RepoJournal
Vercel @vercel
115 wires and counting

$ follow Vercel

Keep up with Vercel in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-01
stories 176
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

WorkflowAgent gets signed approvals, Vercel's Python hooks become conflict-aware

By RepoJournal · Filed · About Vercel

Felix Arntz NathanColosimo ai-sdk-factory[bot] msullivan karthikscale3 fantix aayush-kapoor
17 people shipped this
Felix Arntz @felixarntz 2 cited NathanColosimo @NathanColosimo 2 cited ai-sdk-factory[bot] @ai-sdk-factory[bot] 1 cited msullivan @msullivan 1 cited karthikscale3 @karthikscale3 1 cited fantix @fantix 1 cited aayush-kapoor @aayush-kapoor n1ckoates @n1ckoates vercel-gh-bot-4[bot] @vercel-gh-bot-4[bot] chadhietala @chadhietala Sebastian "Sebbie" Silbermann @eps1lon Aurora Scharff @aurorascharff Jude Gao @gaojude Will Binns-Smith @wbinnssmith unstubbable @unstubbable github-actions @github-actions elprans @elprans

WorkflowAgent now signs and verifies tool approvals inside durable steps, Vercel's Python workflow client can detect conflicting hook tokens, and vercel/ai consolidated security-sensitive bridge logic.

WorkflowAgent in vercel/ai now supports workflow-safe signed tool approvals via the constructor- and stream-level `experimental_toolApprovalSecret`, which uses an environment-variable reference and binds signatures to approval and tool-call details so client-supplied message history cannot forge or alter approvals [1]. Bridge-backed harness adapters in vercel/ai gained shared `createBridgeToken()` and `withBridgeToken()` helpers, replacing duplicated security-sensitive logic across Codex, Claude Code, OpenCode, DeepAgents, and ACP, and enforcement is included [2]. A follow-up adds `createReadBridgeAsset()` to centralize bridge asset resolution across the same adapters [3]. In vercel/vercel-py, `await hook` now raises `HookDisposedError` instead of returning `None` when a hook is disposed, and the new `HookEvent.get_conflict()` API lets a workflow check whether a hook token is already in use, returning either `None` on successful registration or the owning `Run` on conflict [4][5]. Vercel's workflow core now overlaps workflow compilation with replay loading and prepares replay payloads as event frames arrive, skipping Node-specific work for QuickJS [6][7]. `resumeHook()` in vercel/workflow is now durable before it resolves, writing the `hook_received` event to the event log before publishing the workflow wake [8].

Action items

References

  1. [1] feat: add workflow-safe signed tool approvals to WorkflowAgent (#19976) ↗ vercel/ai
  2. [2] feat(harness): add `createBridgeToken()` and `withBridgeToken()` helpers for bridge backed harness adapters (#20027) ↗ vercel/ai
  3. [3] feat(harness): add reusable `createReadBridgeAsset()` helper function ↗ vercel/ai
  4. [4] workflow: make `await hook` never return `None` (#353) ↗ vercel/vercel-py
  5. [5] workflow: add hook conflict inspection ↗ vercel/vercel-py
  6. [6] [core] Prepare replay payloads as event frames arrive ↗ vercel/workflow
  7. [7] [core] Overlap workflow compilation with replay loading ↗ vercel/workflow
  8. [8] Durable hook resume: write, then wake ↗ vercel/workflow

$ ls vercel/reviews/ # the step-back reads

the week in review AI SDK signs approvals, FilesV4 lifecycle expands the month in review Workflow 4.8 overhauls delivery and sessions, Eve compacts traces, Turbopack cache defaults on
Topics: JavaScript Full archive →

Quick answers

What shipped in Vercel on September 1, 2026?
WorkflowAgent now signs and verifies tool approvals inside durable steps, Vercel's Python workflow client can detect conflicting hook tokens, and vercel/ai consolidated security-sensitive bridge logic. In total, 77 commits, 83 pull requests, and 16 releases landed.
Who contributed to Vercel on September 1, 2026?
17 developers shipped this update, including Felix Arntz, ai-sdk-factory[bot], aayush-kapoor, n1ckoates, vercel-gh-bot-4[bot], chadhietala, Sebastian "Sebbie" Silbermann, and Aurora Scharff, and 9 more.
What were the notable Vercel updates?
feat: add workflow-safe signed tool approvals to WorkflowAgent (#19976), feat(harness): add `createBridgeToken()` and `withBridgeToken()` helpers for bridge backed harness adapters (#20027), and feat(harness): add reusable `createReadBridgeAsset()` helper function.
♥

$ log @vercel --recent

Turborepo fixes stale global-input hashing, adds experimental Go workspace graph 54 shipped Uncapped chat history retention, dev overlay route overrides fixed 17 shipped httpx2 migration revived, workflow payloads encrypted in vercel-py 91 shipped Eve ships per-session token cost limits, Next.js tightens Server Action errors 143 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.