import support for Vercel webhooks ↗ vercel/terraform-provider-vercel
  6. [6] Keep project IDs in firewall config state ↗ vercel/terraform-provider-vercel
  7. [7] Update edited firewall rules in place ↗ vercel/terraform-provider-vercel
  8. [8] fix(eve): prevent duplicate pending approvals ↗ vercel/eve
  9. [9] fix(eve): wait for Slack approval settlement ↗ vercel/eve
  10. [10] workflow: attach metadata to a hook ↗ vercel/vercel-py

Quick answers

What shipped in Vercel on August 19, 2026?
AI SDK patches a security hole in OAuth client registration while unlocking structured outputs for Fireworks models. In total, 51 commits, 55 pull requests, and 12 releases landed.
Who contributed to Vercel on August 19, 2026?
15 developers shipped this update, including Aayush Kapoor, ai-sdk-factory[bot], Brice Lechatellier, Kevin Dawkins, Mohamed Rebai, mitul-s, alangenfeld, and VaguelySerious, and 7 more.
What were the notable Vercel updates?
feat(mcp): harden oauth client registration according to latest protocol (#19043), fix(fireworks): enable structured outputs for chat models (#19025), and fix: preserve LangGraph tool lifecycles when provider tool call IDs repeat across steps (#18837).

More from @vercel

Vercel @vercel

NEXT.JS REMOVES UNSTABLE_EAGER AS AI SDK BLOCKS UNSAFE TOOL EXECUTION

Next.js is cleaning house on Partial Prefetching while the AI SDK ships a safety patch that stops side-effecting tools from running after truncated model outputs.

Josh Story Janka Uryga Will Binns-Smith mischnic +15
javascript 165 shipped
Vercel @vercel

AI SDK fixes Gemini 3.7 Flash as chat and Eve harden core flows

Gemini 3.7 Flash just broke for minimal reasoning, and the fix that landed overnight says more about the AI SDK's trajectory than any feature release.

ai-sdk-factory[bot] github-actions ai-sdk-factory github-actions[bot] +9
javascript 70 shipped
Vercel @vercel

NEXT.JS TURBO LAYER GETS GARBAGE COLLECTION PLUMBING, AI PACKAGE FIXES PROVIDER USAGE DATA

Next.js is laying the foundation for task garbage collection across its persistence layer while fixing a critical gap in how OpenAI-compatible providers report token usage.

shaper lukesandberg unstubbable github-actions +2
javascript 20 shipped
Vercel @vercel

NEXT.JS ROUTER ARCHITECTURE SHIFTS INTO CONCURRENT MODE

The Next.js team is laying foundation for a concurrent-rendering-aware router rewrite, while simultaneously cleaning up years of structural debt across the client-side codebase.

acdlite gnoff timneutkens Niklas Mischkulnig +3
javascript 31 shipped

Daily updates, in your inbox

Follow Vercel

Keep up with Vercel in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LangChain ships core 1.6.0 with a security warning tucked inside

LangChain's newest core release fixes a tool-injection bug, but the fix itself widens the path for arbitrary code execution.

Mason Daugherty github-actions[bot] FraterCCCLXIII juanmichelini +4
ai-agents 95 shipped
Local LLMs Local LLMs

OLLAMA FIXES DEADLOCK THAT HUNG CHAT AND GENERATE

A mid-stream parser error in Ollama's server silently wedged chat and generate requests, leaking goroutines and hanging retries until a fix landed overnight.

hoyyeva dhiltgen ParthSareen Kevin Hopper +14
llms 268 shipped
CachyOS @CachyOS

LINUX-CACHYOS SHIPS 7.2.0-1

CachyOS's custom kernel just advanced to 7.2.0-1, and the sched-ext toolchain is moving in lockstep.

github-actions ptr1337 Piotr Gorski
infra 55 shipped
Elixir & Phoenix Elixir & Phoenix

LIVE VIEW HOOKS GET THE ELOQUENT TREATMENT

Phoenix Live View is shipping a passel of hook and JS-client fixes today, headlined by new beforeUpdate arguments that hand you more control over a hook's lifespan.

dkuku SteffenDE lukaszsamson José Valim
elixir 17 shipped
Want every project, not just this one?