Vercel CLI

Adds a verifyIdentity helper for verifying forwarded Passport identity tokens.

@vercel/connect@0.4.1 adds compatibility testing against a recent stable Eve release and AI SDK 7.

Improved vercel ai-gateway coding-agents setup prompts with a searchable team picker, persistent multiselect key legend, and narrower prompt lines. New --apply <edit|prompt> flag supports non-interactive agent handoff — pipes setup instructions to stdout or clipboard.

Linked-project deploys now work with project-scoped tokens that cannot fetch owner user or team resources, fixing a failure when limited-scope tokens were used.

Error and warning messages that previously referenced experimentalServices now use services instead, and error codes have been renamed accordingly (e.g. NO_EXPERIMENTAL_SERVICES_CONFIGURED → NO_SERVICES_CONFIGURED).

Added an optional claims field to ConnectTokenResponse for allow-listed upstream OAuth token claims.

Rust projects' target/ directory, which can be hundreds of MB, is now automatically skipped during vercel deploy and vercel dev when a root Cargo.toml is detected. Users can opt back in with !/target in their .vercelignore. Also hardened the local file scanner to skip directories removed mid-scan instead of crashing.

Supports Python services declaring their web app and development workflow sidecars through a pyproject.toml entrypoint in vercel dev. Fixed a domain alias mutation being sent under a stale ambient team scope, and fixed vercel dev returning 404 for api/ functions using rust, python, ruby, or go runtimes when the project has a framework dev command.

Services framework preset in Vercel CLI is now marked as stable.

Migrated @vercel/client and @vercel/build-utils from node-fetch to native fetch, replacing the agent?: http.Agent option with dispatcher?: FetchDispatcher (an undici dispatcher). Added vercel flags versions <flag> and vercel flags versions diff <flag> --revision <number> to inspect feature flag version history. vercel logs --follow now resolves a deployment automatically, and vercel logs defaults to --expand output when stderr is not a TTY.

Exposes and documents the per-issuance tokenId on ConnectTokenResponse, returned by getToken/getTokenResponse, for correlating a token with its usage in Vercel observability and billing data.

vercel env add now accepts a comma-separated list of environments (e.g. production,preview,development) to create a single Environment Variable spanning multiple targets. Invalid environment names fail locally, and non-interactive error payloads suggest the multi-target form. Also added finer-grained vc.doBuild spans for build-container tracing and fixed a native-trampoline test version hardcoding.

Fixed critical filesystem trust boundaries: vercel init no longer materializes symlinks or hardlinks from downloaded example archives (blocking tar link-following path traversal, CVE-2024-12905 and CVE-2025-48387), and the deploy root-directory check now normalizes paths to prevent sibling directory selection.

Services can now set entrypoint: "pyproject.toml" to build directly from the file's tool.vercel declarations, bypassing auto-detection. A bytecode-first packing mode (VERCEL_PYTHON_COMPILEALL) reduces cold-start overhead for large dependency builds, and tool.vercel.workflows support is added.

vercel routes export now uses --output instead of --format — update scripts to routes export --output ts. The new vercel ai-gateway coding-agents setup command connects Claude Code, Codex, OpenCode, and Pi to the AI Gateway, with optional key provisioning, macOS Keychain storage, spend limits, and dry-run previews.

Fixed a security vulnerability where routePrefix could be exploited for path traversal when mounting static build output.

Node.js Middleware instrumentation is now included in @vercel/next.

Added Lovable as a supported platform framework with a new platform attribute.

The @vercel/container builder now resolves matching vercel.json and per-service functions entries at build time, applying memory, maxDuration, architecture, regions, functionFailoverRegions, experimentalTriggers, and supportsCancellation settings to container runtime outputs via .vc-config.json.

CLI deployments now finish from alias-assigned build stream events while retaining deployment polling as a fallback mechanism.