Who contributed to Vercel on August 25, 2026?

15 developers shipped this update, including alangenfeld, AndrewBarba, zacowan, prha, Gregor Martynus, github-actions[bot], bryan-hunter, and ai-sdk-factory, and 7 more.

What were the notable Vercel updates?

docs: update security reporting instructions (#19364), Turbopack: Improve file existence error handling in realpath_with_links and in module resolution (#97717), and Write traces with buffered synchronous IO (#96874).

@vercel

Next.js + the Vercel platform - frontend infrastructure for the web

github ↗

Pick a date

Topics: JavaScript Full archive →

The Wire · Showcase

AI SDK redirects security reports to HackerOne as Next.js fixes Turbopack regressions

By RepoJournal · Filed 06:56 UTC on August 25, 2026 · About Vercel

15 people shipped this

AndrewBarba @AndrewBarba 1 cited

zacowan @zacowan 1 cited

Gregor Martynus @gr2m 1 cited

Benjamin Woodruff ‮ @bgw 1 cited

Will Binns-Smith @wbinnssmith 1 cited

Luke Sandberg @lukesandberg 1 cited

shalabhc @shalabhc 1 cited

NathanColosimo @NathanColosimo 1 cited

alangenfeld @alangenfeld

prha @prha

github-actions[bot] @github-actions[bot]

bryan-hunter @bryan-hunter

ai-sdk-factory @ai-sdk-factory

Marcos Hernanz @marcoshernanz

Tobias Koppers @sokra

Vercel's AI SDK just moved its entire vulnerability disclosure channel, and Next.js shipped a batch of Turbopack stability fixes that affect every production deploy.

The AI SDK's security reporting now points directly to Vercel's Open Source HackerOne program, replacing an unmonitored email address [1]. That matters because a real vulnerability reported to the old address could have gone unseen. Next.js, meanwhile, closed three Turbopack regressions: file existence errors now match libc behavior in module resolution [2], a build-hanging trace reporter switched to buffered synchronous IO [3], and dev startup sweeps stale content-hashed chunks from `.next/dev` after a week [4]. On the runtime side, workflow now reports replay cost for every step batch, not just the first, with a `retained` optimization tag [5], and the Python conformance lanes are advisory until the runtime supports specVersion 7 [6]. The canonical source graph research in eve [7] and the Slack Block Kit text extraction [8] round out a busy cycle, with 104 commits, 113 PRs, and 14 releases across the four repos.

Action items

→ Update AI SDK security policy and point reporters to the HackerOne program vercel/ai [immediate]
→ Upgrade Next.js to include Turbopack fixes for file resolution and trace flushing vercel/next.js [plan]
→ Monitor workflow replay cost metrics after the new per-batch reporting vercel/workflow [monitor]

References

[1] docs: update security reporting instructions (#19364) vercel/ai
[2] Turbopack: Improve file existence error handling in realpath_with_links and in module resolution (#97717) vercel/next.js
[3] Write traces with buffered synchronous IO (#96874) vercel/next.js
[4] Sweep stale Turbopack output from distDir on dev startup (#97591) vercel/next.js
[5] feat(runtime): report replay cost per step batch, flagged by retained-VM mode ↗ vercel/workflow
[6] [ci] Make Python CI e2e optional until it support specVersion 7 ↗ vercel/workflow
[7] docs(eve): research - define the canonical source graph ↗ vercel/eve
[8] feat(eve): slack - derive inbound message text from Block Kit and legacy attachments ↗ vercel/eve

Quick answers

What shipped in Vercel on August 25, 2026?: Vercel's AI SDK just moved its entire vulnerability disclosure channel, and Next.js shipped a batch of Turbopack stability fixes that affect every production deploy. In total, 104 commits, 113 pull requests, and 14 releases landed.
Who contributed to Vercel on August 25, 2026?: 15 developers shipped this update, including alangenfeld, AndrewBarba, zacowan, prha, Gregor Martynus, github-actions[bot], bryan-hunter, and ai-sdk-factory, and 7 more.
What were the notable Vercel updates?: docs: update security reporting instructions (#19364), Turbopack: Improve file existence error handling in realpath_with_links and in module resolution (#97717), and Write traces with buffered synchronous IO (#96874).

TURBOREPO SHIPS DURABLE FACTORY WORKSPACES

Anthony Shew just turned Turborepo's Factory from throwaway browser chats into persistent, shareable workspaces, and he fixed the network policy twice to get there.

javascript 32 shipped

@vercel Aug 23

EVE PATCHES SESSION LEAK, DEEPGRAM STOPS DROPPING OPTIONS

Vercel's own tooling is quietly fixing the kind of bugs that make production AI apps flaky, and the Deepgram provider is finally honoring the options you thought you were sending.

javascript 18 shipped

@vercel Aug 22

EVE TRACING GOES PUBLIC-ONLY AS PRIVACY GATES LAND

Eve's new audience-aware tracing means private and unknown conversations stop being traced by default, and that's a breaking change you need to plan for.