package.json. The node
framework is now detected from a server.* entrypoint alone, and the
@vercel/backends builder defaults the module format to ESM ("module") when
no package.json is present instead of erroring with "Unable to resolve format".01e18e8: Add hasFallback, htmlSize, and isDynamicRoute to Prerender
These optional fields surface per-route PPR shell metadata in the Build Output so consumers can classify prerenders (e.g. full shell vs. empty shell vs. concrete prerender):
hasFallback — whether a dynamic route template had a static fallback (undefined for concrete prerenders)htmlSize — byte size of the prerendered .html shell (0 for an empty shell, undefined when there's no .html)isDynamicRoute — whether the entry came from a dynamic route template rather than a concrete prerendervercel connect create --data now accepts @<path> to read the JSON from a file and @- to read it from stdin, so non-managed connector credentials (e.g. client secrets) no longer have to be passed inline where they leak into shell history and process listings. Inline --data still works but now warns when it looks like it contains a secret.vercel connect command output (attach, detach, remove, revoke-tokens, and the list table's type/projects cells), not just the list UID/name cells. Prevents terminal escape injection from maliciously-named connectors visible across a team.vc api --spec-url <url> for loading endpoints from a custom OpenAPI spec instead of the default public Vercel spec. Custom specs are fetched fresh, can use the current CLI token to pass Vercel deployment protection via the SSO handshake, and replace the public spec entirely for listing, interactive selection, and tag/operation resolution.@vercel/backends performance regression. Passing stat/readlink/readFile overrides to nodeFileTrace replaces @vercel/nft's internal CachedFileSystem, so repeated (mostly missing) path probes during module resolution became uncached syscalls that throw on every miss. The stat/readlink overrides are now only applied when there are in-memory rolldown output files to serve, and all fs overrides are memoized (including negative results) to restore nft's caching..node) and other binary files during file tracing. Traced files were read as UTF-8 strings, which mangled non-text bytes and caused runtime errors such as ELF file's phentsize not the expected size (e.g. with argon2 on pnpm). Binary files are now preserved byte-for-byte.Transfer-Encoding: chunked WSGI request bodies that arrive without a Content-Length, and strip the hop-by-hop framing header from the WSGI environ (PEP 3333).index.html when no index SSR function is emitted..pyc files with unchecked-hash invalidation.python/vercel-runtime and python/vercel-workers source as the install target during monorepo vercel build runs (mirroring the existing dev-server behavior). This prevents CLI unit tests from depending on a PyPI release of a version that has not been published yet — the case that breaks Version Packages PRs that bump these packages.0c4ea01: Refactor: extract the standalone-server IPC proxy into a shared @vercel-internals/ipc-proxy package.
The proxy is now compiled once into prebuilt static binaries (shipped per-architecture) and reused by compiled runtimes, instead of being compiled at deploy time. No change to deployed behavior.
ws an optional peer dependencydeleteTokenCacheEntry(connector, params) export that drops a single in-process token cache entry, and wire it into the Eve connect() adapter as an evict() hook. When Eve rejects a resolved bearer (a downstream 401 mapped to requireAuth(), or an MCP server rejecting the token) it now cascades invalidation from its own per-step cache down into the Connect adapter's cache, so the next getToken performs a genuine refresh instead of re-serving the revoked-but-unexpired token. The evict() hook also accepts an opt-in revoke: true to tear the grant down at Vercel Connect (refresh token included) for user-initiated disconnects; revocation is best-effort and falls back to a local cache drop on failure.vc dev for experimentalServicesV2.EUNSUPPORTEDPROTOCOL inside pnpm/yarn workspacesdestination object ({ type: "service", service, path }) on routes and rewrites, so a route/rewrite can delegate into a named service. The service handoff is terminal: continue: true together with a service destination is rejected during normalization.8d8e871: Evaluate the maxDuration upper bound at validation time so VERCEL_CLI_SKIP_MAX_DURATION_LIMIT works regardless of import order.
The gate was read when @vercel/build-utils' functionsSchema was constructed and when the CLI compiled its vercel.json validator — both at module load. Any process that imports these modules before setting the env var baked in the default 900-second maximum and ignored the flag, failing with Invalid vercel.json - functions[...].maxDuration should be <= 900.
@vercel/build-utils now exposes getFunctionsSchema(), which reads the limit at call time (the existing functionsSchema const is kept but deprecated). The CLI builds and compiles its config validator lazily, caching one validator per resolved limit, so setting the variable after import takes effect. Default behavior is unchanged — the 900s maximum, the lower bound, and the integer check are all still enforced when the variable is unset.
Updated dependencies [8d8e871]
validate flag to the Eve connect() adapter (backed by a new forceRefresh option on getToken/getTokenResponse). When set, each getToken bypasses the in-process token cache and re-checks Vercel Connect, so a grant the user revoked server-side surfaces as an authorization-required prompt instead of being served as a stale, still-cached bearer.strip, which removes the exported napi_* symbols that native
addons (@napi-rs/keyring) bind against at dlopen time. The runtime is now stripped with
strip -SXx, which keeps exported symbols. Also makes the @vercel/vc-native bin shim launch
the platform binary directly when the postinstall script did not run (pnpm blocks dependency
build scripts by default), instead of always failing.vercel upgrade crashing with ENOENT: no such file or directory, realpath '…/.pkg-staging/pkg.js'
in the native binary. The command tried to realpath process.argv[1], which points into the binary's
virtual filesystem snapshot. Native installs now detect the package manager (npm, pnpm, or yarn) from
the binary's real install location and suggest the matching global upgrade command.experimental_upgradeWebSocket() APIConnectTokenParams.scopes support for ["*"] default scopes.revokeToken API for revoking Connect tokens by connector and subject.sandbox CLI to 3.1.2 (@vercel/sandbox 2.1.1) to fix vc sandbox commands crashing with a segmentation fault.
login, whoami, logout, and any
command that reads config) with ERR_MODULE_NOT_FOUND: '@vercel/cli-auth'. The package is now
staged into the binary. The binary release is also hardened with a real command smoke test and a
build-time check that every statically-imported dependency is bundled, so a binary missing a
required package can no longer be released.Fixed an issue where NFT was tracing only TypeScript sources and missing conditional exports from rolldown output chunks, causing CJS bundl…
Vercel · Vercel CLINode.js Serverless Functions can now opt into the Web API handler interface (Request → Response) by setting useWebApi: true in the static c…
Vercel · Vercel CLI