Vercel CLI
Mon
Wed
Fri
AugSepOctNovDecJanFebMarAprMayJunJulAug
LessMore
Releases226Avg69/mo
Last Checked
23h ago
Latest
@vercel/python@6.54.1
Source
@vercel/vercel--protection-password to vercel project protection enable so deployment protection passwords can be set from the CLI when used with --password.maxConcurrency configuration into build outputs and keep every configured Next.js route in its own Lambda group, including routes with the same limit.vercel env add and vercel env update when VERCEL_ENV_VAR_CONFIG_SECRET_UI is set, and send visibility (config/secret) on create and update requests when not explicitly set via --visibility (omitted for public-prefixed keys that cannot use secret visibility). Development still disallows secrets.CI when asserting browser open, and read already-flushed stderr via getFullOutput.vercel teams members command.vercel team members to the native CLI binary.vercel flags update.
For example, use
vercel flags update checkout-flow --add-variant treatment="Treatment" to add
a variant, or
vercel flags update checkout-flow --remove-variant legacy --yes to remove
one.vercel ai-gateway budgets defaults (list/set/remove) to manage per-scope AI Gateway budget defaults (project and api-key), each with its own limit and refresh period0f04613: Add vercel vcr permissions subcommands for managing which teams can pull images from a VCR repository: vcr permissions <repository> ls lists teams with access (by team slug), add and rm grant or revoke access for one or more teams (comma-separated team ids or slugs), and clear removes access for every team.
17ee736: Replace the vercel-workers integration for Python queue subscribers and workflows with the new vercel-queue SDK:
[[tool.vercel.subscribers]] entrypoints are introspected at build time via vercel.queue.get_subscriptions() and served through generated vercel.queue.asgi_app() handler modules, with queue/v2beta triggers carrying the SDK-registered consumer groups and per-subscription tuning.vercel-celery/vercel-dramatiq integration package injected automatically (bundled variant unless vercel-queue is an explicit dependency), in builds and in vercel dev.[[tool.vercel.workflows]] entrypoints follow the SDK generation: projects on vercel >= 0.8.0 are served through vercel-queue like subscribers; older or undeterminable versions keep the legacy vercel-workers serving (worker env markers, injected pinned vercel-workers).vercel-workers directly keep the legacy integration wholesale: legacy subscriber schema, direct entrypoint serving, worker env markers.vercel dev serves queue sidecars through vercel.queue.asgi_app() for new-SDK projects, and its queue broker delivers with the SDK-registered consumer groups introspected at sidecar startup (matching production trigger behavior); legacy projects keep the vercel-workers bootstrap.config.hasWorkerServices; the Python builder makes all queue-serving decisions from project metadata.5fc4930: Rename the vc edge-config command to vc global-config, keeping edge-config working as an alias for backwards compatibility.
--deployment targets without linking the current directory, reuse existing protection bypass tokens without creating them on cross-project targets, and prevent --scope and --team from leaking into curl arguments.vercel buy addon customEnvironment <packs> to purchase per-project custom environment capacity via /v1/projects/custom-environments/settings instead of /v1/billing/buy. Supports --project for non-linked directories, accepts common name aliases, validates pack ranges client-side, and shows clearer errors for Hobby teams (upgrade_required), feature-flag blocks, and over-limit requests.vc upgrade --binary)--format in command help output while keeping --json available.vercel ai-gateway api-keys create with --expiration and --alert-thresholds flags for parity with the create endpoint.vercel ai-gateway api-keys list, inspect, and remove subcommands so API keys can be listed, inspected, and deleted from the CLI.vercel ai-gateway leaderboard models, exposing the AI Gateway models usage leaderboard from the CLI. Supports --modality, --metric, and --date, a pretty table in interactive terminals with JSON by default when piped, --format table|json|csv, and --out to write the payload to a file.vercel ai-gateway leaderboard labs, apps, and providers, completing CLI parity with the AI Gateway leaderboard export endpoint. labs mirrors the models time series (--modality/--metric/--date); apps and providers render the ranked top lists. All support --format table|json|csv and --out.--json the documented flag for commands that emit JSON while continuing to support --format json for backward compatibility.vercel vcr build and vercel vcr push to build and push container images to the Vercel Container Registry using your local engine (docker/podman/buildah). Both default the repository to the project name and the tag to latest, assemble the full registry reference for you, and forward any arguments after -- to the engine. vcr build --push builds and pushes in one step with zstd compression enabled by default (Docker via Buildx, Podman/Buildah on push), and standalone vcr push compresses with zstd on Podman and Buildah.f196f2e: Internal: add the AI Gateway leaderboard export client (util/ai-gateway/leaderboard.ts) and the shared CLI rendering engine (fetch, format resolution, table rendering, file output) used by the forthcoming ai-gateway leaderboard subcommands. No user-facing change yet.
5b6256c: Replace the Builder peerDependencies with a builders manifest in package.json, pinned to exact workspace versions at pack time and used for Builder version resolution. Builders remain in dependencies.
eef1ae9: Remove the advanced settings prompt when creating a project.
a75c3ff: Help agents discover vercel curl when verifying deployments protected by Deployment Protection.
f2adf27: Add a --base-url flag to vercel ai-gateway coding-agents setup to point Codex and Claude Code at a different AI Gateway base URL (e.g. a preview deployment). When set, the value is written verbatim into each agent's config, so you own correctness when mixing API styles in one run.
Codex and Claude Code now default to their gateway compatibility endpoints — https://ai-gateway.vercel.sh/codex/v1 and https://ai-gateway.vercel.sh/claude-code (Anthropic style, no /v1) — instead of the generic gateway URLs. Claude Code's settings also set CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 so it discovers the gateway's model catalog. OpenCode and Pi are unaffected — they use their native gateway providers.
d05a16a: Decouple first-deployment framework detection from VERCEL_FRAMEWORK_DETECTION. First-deployment detection (auto-detecting the framework for a project's first deployment when none is configured) is now driven solely by VERCEL_FIRST_DEPLOYMENT; VERCEL_FRAMEWORK_DETECTION continues to gate only the end-of-build framework cross-check.
Also adds a curl-based CLI e2e test (packages/cli/test/e2e-curl-deploy.test.ts) that uploads a zipped Node project to /v2/files, creates a deployment via /v13/deployments, waits for it to be READY, probes / for the expected response, and deletes the created project.
proxy.entrypoint, with optional path matching through proxy.matcher. The matcher may be configured in the entrypoint source or vercel.json, but not both.VERCEL_TOML_CONFIG_ENABLED feature flag. vercel.toml configuration file support is now always enabled.resolved attribute to the vc.importBuilders trace span recording each Builder's resolved version and source directoryvc alerts and vc alerts rules output for custom alerts, including readable inspect views, custom alert rule filtering, compact rule tables, and normalized alert timestamps.vercel deploy (without --prod) is assigned to production by the API. The notice explains that this is expected behavior for the first deployment and that future deployments will be preview deployments unless --prod is used. In non-interactive mode, the hint is included in the JSON payload and the "Promote to production" next command is omitted since the deployment is already production.@vercel/vc-native-* binary is only spawned when the user opts in via vercel upgrade --enable-binary (or the useNativeBinary global config flag); members of the vercel team are auto-opted-in when their teams are already loaded. Adds a zod-free @vercel/cli-config/paths subpath so the opt-in flag can be read on the CLI startup hot path without loading zod.NODE_PATH: require.resolve() consults NODE_PATH and the global folders even when paths is given, so the native package is now located with an explicit walk up this install's own node_modules treepprState in vc logs output, alongside the existing cache status and reason, so users can see how a PPR page was served (fully_static / partially_dynamic / fully_dynamic).vercel login no longer resets currentTeam to the default team when re-authenticating: the previous selection is kept when the authenticated user is still a member of that team, and only falls back to the default scope (with a warning) otherwise. vercel teams switch no longer hard-fails when the persisted team is stale (deleted or membership revoked), so it can always be used to switch away.vercel ai-gateway budgets set/list/remove commandsvercel dev, vercel pull, vercel env run, vercel build, vercel link, OIDC token refresh), not just vercel env pull. The device-code re-authentication flow now lives at the shared env-records layer, so any challenge_required response triggers it when running interactively.vercel comments — a project-aware inbox for Vercel Toolbar comments. List unresolved comments for the linked project (focused on the current Git branch), inspect full threads, reply, resolve/reopen (optionally with a closing reply via -m), and edit/delete messages. Supports --format json with a stable envelope for scripting and agents.vercel.json validation to improve CLI startup performance.peerDependencies and use the declared versions to pin dynamic Builder installs: bare specs install the version this CLI release was published with instead of latest, stale .vercel/builders copies are reinstalled, @vercel/build-utils is pinned to the CLI's own version, and post-install resolution failures now report a per-Builder reason instead of "Something went wrong!". Explicit Builder version pins are unchanged and always win. Builders remain in dependencies.url.parse() deprecation warnings in the native binaryvercel and @vercel/vc-native are both installed globally. The launcher no longer resolves a native binary when already running inside one (VERCEL_VC_NATIVE=1), and only resolves the native package from its own install tree, ignoring NODE_PATH.vc env pull step-up authentication. The step-up rotates the token pair server-side and revokes the previous refresh token, so keeping the old one caused subsequent step-ups to fail with Device authorization request failed and eventually forced a re-login.ed28e18: Add vercel flags evaluations for viewing compact, per-variant evaluation charts and bucket-level JSON data with truncation metadata.
Examples:
vercel flags evaluations my-feature
vercel flags evaluations my-feature --since 24h --granularity 1h
vercel flags evaluations my-feature --since 24h --json145eb34: Improve vercel ai-gateway coding-agents setup prompts: use the searchable team picker, keep the multiselect key legend visible after the first selection, and narrow the prompt lines by moving context off the question line.
The apply step now offers a coding-agent handoff: when the key is stored in the macOS Keychain it asks whether to write the files or "Copy a prompt for my agent" (which creates the key, stores it in the Keychain, and copies agent-ready setup instructions — with no plaintext key — to the clipboard); without the Keychain it stays a plain yes/no confirm. A new --apply <edit|prompt> flag drives this non-interactively — --apply prompt writes the prompt to stdout so it can be piped into an agent (… --apply prompt --yes | claude -p), and in machine mode it rides along as a prompt JSON field.
pyproject.toml entrypoint in vercel dev.d5751d6: Allow Env, Target, Flags rules, Routes, Redirects, Firewall, and Git commands to select a project explicitly with --project, including from an unlinked directory.
1d8e0ee: Extract project-link validation shared by routes, redirects, and firewall commands.
b0aa678: Consolidate suggested-command and subcommand-argument helpers while preserving explicit project context and required-argument validation.
c06b596: Fix vercel domains add sending the alias mutation under a stale ambient team scope. When run inside a directory linked to a project in another team, the command now resolves the local project link (like vercel domains ls) and scopes the domain/alias request to the linked team, so a same-name project in the ambient team can no longer be targeted by mistake.
a39869e: Fix vercel dev returning 404 for api/ functions using the rust, python, ruby, or go runtimes when the project has a framework dev command (e.g. Next.js). These runtimes are registered by backend framework presets, which caused the dev server to misclassify api/ functions as the frontend build and skip building them.
a55e7df: Replace user-facing experimentalServices references with services in error/warning messages and rename error codes (NO_EXPERIMENTAL_SERVICES_CONFIGURED → NO_SERVICES_CONFIGURED, MISSING_EXPERIMENTAL_SERVICES → MISSING_SERVICES). The deprecated v1 config key should no longer appear in guidance shown to users.
e4866e9: Skip the Rust target/ directory by default for Rust projects.
Rust projects produce a target/ directory of build artifacts that can be
hundreds of MB. It's rebuilt on Vercel during the deployment (and cached
server-side), so uploading it only slows deployments down. When a root
Cargo.toml is detected, target/ is now ignored by default during
vercel deploy and vercel dev. Users can opt back in with !/target in
their .vercelignore.
Also hardened the local file scanner used by vercel dev so that a directory
removed mid-scan (a common race with cargo build churning target/) is
skipped instead of crashing the process.
7ea6c7a: Preserve buildCommand and combine preDeployCommand when writing inferred services config to vercel.json in V2 format.
4cce813: Write [SENSITIVE] placeholder instead of an empty string when vercel env pull encounters sensitive environment variables whose values cannot be read, so an unset value is distinguishable from a redacted one
Updated dependencies [b0ed8e5]
Updated dependencies [c555d3a]
Updated dependencies [238543c]
Updated dependencies [f97e2e0]
ce094f1: Show a specific error message when purchasing v0 credits without a paid v0 plan, instead of the generic unexpected-error fallback.
3e0e6a8: Refactor linked project resolution to use named options.
877c1ba: Allow vercel env ls to target a project explicitly without linking the current directory.
81360cf: Use /v5/certs instead of legacy /v5/now/certs when listing custom certs for a domain.
a6af051: Add vercel flags versions <flag> and vercel flags versions diff <flag> --revision <number> to inspect feature flag version history and changes.
Examples:
vercel flags versions my-flag
vercel flags versions my-flag --environment production
vercel flags versions diff my-flag --revision 451c7c32: vercel logs --follow now resolves a deployment automatically instead of erroring. When no deployment is specified it follows, in order: the latest deployment on the current git branch (using the provider-agnostic branch filter, which also matches deployments from unrecognized git remotes), your latest deployment, then the latest production deployment. --environment production streams the latest production deployment directly, and --environment preview restricts resolution to preview deployments.
51c7c32: vercel logs now defaults to --expand output when stderr is not a TTY (agents, pipes, CI), printing every log message in full instead of truncating messages to a fixed-width table column.
def07fc: Migrate @vercel/client and @vercel/build-utils from node-fetch to native fetch. This removes the last url.parse() usage from the CLI bundle, which triggered a DEP0169 DeprecationWarning on Node 24 (visible in the standalone binary during vercel deploy).
BREAKING CHANGE (@vercel/client): the agent?: http.Agent option was replaced with dispatcher?: FetchDispatcher (an undici dispatcher, e.g. undici.ProxyAgent), since native fetch does not support Node.js HTTP agents. The CLI now threads its proxy-aware dispatcher through automatically, so HTTP_PROXY/HTTPS_PROXY behavior is unchanged for CLI users.
75342cb: Resolve an explicit scope before looking up a project for local builds.
b16a9a2: Standardize explicit project resolution across existing project-aware commands.
075dc0c: Respect explicit project and scope selection when resolving project context.
Updated dependencies [def07fc]
vercel env add now accepts a comma-separated list of environments to create a single Environment Variable entry spanning multiple targets, e.g. vercel env add API_URL production,preview,development. Invalid environment names fail locally with a clear error (invalid_environment in non-interactive mode), custom Environment slugs are resolved to ids, and a Git branch is rejected unless Preview is the only target. Non-interactive missing_environment, missing_requirements, and sensitivity-conflict payloads now suggest the multi-target command form.e6b11f0: Add finer-grained vc.doBuild spans (vc.readConfigInputs, vc.prepareFlagsDefinitions, vc.getFiles, vc.populateFilesMap, and vc.setMonorepoDefaultSettings) so build-container traces can attribute previously unaccounted CLI orchestration time.
383c0a0: Fix native-trampoline test hardcoding 55.0.0 that broke after version bump to 56.1.0.
The test now reads the version from packages/cli/package.json and strips NODE_PATH/VITEST env vars so require.resolve inside the temp install does not leak the repo's pnpm store. Also fixes VERCEL_VC_NATIVE leak on ENOENT/EACCES fallback (JS fallback was mislabeled as "(native)") and updates the stale Part-1 comment in src/vc.js.
351a9b6: Exclude vercel.ts config file variants from static file serving
@vercel/vc-native-*
binary when present, otherwise no-op into the existing JS CLI. Part 1 of 2;
no optionalDependencies are wired yet, so this release is a no-op that
confirms the JS path is unaffected. Part 2 wires the release flow to
publish natives before vercel.vercel init no longer materializes symlink or hardlink entries from downloaded example archives (blocking tar link-following path traversal, CVE-2024-12905 / CVE-2025-48387, and upgrading tar-fs to 1.16.5), the deploy root-directory check now normalizes paths before the containment test so a sibling directory sharing the project's path prefix can no longer be selected, and ai-gateway coding-agents setup now flags in its plan when a target config path is a symlink so the approval prompt reflects the file the write actually lands on.vercel routes export now uses --output (-o) instead of --format to select the output file format (json or ts, dotted forms like .ts also accepted). This frees --format to align with the standard output-format convention used by other commands. Update any scripts from routes export --format ts to routes export --output ts.vercel ai-gateway coding-agents setup to connect Claude Code to the AI Gateway from an existing API key (--key): it sets the gateway base URL and authentication in ~/.claude/settings.json (honoring CLAUDE_CONFIG_DIR), never pins a default model, is idempotent, masks the key in output, skips unparseable configs instead of clobbering them, edits existing config files in place so your own keys and formatting are untouched, and emits a structured JSON result in non-interactive mode.vercel integration add provisions it, replacing the interactive confirmation prompt. The transcript ends with an install summary linking to the product's marketplace page, and failed installs fall back to printing the manual npx skills add command.vercel oauth-apps sub-command, reverting the OAuth / connected apps parity scope.vercel env pull now keeps variables that only exist in the local env file instead of deleting them. Kept variables are listed in the command output. CLI-managed variables (VERCEL_OIDC_TOKEN and analytics IDs) are still removed when they no longer exist upstream.2a403e2: Add Codex support to vercel ai-gateway coding-agents setup. It writes a vercel model provider to ~/.codex/config.toml (OpenAI-compatible base URL, responses wire API) without pinning a default model, and exports the gateway API key via your shell rc (honoring CODEX_HOME and fish/ZDOTDIR). Merging into an existing config.toml edits assignments in place, preserving your comments and formatting.
683f013: ai-gateway coding-agents setup can now provision a key for you: run it without --key and it creates an AI Gateway API key (prompting for the owning team and a name, or using --name/--scope and the current scope with --yes), then writes that key into the agent configs.
Re-running when everything is already set up is no longer a dead end: it prompts to rotate the key or switch team, and --reconfigure does the same non-interactively (useful for a rotated or expired key, or a different org). A plain re-run stays a no-op.
e64b222: ai-gateway coding-agents setup now detects the Codex desktop app and asks for consent before configuring Codex, since the desktop app cannot use custom model providers and stops working when one is set (the Codex CLI keeps working). Non-interactive and --yes runs configure Codex only when it is explicitly requested with --agent/--all; JSON output gains a warnings array and a requires_consent skip reason, and a run refused for lack of consent exits 1 with a self-contained requires_consent error payload (structured warnings, skip entries, and a runnable next[] command). A declined agent's configuration is left untouched.
7190684: ai-gateway coding-agents setup now configures only the agents detected on the machine when run non-interactively without --agent/--all, exits with code 1 (without creating an API key) when no agent configuration can be written, and on Windows reports the environment variable to set instead of writing a shell file that is never loaded (unless --shell-rc is passed explicitly). Non-interactive re-runs with --key on an already-configured macOS Keychain setup now refresh the stored key instead of silently keeping the old one.
097395b: ai-gateway coding-agents setup can now put limits on a key it creates: a spend cap (--budget with --refresh-period / --include-byok) and an expiry (--expiration 7d|30d|60d|90d|1y|none). Interactively it asks whether to set each. The limits are sent only when creating a key; reusing one with --key is unaffected.
fcdf5cd: Store the coding-agents setup API key in the macOS login Keychain instead of writing it into plaintext config files. When available it's used automatically: env-based agents resolve the key from the shell at runtime (a managed shell-rc block runs security find-generic-password), so the secret never lands in a config file. Pass --no-keychain, or run off macOS, to embed the key directly; it also falls back to embedding if the Keychain write fails.
c66bae3: Add OpenCode support to vercel ai-gateway coding-agents setup. It supplies the gateway API key to OpenCode's native vercel provider in ~/.config/opencode/opencode.json (honoring XDG_CONFIG_HOME) without pinning a default model. With the macOS Keychain in use, the key is kept out of the config and resolved from AI_GATEWAY_API_KEY (exported from the shell rc) at runtime instead.
2ffbf59: Add Pi support to vercel ai-gateway coding-agents setup. It writes the gateway credential to Pi's native vercel-ai-gateway auth entry in ~/.pi/agent/auth.json (created 0600, honoring PI_CODING_AGENT_DIR) without pinning a default model.
bb16ec9: ai-gateway coding-agents setup now previews before it writes. --dry-run and the pre-apply summary show the planned per-file changes as a masked diff, the resolved key/quota/expiry, and the .bak backups it would create (suppressed with --no-backup), then ask for confirmation before applying. For non-standard setups, --agent-config <id>=<path> overrides an agent's config-file location and --shell-rc <path> the shell rc; interactively it offers a custom path when an agent isn't found at its default location.
35fba40: Attribute marketplace agent-skill auto-installs in the skills CLI's install telemetry by passing --metadata (origin, flow, integration and product slugs) to the npx skills add invocation. Older skills versions (< 1.5.16) ignore the flag and install unchanged.
fd8e544: Preserve an environment's serving mode when feature flag rules are added, updated, moved, or removed. When the environment is serving a fixed variant, the CLI identifies that variant and warns that rule changes will not affect flag evaluation until the environment uses targeting again.
Updated dependencies [607f0ef]
Updated dependencies [7bbfd48]
Updated dependencies [9637ae6]
Updated dependencies [f11c4c4]
vercel link (and other commands that set up a
link) no longer fall back to the globally selected team from vc switch or the
login default, and --yes no longer guesses a team. The team now resolves only
from --scope/--team, the scope property in vercel.json,
VERCEL_ORG_ID, or a single available team; otherwise the command fails with
action_required: missing_scope (JSON in non-interactive mode) before any
project discovery runs, before a new project is created, and before the
existing .vercel/project.json is deleted. This also removes the slow
all-teams project search from non-interactive vercel link runs.vercel deploy, vercel pull,
vercel dev, vercel git connect, and vercel link itself — now uses the
same flow: resolve the team first (explicit --scope/--team,
vercel.json scope, VERCEL_ORG_ID, a single available team, or the
searchable team picker), then offer project suggestions scoped to that team,
preferring projects linked to the local Git repository (which produce a
repo-style .vercel/repo.json link) over folder-name matches. The
cross-team project sweep and its SSO fallback prompt are removed entirely;
project discovery never queries teams other than the one that was resolved.
An explicit project name (--project, --name, or vercel.json name)
skips the suggestions and resolves directly within the team. An explicit
team signal now also skips the team prompt in every command, not just
vercel link.--yes no longer selects a team on its own. It answers confirmations, not
data questions: when the account has multiple teams and no explicit signal
(--scope/--team, vercel.json scope, VERCEL_ORG_ID), an interactive
terminal now asks Which team? once and continues auto-confirmed, instead of
silently using the globally selected team from vc switch or the login
default. This also removes the all-teams project sweep from vercel link --yes; matches are resolved within the chosen team, and a single Git-linked
root-directory match still links automatically.vercel integration resource inspect <resource> (alias status) to show a marketplace resource's details and live status fetched fresh from the provider, rather than the cached status shown by vercel integration list. Supports --format=json.vercel link now honors VERCEL_ORG_ID and VERCEL_PROJECT_ID as an
explicit project-owner pair: when both are set, the command resolves and
confirms exactly that pair without prompting and without --yes, and leaves
local link files untouched. An unresolvable pair errors instead of falling
back to prompts. The new-project Name? prompt also suggests a creatable
default: when the folder name is already a project in the selected team, it
suggests <folder-name>-<short suffix> instead of a name that can only fail
"Project already exists" validation.vercel vcr login [engine] to authenticate docker, podman, or buildah with the Vercel Container Registry using an OIDC token.