Sourced from vercel's releases.

vercel@56.2.0

Minor Changes

• 997d319: vercel env add now accepts a comma-separated list of environments to create a single Environment Variable entry spanning multiple targets, e.g. vercel env add API_URL production,preview,development. Invalid environment names fail locally with a clear error (invalid_environment in non-interactive mode), custom Environment slugs are resolved to ids, and a Git branch is rejected unless Preview is the only target. Non-interactive missing_environment, missing_requirements, and sensitivity-conflict payloads now suggest the multi-target command form.

Patch Changes

• e6b11f0: Add finer-grained vc.doBuild spans (vc.readConfigInputs, vc.prepareFlagsDefinitions, vc.getFiles, vc.populateFilesMap, and vc.setMonorepoDefaultSettings) so build-container traces can attribute previously unaccounted CLI orchestration time.

• 383c0a0: Fix native-trampoline test hardcoding 55.0.0 that broke after version bump to 56.1.0.

  The test now reads the version from packages/cli/package.json and strips NODE_PATH/VITEST env vars so require.resolve inside the temp install does not leak the repo's pnpm store. Also fixes VERCEL_VC_NATIVE leak on ENOENT/EACCES fallback (JS fallback was mislabeled as "(native)") and updates the stale Part-1 comment in src/vc.js.

• 351a9b6: Exclude vercel.ts config file variants from static file serving

vercel@56.1.0

Minor Changes

• fac79dc: Make the CLI bin native-aware: resolve and spawn a @vercel/vc-native-* binary when present, otherwise no-op into the existing JS CLI. Part 1 of 2; no optionalDependencies are wired yet, so this release is a no-op that confirms the JS path is unaffected. Part 2 wires the release flow to publish natives before vercel.

Patch Changes

• e01c1d2: Harden filesystem trust boundaries: vercel init no longer materializes symlink or hardlink entries from downloaded example archives (blocking tar link-following path traversal, CVE-2024-12905 / CVE-2025-48387, and upgrading tar-fs to 1.16.5), the deploy root-directory check now normalizes paths before the containment test so a sibling directory sharing the project's path prefix can no longer be selected, and ai-gateway coding-agents setup now flags in its plan when a target config path is a symlink so the approval prompt reflects the file the write actually lands on.

vercel@56.0.0

Major Changes

• 4998ec8: vercel routes export now uses --output (-o) instead of --format to select the output file format (json or ts, dotted forms like .ts also accepted). This frees --format to align with the standard output-format convention used by other commands. Update any scripts from routes export --format ts to routes export --output ts.

Minor Changes

• 5ae15fa: Add vercel ai-gateway coding-agents setup to connect Claude Code to the AI Gateway from an existing API key (--key): it sets the gateway base URL and authentication in ~/.claude/settings.json (honoring CLAUDE_CONFIG_DIR), never pins a default model, is idempotent, masks the key in output, skips unparseable configs instead of clobbering them, edits existing config files in place so your own keys and formatting are untouched, and emits a structured JSON result in non-interactive mode.
• 24c2b3c: Automatically install a marketplace product's declared agent skills after vercel integration add provisions it, replacing the interactive confirmation prompt. The transcript ends with an install summary linking to the product's marketplace page, and failed installs fall back to printing the manual npx skills add command.
• 607f0ef: Add service information to deploy-manifest.
• 8642a47: Remove the vercel oauth-apps sub-command, reverting the OAuth / connected apps parity scope.
• 57e2091: vercel env pull now keeps variables that only exist in the local env file instead of deleting them. Kept variables are listed in the command output. CLI-managed variables (VERCEL_OIDC_TOKEN and analytics IDs) are still removed when they no longer exist upstream.

Patch Changes

• 2a403e2: Add Codex support to vercel ai-gateway coding-agents setup. It writes a vercel model provider to ~/.codex/config.toml (OpenAI-compatible base URL, responses wire API) without pinning a default model, and exports the gateway API key via your shell rc (honoring CODEX_HOME and fish/ZDOTDIR). Merging into an existing config.toml edits assignments in place, preserving your comments and formatting.

• 683f013: ai-gateway coding-agents setup can now provision a key for you: run it without --key and it creates an AI Gateway API key (prompting for the owning team and a name, or using --name/--scope and the current scope with --yes), then writes that key into the agent configs.

  Re-running when everything is already set up is no longer a dead end: it prompts to rotate the key or switch team, and --reconfigure does the same non-interactively (useful for a rotated or expired key, or a different org). A plain re-run stays a no-op.

... (truncated)

Sourced from vercel's changelog.

56.2.0

Minor Changes

• 997d319: vercel env add now accepts a comma-separated list of environments to create a single Environment Variable entry spanning multiple targets, e.g. vercel env add API_URL production,preview,development. Invalid environment names fail locally with a clear error (invalid_environment in non-interactive mode), custom Environment slugs are resolved to ids, and a Git branch is rejected unless Preview is the only target. Non-interactive missing_environment, missing_requirements, and sensitivity-conflict payloads now suggest the multi-target command form.

Patch Changes

• e6b11f0: Add finer-grained vc.doBuild spans (vc.readConfigInputs, vc.prepareFlagsDefinitions, vc.getFiles, vc.populateFilesMap, and vc.setMonorepoDefaultSettings) so build-container traces can attribute previously unaccounted CLI orchestration time.

• 383c0a0: Fix native-trampoline test hardcoding 55.0.0 that broke after version bump to 56.1.0.

  The test now reads the version from packages/cli/package.json and strips NODE_PATH/VITEST env vars so require.resolve inside the temp install does not leak the repo's pnpm store. Also fixes VERCEL_VC_NATIVE leak on ENOENT/EACCES fallback (JS fallback was mislabeled as "(native)") and updates the stale Part-1 comment in src/vc.js.

• 351a9b6: Exclude vercel.ts config file variants from static file serving

56.1.0

Minor Changes

• fac79dc: Make the CLI bin native-aware: resolve and spawn a @vercel/vc-native-* binary when present, otherwise no-op into the existing JS CLI. Part 1 of 2; no optionalDependencies are wired yet, so this release is a no-op that confirms the JS path is unaffected. Part 2 wires the release flow to publish natives before vercel.

Patch Changes

• e01c1d2: Harden filesystem trust boundaries: vercel init no longer materializes symlink or hardlink entries from downloaded example archives (blocking tar link-following path traversal, CVE-2024-12905 / CVE-2025-48387, and upgrading tar-fs to 1.16.5), the deploy root-directory check now normalizes paths before the containment test so a sibling directory sharing the project's path prefix can no longer be selected, and ai-gateway coding-agents setup now flags in its plan when a target config path is a symlink so the approval prompt reflects the file the write actually lands on.

56.0.0

Major Changes

• 4998ec8: vercel routes export now uses --output (-o) instead of --format to select the output file format (json or ts, dotted forms like .ts also accepted). This frees --format to align with the standard output-format convention used by other commands. Update any scripts from routes export --format ts to routes export --output ts.

Minor Changes

• 5ae15fa: Add vercel ai-gateway coding-agents setup to connect Claude Code to the AI Gateway from an existing API key (--key): it sets the gateway base URL and authentication in ~/.claude/settings.json (honoring CLAUDE_CONFIG_DIR), never pins a default model, is idempotent, masks the key in output, skips unparseable configs instead of clobbering them, edits existing config files in place so your own keys and formatting are untouched, and emits a structured JSON result in non-interactive mode.
• 24c2b3c: Automatically install a marketplace product's declared agent skills after vercel integration add provisions it, replacing the interactive confirmation prompt. The transcript ends with an install summary linking to the product's marketplace page, and failed installs fall back to printing the manual npx skills add command.
• 607f0ef: Add service information to deploy-manifest.
• 8642a47: Remove the vercel oauth-apps sub-command, reverting the OAuth / connected apps parity scope.
• 57e2091: vercel env pull now keeps variables that only exist in the local env file instead of deleting them. Kept variables are listed in the command output. CLI-managed variables (VERCEL_OIDC_TOKEN and analytics IDs) are still removed when they no longer exist upstream.

Patch Changes

• 2a403e2: Add Codex support to vercel ai-gateway coding-agents setup. It writes a vercel model provider to ~/.codex/config.toml (OpenAI-compatible base URL, responses wire API) without pinning a default model, and exports the gateway API key via your shell rc (honoring CODEX_HOME and fish/ZDOTDIR). Merging into an existing config.toml edits assignments in place, preserving your comments and formatting.

... (truncated)

• 72de62c Version Packages (#17091)
• e6b11f0 feat(cli): add finer-grained vc.doBuild spans (#17079)
• 351a9b6 fix(cli): exclude vercel.ts config variants from static serving (#16985)
• 4173d75 [cli] skip coding agents setup tests on macOS (#17096)
• 997d319 [CLI] Adding more agentic friendliness for vc env commands (#17061)
• 383c0a0 fix(cli): make native-trampoline test version-agnostic, fix VERCEL_VC_NATIVE ...
• ad5ac9a fix(ci): install Go toolchain for packages depending on ipc-proxy and harden ...
• f3efd0e Version Packages (#17078)
• fac79dc feat(cli): native trampoline with JS fallback, drop postinstall (#17011)
• e01c1d2 [cli] Harden filesystem trust boundaries (#17064)
• Additional commits viewable in compare view

This version was pushed to npm by GitHub Actions, a new releaser for vercel since your current version.