RepoJournal
Vercel @vercel
115 wires and counting

$ follow Vercel

Keep up with Vercel in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-02
stories 180
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

FilesV4 gains full file lifecycle, eve fixes session startup

By RepoJournal · Filed · About Vercel

Kevin Dawkins Anthony Shew Gregor Martynus AndrewBarba chadhietala github-actions[bot] github-actions
13 people shipped this
Kevin Dawkins @kkdawkins 2 cited Anthony Shew @anthonyshew 2 cited Gregor Martynus @gr2m 1 cited AndrewBarba @AndrewBarba 1 cited chadhietala @chadhietala 1 cited github-actions[bot] @github-actions[bot] github-actions @github-actions OwenKephart @OwenKephart Steven @styfle Niklas Mischkulnig @mischnic Luke Sandberg @lukesandberg vercel-gh-bot-2[bot] @vercel-gh-bot-2[bot] nityam @Nixxx19

vercel/ai extends FilesV4 with optional download and metadata methods while eve removes a session startup bottleneck, and both provider-utils and @turbo/releaser ship security updates.

vercel/ai extends the FilesV4 files interface with optional getFileMetadata, downloadFile, and deleteFile methods, following the VideoModelV4 pattern [1]. The new methods are non-breaking for the six existing implementers, and OpenAIFiles now implements the full surface, streaming downloads through a ReadableStream without buffering [2]. A notable event: downloading file content passes through as a ReadableStream, never buffered. Separately, provider-utils updates undici from 7.28 to 7.29 to address CVE-2026-13697, and the ai-functions example workspace receives a similar undici bump [3]. This is a security patch; upgrade your @ai-sdk/provider-utils dependency to include undici 7.29+. In eve, session creation previously waited for a stable command inbox, causing repeated hook lookups; it now returns its durable ID immediately, with session.send() using three bounded retries to bridge the readiness race [4]. Remote agent hops no longer lose the origin audience and upstream input/output capture limits; sampled remote starts now use forwardPrincipal to carry the immutable origin audience in W3C Baggage [5]. For turborepo, experimental command overrides now replace only task execution while preserving native task defaults, inputs, outputs, environment, and cache policy [6]. Finally, @turbo/releaser now depends on tar 7.5.22, fixing CVE-2026-73566, a high-severity stack overflow triggered by a crafted gzip tar [7].

Action items

References

  1. [1] feat(provider): add optional getFileMetadata/downloadFile/deleteFile to FilesV4 + streaming upload support (#20036) ↗ vercel/ai
  2. [2] feat(openai): implement getFileMetadata/downloadFile/deleteFile and streaming uploads on OpenAIFiles (#20037) ↗ vercel/ai
  3. [3] fix(provider-utils): update undici for CVE-2026-13697 (#20165) ↗ vercel/ai
  4. [4] fix(eve): session startup - return early and retry follow-ups ↗ vercel/eve
  5. [5] feat(eve): preserve trusted remote trace ceilings ↗ vercel/eve
  6. [6] fix: Preserve task metadata for command overrides ↗ vercel/turborepo
  7. [7] fix: Bump tar to 7.5.22 in @turbo/releaser (CVE-2026-73566) (#13911) ↗ vercel/turborepo

$ ls vercel/reviews/ # the step-back reads

the week in review AI SDK signs approvals, FilesV4 lifecycle expands the month in review Workflow 4.8 overhauls delivery and sessions, Eve compacts traces, Turbopack cache defaults on
Topics: JavaScript Full archive →

Quick answers

What shipped in Vercel on September 2, 2026?
vercel/ai extends FilesV4 with optional download and metadata methods while eve removes a session startup bottleneck, and both provider-utils and @turbo/releaser ship security updates. In total, 76 commits, 84 pull requests, and 20 releases landed.
Who contributed to Vercel on September 2, 2026?
13 developers shipped this update, including Kevin Dawkins, Gregor Martynus, github-actions[bot], github-actions, AndrewBarba, chadhietala, OwenKephart, and Steven, and 5 more.
What were the notable Vercel updates?
feat(provider): add optional getFileMetadata/downloadFile/deleteFile to FilesV4 + streaming upload support (#20036), feat(openai): implement getFileMetadata/downloadFile/deleteFile and streaming uploads on OpenAIFiles (#20037), and fix(provider-utils): update undici for CVE-2026-13697 (#20165).
♥

$ log @vercel --recent

Turborepo fixes stale global-input hashing, adds experimental Go workspace graph 54 shipped Uncapped chat history retention, dev overlay route overrides fixed 17 shipped httpx2 migration revived, workflow payloads encrypted in vercel-py 91 shipped Eve ships per-session token cost limits, Next.js tightens Server Action errors 143 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.