Update dependency vercel to v54#31
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
a53ac31 to
eb2a5ad
Compare
5e5df51 to
b735d0d
Compare
7d52501 to
f45ad8c
Compare
f45ad8c to
2dffa0c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^36.0.0→^54.0.0Release Notes
vercel/vercel (vercel)
v54.12.1Compare Source
Patch Changes
800286e:vercel connect create --datanow accepts@<path>to read the JSON from a file and@-to read it from stdin, so non-managed connector credentials (e.g. client secrets) no longer have to be passed inline where they leak into shell history and process listings. Inline--datastill works but now warns when it looks like it contains a secret.800286e: Strip ANSI escape sequences from team-controlled connector names, UIDs, and project names in allvercel connectcommand output (attach,detach,remove,revoke-tokens, and thelisttable's type/projects cells), not just thelistUID/name cells. Prevents terminal escape injection from maliciously-named connectors visible across a team.1e64d1f: Addedvc api --spec-url <url>for loading endpoints from a custom OpenAPI spec instead of the default public Vercel spec. Custom specs are fetched fresh, can use the current CLI token to pass Vercel deployment protection via the SSO handshake, and replace the public spec entirely for listing, interactive selection, and tag/operation resolution.52f005f]2d2aad9]01e18e8]v54.12.0Compare Source
Minor Changes
5757bca: [services] add support tovc devforexperimentalServicesV2.Patch Changes
663307f: Fix CLI self-upgrade failing withEUNSUPPORTEDPROTOCOLinside pnpm/yarn workspaces32a730e: Elevate maximum maxDuration to 1800s4637f0a]32a730e]c5d53d7]a5034c1]0c4ea01]v54.11.1Compare Source
Patch Changes
8d8e871: Evaluate themaxDurationupper bound at validation time soVERCEL_CLI_SKIP_MAX_DURATION_LIMITworks regardless of import order.The gate was read when
@vercel/build-utils'functionsSchemawas constructed and when the CLI compiled itsvercel.jsonvalidator — both at module load. Any process that imports these modules before setting the env var baked in the default 900-second maximum and ignored the flag, failing withInvalid vercel.json - functions[...].maxDuration should be <= 900.@vercel/build-utilsnow exposesgetFunctionsSchema(), which reads the limit at call time (the existingfunctionsSchemaconst is kept but deprecated). The CLI builds and compiles its config validator lazily, caching one validator per resolved limit, so setting the variable after import takes effect. Default behavior is unchanged — the 900s maximum, the lower bound, and the integer check are all still enforced when the variable is unset.Updated dependencies [
8d8e871]v54.11.0Compare Source
Minor Changes
fc7b557: Ensure project manifest includes framework for non-service builds.Patch Changes
bc8dc95: Fix the darwin-arm64 native CLI binary crashing with SIGSEGV on most commands. The custom Noderuntime was stripped with bare
strip, which removes the exportednapi_*symbols that nativeaddons (
@napi-rs/keyring) bind against at dlopen time. The runtime is now stripped withstrip -SXx, which keeps exported symbols. Also makes the@vercel/vc-nativebin shim launchthe platform binary directly when the postinstall script did not run (pnpm blocks dependency
build scripts by default), instead of always failing.
bc8dc95: Fixvercel upgradecrashing withENOENT: no such file or directory, realpath '…/.pkg-staging/pkg.js'in the native binary. The command tried to
realpathprocess.argv[1], which points into the binary'svirtual filesystem snapshot. Native installs now detect the package manager (npm, pnpm, or yarn) from
the binary's real install location and suggest the matching global upgrade command.
v54.10.3Compare Source
Patch Changes
4f82914: Bump the embeddedsandboxCLI to 3.1.2 (@vercel/sandbox2.1.1) to fixvc sandboxcommands crashing with a segmentation fault.v54.10.2Compare Source
Patch Changes
0f7844c: Fix the native CLI binary crashing on auth commands (login,whoami,logout, and anycommand that reads config) with
ERR_MODULE_NOT_FOUND: '@​vercel/cli-auth'. The package is nowstaged into the binary. The binary release is also hardened with a real command smoke test and a
build-time check that every statically-imported dependency is bundled, so a binary missing a
required package can no longer be released.
78e5d4f]v54.10.1Compare Source
Patch Changes
4e849dd]v54.10.0Compare Source
Minor Changes
0774460: Bump @vercel/prepare-flags-definitionsPatch Changes
f6a6e55: Only offer the Claude Code plugin in projects that have actually been used with Claude Code. Previously the prompt could appear in any directory as long as a~/.claudedirectory existed on disk. The CLI now checks whether the current project (walking up from the working directory) appears in Claude Code's per-project history before offering the plugin.a4f7dc9: CLI help and command-schema cleanups from the docs audit:blob: remove orphanaddStoreSubcommand,removeStoreSubcommand, andgetStoreSubcommandexports that duplicated the wiredcreate-store/delete-store/get-storespecs. Handlers and telemetry now import the actual wired subcommand definitions.dns list: the<domain>argument is now declaredrequired: falseto match the runtime, which already supports listing every domain's records when no argument is given.routes delete: declare the<name-or-id>argument asmultiple: trueso the help synopsis and schema match the variadic behavior already supported by the handler and shown in the existing examples.init: fix the "Initialize example project into specified directory" help example, which was missing theinitliteral (vercel <example> <dir>→vercel init <example> <dir>).promote statusandrollback status: declare--timeouton thestatussubcommand options so--helpmatches the examples (promote status --timeout 30s,rollback status --timeout 30s). The flag is also kept on the parent command, where parsing actually happens.33efa25: Added non-managed Connex connector creation with--dataand optional--connector-type.3a2d61e: Addvercel domains search <query>for client-side Domain Discovery with fast bulk availability and registrar pricing, renewal pricing,--availableand exact TLD filters, ordering, candidate windows of up to 200 domains, and JSON output.c5eeb30: Gate the client-side 900-secondmaxDurationupper bound behind theVERCEL_CLI_SKIP_MAX_DURATION_LIMITenvironment variable. The limit is now owned by a single helper in@vercel/build-utilsinstead of being hardcoded in multiple validators. When the variable is set to1, the client-side maximum is skipped and validation defers to the server. Default behavior is unchanged — the maximum, the lower bound, and the integer check are all still enforced when the variable is unset.9f9eed3: Nest Build Output API files forexperimentalServicesV2under.vercel/output/services/<name>.fb30b76: Strip ANSI escape sequences from connector UID and name cells inconnect listtable output.Updated dependencies [
c5eeb30]Updated dependencies [
09c39af]v54.9.1Compare Source
Patch Changes
f5ab607: [evals] Shrink eval result uploads and fix run discoveryThe eval ingest transform (
transform-agent-eval-to-canonical.js) now excludes raw transcripts (transcript-raw.jsonl) from the--upload-artifacts allpath, roughly halving each ingest payload. The parsedtranscript.jsonis still uploaded and still read forresolvedModelsmetadata.It also normalizes provider-prefixed model paths before upload. Models that resolve to
provider/model(e.g.openai/gpt-5.5-pro) write results one directory deeper, pushing the timestamp past theexperiment/model/timestampshape the ingest endpoint discovers runs from, which previously failed withCould not discover any experiment/model/timestamp runs. The model is now collapsed to a single segment (openai-gpt-5.5-pro) so discovery succeeds.2b31813: Fixvc build --standalonefailing to zip Lambdas when run from a monoreposubdirectory. When dependencies are hoisted to the monorepo root (e.g. pnpm's
node_modules/.pnpm/...), the recorded function file paths could escape thefunction root (
../../node_modules/...), which later caused zipping to failwith
invalid relative path: ../../node_modules/.... These paths are nowre-anchored inside the function so the standalone output is self-contained.
252c6eb: [cli] Showclaiminvercel integration resource --helpThe
claimsubcommand was missing fromresourceSubcommand.subcommands, sovercel integration resource --helponly listedconnect,disconnect,remove, andcreate-threshold. The legacyvercel integration-resource --helpand the dispatcher's runtime resolution both already includedclaim— this was purely a help/discoverability gap on the canonical nested path. AddsclaimSubcommandto the subcommand list and updates the parent description accordingly.0a170fd: [services] wireexperimentalServicesV2intofs-detectors.Updated dependencies [
aeb5bfa]Updated dependencies [
0a170fd]v54.9.0Compare Source
Minor Changes
fb4fb2d: Add support for claiming sandbox marketplace resources (Stripe, Shopify) from the CLI.integration listshows a newClaimcolumn,integration-resource claim <name>opens the provider claim URL in the browser and polls until completion, andintegration addoffers to claim sandbox resources after provisioning with new--claim/--no-claimflags.Patch Changes
338cc35: Add isPackageInstalled util for detecting dependencies during build.Fix Vercel Flags dependency detection for emitting datafiles during builds with OIDC tokens.
338cc35]v54.8.0Compare Source
Minor Changes
fddeb55: Add configurable credentials storage handling across the CLI auth stack. Storage of credentials can be configured by the newcredStoragekey in globalconfig.jsonor the newVERCEL_TOKEN_STORAGEenvironment variable. The environment variable takes precedence over the configuration key. Accepted values arefile(store credentials inauth.json),keyring(store credentials in system keyring, e.g macOS Keychain or Secrets Service on Linux), andauto(try storing in keyring if available, fall back tofileif keyring is not available).@vercel/oidcsupports keyring-stored authentication credentials by delegating the OIDC minting to the CLI executable via@vercel/cli-exec.Patch Changes
a869874: [connect] Rename user-facing "client" references to "connector"Updates the
vercel connectCLI commands to use the official "connector" terminology in all user-facing surfaces: help text argument names (remove/attach/detach), usage strings in error messages, and the--format=jsonoutput key (clients→connectors) forvercel connect list.200aa3b: [connect] Forward--scopesand--installation-idinto the authorize/install recovery URLWhen
vercel connect tokenhits an action-required error (user_authorization_requiredorclient_installation_required), the CLI builds an authorize/install URL for the user to complete consent in the browser. Previously this URL carried onlyteamIdandrequest_code, dropping the--scopesand--installation-idthe user supplied. As a result the consent flow fell back to provider defaults (e.g. Slack'susers.profile:read), and the post-authorization token retry mismatched the requested scopes. The CLI now forwardsscopes(comma-joined) andinstallationIdas query params, which the authorize and install endpoints already accept.3019788: [services] Remove theservicesfield fromvercel.jsonand theVERCEL_USE_SERVICESgate.fe893ec: [services] AddexperimentalServicesV2field tovercel.jsonimplementing the new schema for services.d22d812: [cli] Nestintegration-resourceunderintegration resourceand addintegration resource connectThe marketplace resource subcommands (
disconnect,remove,create-threshold) are now discoverable undervercel integration resource <sub>. The standalonevercel integration-resourceandvc irforms still work as hidden aliases — no scripts or tests break.Adds a new
vercel integration resource connect <resource> [project]command (the inverse ofdisconnect). Accepts--environment(repeatable, defaults to all three),--prefixfor env var namespacing,--yes, and--format=json. Defaults to the project linked in the current directory when<project>is omitted.Tightens
disconnectto error (exit 1) when the specified project is not connected to the resource, instead of exiting 0 with a "not found" message.Both commands emit a structured
outputAgentErrorpayload withreason: confirmation_requiredand anext: [{command}]retry hint when run in non-interactive / agent mode without--yes. Whenconnectfails because an env var with the same name already exists on the target project, the error names the conflicting variable and suggests--prefixorvercel env rmas remediation.Updated dependencies [
3019788]Updated dependencies [
fe893ec]Updated dependencies [
fddeb55]v54.7.1Compare Source
Patch Changes
1180675: Revert "[flags] fix dep detection for build embedding (#16242)"1180675]v54.7.0Compare Source
Minor Changes
0b4e1ef: Addvercel connect revoke-tokenssubcommand to revoke tokens issued from a connector.Patch Changes
ba6e7c6: Internal: fix_deployeval grader passing--token ""in the Docker sandbox whereVERCEL_TOKENisn't in process env. Only pass--tokenwhen set; CLI falls back toauth.jsonotherwise.92988c2: Handle sensitive Environment Variable pull challenges in the CLI.3986bb0: Stop retrying intentionally aborted requests so the CLI exits promptly after a deployment is ready.64f5484: Allow SAML re-authentication to use device-code flow in non-TTY sessions.97fdbbe: [flags] fix dep detection for build embedding2d918b8]v54.6.1Compare Source
Patch Changes
1444502: Support discoveringexperimentalServicesfrom Build Output API config duringvercel build.7ba4713: Reordervercel env addto ask whether a value is sensitive before collecting the value and selecting environments. Sensitive adds hide Development; teams with the sensitive env policy still prompt, and non-sensitive adds are limited to Development with clearer messaging.ab0e5aa]4f782b1]v54.6.0Compare Source
Minor Changes
af3e0bd: adding version node + cli version to top of every commandPatch Changes
6495585: [services] drop top-levelenvsupport for the newservice-refshape for services.6495585]v54.5.1Compare Source
Patch Changes
57ea4ba: Reduce duplicate user and team lookups during CLI scope resolution.b66bd3e: Fix prebuilt deployments failing with "invalid relative path" when using the--standaloneflag in pnpm monorepos by skipping external node_modules symlinks and copying traced files at their logical paths instead.9ad632d: Handle CLI update flows safely for native binary installs.b66bd3e]0e04bc5]eecd10d]v54.5.0Compare Source
Minor Changes
6860c32: Add project manifest to rust builder.2c17a12: Added--openand--viewflags tovercel traces get.--openopens the trace in the Vercel Dashboard instead of printing the markdown summary.--view <timeline|tree|gantt>selects the dashboard view and is only valid with--open.Patch Changes
620bcfa: Add--type,--service, and--searchfilter flags tovercel connect list.ff2a980: Add avercel domains checksubcommand for registrar availability and extendvercel domains priceto support bulk price lookups for multiple domains.1318682]6860c32]e917989]baac149]ecf5033]73dbbe6]647c1e8]b1f766a]v54.4.1Compare Source
Patch Changes
8fed091: Suppress metrics query status output when using--format=json.c8bce3b]v54.4.0Compare Source
Minor Changes
9d9532d: Wire builder entrypoint detection into service setup.Patch Changes
972cc84: Support workflow-triggered job services in queue infrastructureAdd
isWorkflowTriggeredService()andisQueueBackedService()helpers so workflow servicesare recognized by the queue broker, dev server, and build pipeline. Update Python runtime to
bootstrap workflow services as queue-backed workers.
Updated dependencies [
fa25cb7]Updated dependencies [
972cc84]v54.3.0Compare Source
Minor Changes
8fabeba:vercel curl --tracenow sends the_vercel_sessioncookie alongside the trace cookie, scopes the session API call via query parameters, sendshostnameinstead ofdeploymentId, and parses the request id from thex-vercel-idresponse header.f2c60d6: [vercel-flags] check flags pkgs for build embedding8ac2af6: Add--project <NAME_OR_ID>flag tobuild,deploy,pull, anddevfor non-interactive CI/CD and agent-driven use.When
--projectis provided, the CLI will:.vercel/repo.jsonlinked projects without prompting (matches by name or ID)nextarray of suggested follow-up commands.This is particularly important for agents (which run non-interactively by default): they can now target a specific project in monorepos and unlinked directories without relying on interactive setup prompts or the project picker.
The flag is also accepted on
vercel deploy init(excluded onvercel deploy continuebecause--idalready identifies the deployment).The new API-based resolution is opt-in via the explicit
--projectflag, so commands likevercel deployin an unlinked directory keep their existing behavior of falling back to interactive setup.a2e79a8: Addedvercel traces get <request-id>to fetch and render a trace summary for a request. Resolves project/team from the linked project, with--scopeand--projectflag fallbacks.Patch Changes
b0d4dba: Add OIDC auth support tovercel blobcommands and upgrade@vercel/blobto2.4.0. WhenVERCEL_OIDC_TOKENandBLOB_STORE_IDare set in the environment (or.env.local), or when--oidc-tokenand--store-idare passed together, the CLI uses them as the credential source. The--rw-tokenflag remains exclusive — when provided, it always wins and never falls back to OIDC. The OIDC token is now forwarded to the SDK via the nativeoidcTokenoption (added in@vercel/blob2.4.0) rather than by mutatingprocess.env.c6fa2d1: Revert non-interactive Marketplace terms acceptance forintegration accept-terms.This change requires human interactive confirmation for terms acceptance and removes
--yesfromintegration accept-termsguidance.a5b231a: Updatevercel env pullto add.env*to.gitignorefor default.env.localpulls.Updated dependencies [
e6dc048]Updated dependencies [
2cd64ea]Updated dependencies [
23eee91]Updated dependencies [
79d9508]v54.2.0Compare Source
Minor Changes
39850ef: Addvercel connect update <id>subcommand to change connector branding. Accepts--icon(PNG or JPEG path, uploaded to Vercel and sent as SHA-1),--background-color, and--accent-color(both#RRGGBB). Gated behind the existingFF_CONNEX_ENABLEDflag.63a66d4: Add--icon,--background-color, and--accent-colorflags tovercel connect create. The icon is uploaded to Vercel before the connector is created. When the API requires a browser registration step, branding is appended to the dashboard URL so the create form can prefill itself; the CLI also applies a follow-up PATCH after the browser flow as a safety net for the dashboard rollout. Gated behind the existingFF_CONNEX_ENABLEDflag.137e5d1: Allow builder V2 to expose startDevServer.b1aa926: [vc dev] handle process errors in dev serverPatch Changes
a3a1a5a: Added CLI eval support for comparable agent/model experiment runs and restored transcript artifact uploads via chunked result ingestion.18e9fd6: fix(cli): pointvc connect openand registration error URLs at the renamed/connectdashboard route4118600: Fix standalone CLI binary latest-version worker startup.80e8e06: Track Vercel plugin active-session markers in CLI telemetry.bb61428: Include framework slug in output/config.jsonf45e466: Add opt-in automatic CLI updates viavercel upgrade --enable-autoand prompt users to enable them after a successful manual upgrade.a3a1a5a: Add offline-friendly local modes for CLI eval discovery and dashboard fixture generation, and expand Vercel CLI eval coverage for project, list, inspect, logs, and pull commands.a3a1a5a: Relaxed the CLI env/add eval grader to accept equivalent JSON format syntax and shell-variable env names wConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.