2026-10-14
Amazon S3 available as an integration in the Vercel Marketplace
Vercel announced that Amazon S3 can now be created and connected from the Vercel Marketplace within a Vercel project dashboard. The integration adds connection details as environment variables, uses short-lived OIDC credentials instead of stored AWS keys, and is also available in v0.
2026-10-14
Next.js v16.4.1 released with security fixes for three advisories
Vercel released Next.js v16.4.1 on 2026-10-14 containing security fixes for two critical advisories (unauthenticated remote code execution in use cache functions returning typed arrays, and in the Image Optimization API when SVG files are used) and one high-severity advisory (denial of service in App Router using Server Actions).
2026-10-14
Next.js v15.5.28 released with security fixes for a critical RCE and a high-severity DoS
Vercel published Next.js v15.5.28 on its GitHub releases page on 2026-10-14. The release includes security fixes for a critical unauthenticated remote code execution issue in the Image Optimization API when SVG files are used, and a high-severity denial of service issue in the App Router involving Server Actions.
2026-09-30
Next.js 16.3.8 and 15.5.27 fix nine vulnerabilities, one critical
Next.js published 16.3.8 and 15.5.27 on September 30, 2026 as a scheduled security release covering nine vulnerabilities: one critical, two high, five medium and one low. The 15.5 line receives the backported fixes. The 16.3.7 release on September 29 was a bug fix only and does not include them.
2026-09-22
Next.js patches a critical remote code execution bug in next/og
Next.js shipped an out-of-band security update on September 22, 2026 in 16.3.6 and 15.5.26. It fixes a critical issue in the Node.js ImageResponse implementation in next/og, where improper escaping in SVG output generated by Satori could lead to remote code execution. Versions from 16.2.0 up to 16.3.5 are affected. The Edge ImageResponse is not affected, and 15.x only receives hardening.
2026-09-03
Next.js 16.3 adds experimental controls over how Turbopack chunks JavaScript
Vercel published the reasoning behind Turbopack's chunking on September 3, 2026, with new experimental options in Next.js 16.3. generateComponentChunks emits un-merged chunks beside merged ones so the runtime can fetch whichever is cheaper given what the browser holds. firstPageLoadPriority, priorityRoutes and clusters replace Turbopack's assumption that two thirds of sessions are one page. turbopackSharedRuntime also cuts a blocking request and about 10 KB per navigation.
2026-08-28
Vercel adds an agent builder to its dashboard
Vercel shipped in-dashboard agent creation on August 28, 2026. The builder scaffolds the agent's code, pushes it to a connected Git repository, and creates a Vercel project wired to AI Gateway models, a web chat or Slack front end, and MCP connections, so a deployed agent exists before any local setup.
2026-08-06
Agent Plugins 1.0.0 ships as a vendor-neutral standard
Agent Plugins 1.0.0 was published on August 6, 2026 — an open specification for packaging Agent Skills and MCP servers as portable plugins. A plugin is a directory with a plugin.json manifest and fixed locations for its components, so one package loads across any compatible client. Vercel initiated the proposal; AWS, Anysphere, GitHub, Microsoft, and OpenAI refined it collaboratively. It is supported at launch in ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code.
