$ the-wire · showcase
AI SDK redirects security reports to HackerOne as Next.js fixes Turbopack regressions
By RepoJournal · Filed · About Vercel · Composed from the cited sources · methodology
15 people shipped this
AndrewBarba
@AndrewBarba
1 cited
zacowan
@zacowan
1 cited
Gregor Martynus
@gr2m
1 cited
Benjamin Woodruff
@bgw
1 cited
Will Binns-Smith
@wbinnssmith
1 cited
Luke Sandberg
@lukesandberg
1 cited
shalabhc
@shalabhc
1 cited
NathanColosimo
@NathanColosimo
1 cited
alangenfeld
@alangenfeld
prha
@prha
github-actions[bot]
@github-actions[bot]
bryan-hunter
@bryan-hunter
ai-sdk-factory
@ai-sdk-factory
Marcos Hernanz
@marcoshernanz
Tobias Koppers
@sokra
Vercel's AI SDK just moved its entire vulnerability disclosure channel, and Next.js shipped a batch of Turbopack stability fixes that affect every production deploy.
The AI SDK's security reporting now points directly to Vercel's Open Source HackerOne program, replacing an unmonitored email address [1]. That matters because a real vulnerability reported to the old address could have gone unseen. Next.js, meanwhile, closed three Turbopack regressions: file existence errors now match libc behavior in module resolution [2], a build-hanging trace reporter switched to buffered synchronous IO [3], and dev startup sweeps stale content-hashed chunks from `.next/dev` after a week [4]. On the runtime side, workflow now reports replay cost for every step batch, not just the first, with a `retained` optimization tag [5], and the Python conformance lanes are advisory until the runtime supports specVersion 7 [6]. The canonical source graph research in eve [7] and the Slack Block Kit text extraction [8] round out a busy cycle, with 104 commits, 113 PRs, and 14 releases across the four repos.
Action items
- → Update AI SDK security policy and point reporters to the HackerOne program vercel/ai [immediate]
- → Upgrade Next.js to include Turbopack fixes for file resolution and trace flushing vercel/next.js [plan]
- → Monitor workflow replay cost metrics after the new per-batch reporting vercel/workflow [monitor]
References
- [1] docs: update security reporting instructions (#19364) vercel/ai ↗
- [2] Turbopack: Improve file existence error handling in realpath_with_links and in module resolution (#97717) vercel/next.js ↗
- [3] Write traces with buffered synchronous IO (#96874) vercel/next.js ↗
- [4] Sweep stale Turbopack output from distDir on dev startup (#97591) vercel/next.js ↗
- [5] feat(runtime): report replay cost per step batch, flagged by retained-VM mode ↗ vercel/workflow
- [6] [ci] Make Python CI e2e optional until it support specVersion 7 ↗ vercel/workflow
- [7] docs(eve): research - define the canonical source graph ↗ vercel/eve
- [8] feat(eve): slack - derive inbound message text from Block Kit and legacy attachments ↗ vercel/eve
