Changelog

Next.js 15.5.18 and 16.2.6 patch 13 security advisories covering middleware bypass, denial of service, SSRF, cache poisoning, and cross-site scripting.

Vercel Flags now supports JSON types alongside boolean, string, and number values. Store structured configuration data directly in feature flags without additional database lookups.

Configure team member approval for private repository committers on Vercel. Choose automatic approval for instant access or manual approval for owner review.

You can now secure native integration resources by restricting where they can be used. Setting a resource to Production only removes non-production access and protects credentials as Sensitive environment variables

You can now query for observability data through the Vercel CLI using the vercel metrics command. This enables you to pull observability data programmatically.

Postgres connections now work through Sandbox firewall, which didn't work before due to early TLS termination

You can now access Grok 4.3 on Vercel's AI Gateway with no markup and no other provider accounts required.

Tags on Vercel Sandbox is now in open beta, add tags to a sandbox, update tags for an existing sandbox and filter by tags when listing sandboxes.