Vercel Feature Trails

Vercel's AI Gateway and AI SDK enable rapid iteration and deployment of AI-powered features. AI SDK 7 introduces production depth for agent work, including reasoning control, tool and runtime context, provider file and skill uploads, MCP Apps, and a terminal UI for development. For running agents, it adds tool approvals, durability with WorkflowAgent, timeouts, and sandbox support. It also supports integrating with various agent harnesses, provides enhanced observability through telemetry and tr. Agent Plugins 1.0.0 provides an open, vendor-neutral standard for packaging Agent Skills and MCP servers into distributable plugins, enabling compatibility across various AI agent clients.

v0 is expanding its offerings for teams with new Team and Enterprise plans. These plans include features like SSO, data training opt-outs for Enterprise, and enhanced collaboration tools such as custom instructions for v0 responses within Projects and the ability to add custom data sources (PDFs, TXT, code files) for tailored generations. This aims to help teams ship faster by leveraging v0 for technical support, code generation, debugging, migrations, writing tests, product planning, prototypin. The new v0 API provides programmatic, headless access to v0's app-building agent, allowing users to send prompts and receive generated apps, start dev servers in Vercel Sandbox, and obtain preview URLs. It supports streaming work, embedding apps, and integrating with existing codebases, design systems, and agent frameworks. The API also facilitates connecting to Vercel projects for deployment and offers migration paths from previous API versions.

Vercel provides comprehensive support for Next.js, continuously evolving its platform to integrate new framework versions and enhance performance. This includes optimizing for features like leaner prefetching, immutable static assets, faster routing at scale, and improved observability for Incremental Static Regeneration (ISR) and Partial Prerendering (PPR). The platform's build output API and CDN are adapted to leverage framework-specific optimizations, ensuring efficient deployment and runtime performance.

Vercel provides support for various Node.js runtimes, allowing developers to choose the version that best suits their application's needs and leverage the latest features and performance improvements. This includes enabling support for new Node.js versions for serverless functions and Next.js applications, with configuration managed via the `engines` field in `package.json`. Factory leverages Next.js API routes, middleware, and webhook handlers for its entire cloud backend, handling tens of millions of daily requests with a p95 response time of 350ms, utilizing Fluid Compute for warm functions and minimal cold start penalties. The platform also supports internal tooling deployment via Vercel's APIs and provides security through Vercel Observability and the Web Application Firewall.

Vercel Sandbox is used by Notion to run untrusted code for their Custom Agents, providing hard isolation via Firecracker microVMs, credential security through a firewall proxy, dynamic network policies, and filesystem snapshotting for fast cold starts. This enables Notion to offer a developer platform for third-party data syncing, custom automations, and AI agent tools. Performance optimizations have been applied to snapshot restore times, reducing p75 latency from over 40 seconds to under one s. This post details security considerations for building AI agents, focusing on prompt injection, data exfiltration, and designing for failure. It emphasizes scoping tools to user authority, treating model output as untrusted, sanitizing markdown, and avoiding secrets in prompts. It also references `harden-react-markdown` and `markdown-to-markdown-sanitizer` for output sanitization.

Vercel Agent now has a dedicated home in the dashboard, enabling it to investigate production issues, answer project-specific questions, and take approved actions. It acts as a first responder to production changes by autonomously investigating logs, metrics, and deployments to find root causes and propose fixes. The agent operates under its own identity and is read-only by default, with actions requiring explicit user approval. It can review pull requests for performance regressions and risky changes. This post details the integration of an AI-powered agent into Vercel's customer support workflow, reducing human-handled tickets by 31% through a comprehensive knowledge base and iterative rollout strategy. The agent handles a wide range of customer queries, transitions to human support when necessary, and provides valuable feedback for documentation and product improvements. The implementation involved A/B testing with Edge Middleware and a focus on customer experience and brand integrity.

Vercel's platform is used to analyze and understand the behavior of AI crawlers, including their scale, geographic distribution, JavaScript rendering capabilities, content type priorities, and crawling inefficiencies. This analysis helps site owners optimize their content for AI consumption and provides insights into the evolving web landscape. The Frontend Cloud provides a resilient foundation for global web applications, offering automatic scaling, high availability by default with regional fa. Speechify leverages Vercel's Data Cache, ISR, and Next.js Cache Components to serve over 500,000 dynamic pages to 60 million users, achieving a 50% cost reduction through Fluid Compute and maintaining 99.99% uptime with Instant Rollbacks.

Vercel supports running any HTTP server directly from a Dockerfile, enabling deployment of applications built with frameworks like Rails, Django, Spring Boot, and Go. This feature leverages Fluid compute for autoscaling and active CPU pricing, with optimized boot images for fast startup. Containers are treated as first-class citizens, integrating with the Vercel platform for builds, storage, deployment, and observability. This extends Vercel's capabilities to support a wider range of backend app. Ozone, a web-based video editing platform, migrated from Heroku to Vercel, experiencing a 5x increase in development speed and an 85% decrease in build times. This migration improved load times for their React and WebAssembly-heavy application, enabling faster iteration and independent feature deployment through Vercel's collaboration features. Ozone also integrated AI functionality, leveraging Vercel's AI Integrations and AI SDK for seamless API integration and deployment.

Vercel and Shopify are collaborating to rebuild Hydrogen from the ground up, making it open-source and runtime-agnostic. The new version will feature a three-layer strategy: core (centralized Shopify API bindings), client (reusable UI components like cart management), and server (integrating with modern frameworks like Next.js, Nuxt, and SvelteKit for full-stack capabilities). This aims to improve portability, reduce boilerplate code, and leverage existing framework features for performance and developer experience. This post highlights how KidSuper leveraged Next.js and Vercel to go headless from Shopify, enabling them to build fast, creative storefronts with a focus on developer experience and rapid iteration through preview deployments.

Vercel Services allows users to run multiple frameworks within a single Vercel Project, enabling atomic deployments, shared preview deployments, and internal service communication. This feature unifies frontend, backend, and other services into a cohesive application, managed through `vercel.json` configuration. It integrates with Vercel's existing platform primitives for compute, data, networking, and background jobs, including isolated compute for agents via Vercel Sandbox, WebSocket support for real-time features, and enhanced collaboration tools like Visual Editing with Sanity.

Vercel Flags is a platform-native feature flagging system that allows for server-side evaluation, automatic flag registration, and integration with frameworks like Next.js and SvelteKit. It enables progressive rollouts, kill switches, and A/B testing, with advanced patterns like precomputation for static pages and agent-native management via the Vercel CLI. The system is used internally by Vercel teams, including v0, for shipping new features, managing AI model routing, performing database migrations, and now, dynamic configuration management at the edge with sub-millisecond performance via Edge Config.

Vercel Connect introduces a new system for managing agent access to tools, data, and services. It replaces long-lived provider tokens with runtime credential exchange, using short-lived, scoped tokens obtained via OIDC identity. This system supports per-user token scoping, environment-based access containment, and revocation. It also enables event-driven agents through verified webhook forwarding from services like Slack, GitHub, and Linear, moving sensitive secrets server-side to Vercel Connect. This post details how to implement fine-grained authorization in Next.js applications using a Data Access Layer (DAL) with Okta FGA (built on OpenFGA) for relationship-based access control (ReBAC), complementing existing authentication and authorization mechanisms.

Vercel Workflows provides a programming model for building long-running, durable, reliable, and observable agents and backends. It eliminates the need for separate orchestration services by integrating coordination directly into application code. Key components include an event log for execution history, Fluid compute for step execution, and Vercel Queues for enqueueing next steps. The system supports TypeScript and Python SDKs, offering automatic retries, persistence, observability, and durable execution. The introduction of 'eve' extends this by providing an open-source agent framework built on Vercel Workflows, offering durable execution, sandboxed compute, human-in-the-loop approvals, subagents, evals, and a structured directory-based approach to agent definition. eve integrates with Vercel Connect for secure tool connections and leverages OpenTelemetry for tracing.

Vercel's platform demonstrated its ability to handle massive traffic surges during Black Friday and Cyber Monday 2024, processing over 86.7 billion requests with consistent performance. Key metrics include 1.9 million peak requests per second, 2.4 million deployments, 3 billion system-triggered Vercel Firewall blocks, and 519 million customer-specific Vercel Web Application Firewall blocks. The platform achieved 99.9992% uptime. During peak times, Vercel served 270K+ legitimate requests per second. KIKO Milano migrated to Vercel, eliminating 3 weeks of Black Friday infrastructure prep, achieving a 75% decrease in app build times, and increasing release frequency to multiple times per day. Their Next.js app leverages Vercel's infrastructure to scale static delivery, cached pages, and dynamic compute independently during traffic spikes.

Vercel's platform now supports stable HTTP response streaming for Edge Runtime and Node.js Serverless Functions, enabling incremental data delivery. This is achieved through a custom solution on AWS Lambda that bridges the response stream to the invocation service. Read.cv leverages Edge Functions to deliver personalized content from a location close to their users, decreasing latency and improving performance. Vercel OG Image Generation leverages Edge Functions and WebAssembly with a new core library (`@vercel/og`) to convert HTML/CSS into SVGs for dynamic social card images, offering a 5x improvement in P99 TTFB and 5.3x in P90 compared to the previous Chromium-based Serverless Function approach. This new system is lightweight, affordable, and fast, supporting basic CSS, framework-agnostic use, and font/emoji subsetting. It also includes Tailwind CSS support via the `tw` prop and automatically adds Cache-Control headers for edge caching. The system was tested at Next.js Conf, generating over 100,000 tickets on average in 800ms.

Turborepo is a high-performance build system for JavaScript and TypeScript monorepos. It optimizes builds through intelligent caching, parallel execution, and remote caching capabilities. Vercel acquired Turborepo to accelerate build speed and improve developer experience, making the CLI open source and integrating it with Vercel's infrastructure for task sharing. The acquisition aims to unlock the power of monorepos by abstracting complex configuration into a cohesive build system. This post details the strategy and technical challenges of porting Turborepo from Go to Rust, focusing on an incremental porting approach using CGO for inter-language communication and JSON serialization for argument passing. It highlights the implementation of global `turbo` and CLI argument parsing in Rust, and the resolution of platform-specific issues like Windows toolchain compatibility and path handling.

Vercel Edge Config provides a globally distributed, ultra-low latency data store for near-instant reads of configuration data. It is optimized for use cases like A/B testing, feature flags, dynamic redirects, and request blocking rules. Data is pushed to every Vercel region at write time, ensuring most lookups return in 5 ms or less, and 99% under 15 ms. Integrations with Statsig and HappyKit enable seamless A/B testing and feature flagging at the edge. The system supports an Edge Config SDK for dynamic routing and proxying. This post extends this capability by demonstrating how Vercel's CDN can be used to proxy external applications like Discourse, providing firewall protection, DDoS mitigation, and observability. It also details the use of microfrontends to integrate new Next.js features onto existing domains, enabling incremental modernization and feature layering.

Vercel offers direct integration with AWS databases (Aurora PostgreSQL, Amazon DynamoDB, Aurora DSQL) and MongoDB Atlas through the Vercel Marketplace and v0. This allows developers to provision, configure, and connect these databases to their Vercel projects with a streamlined developer experience, reducing manual setup for IAM, credentials, and console switching. The integration leverages AWS infrastructure for low-latency data access and supports both new and existing AWS accounts. Nuxt appli

Vercel is researching and contributing to advancements in Python's type system, aiming to make it more expressive and composable, similar to TypeScript's programmable types. This effort has resulted in PEP 827, which proposes standard type-level building blocks for introspecting and constructing types, benefiting both type checkers and runtime tooling. The goal is to align Python's static typing with its dynamic runtime capabilities, enabling frameworks like Pydantic to leverage these improvements.

Vercel has developed a library called `fast-webstreams` that reimplements WHATWG Streams APIs using Node.js streams internally. This significantly improves performance for common operations like piping between streams, chunk-by-chunk reading, and handling React Server Component byte streams. The library aims to reduce Promise and object allocation overhead, leading to substantial speedups in server-side rendering and data processing. This work is also being contributed upstream to Node.js. The N

Vercel has implemented content negotiation to serve agent-friendly markdown versions of pages, significantly reducing payload size and improving agent efficiency. This includes updating pages like the blog and changelog, and generating markdown sitemaps for agent discovery. The implementation in Next.js involves rewrite rules and route handlers to serve markdown content, and the use of `link rel="alternate"` tags for fallback discovery.

Vercel's platform enables customers to achieve significant site performance improvements through the adoption of modern frameworks like Next.js and content management systems like Sitecore. This includes achieving faster load times, improved Interaction to Next Paint (INP) scores, and outperforming a large percentage of global websites. The platform's architecture supports scalable deployments, efficient content management, and localization, empowering marketing teams to independently manage a g. This post details how to improve the accessibility of Next.js sites by increasing element target size, building with semantic HTML using ARIA patterns, providing descriptive alternative text for images, and implementing accessible input error messages using `role="alert"` and `aria-atomic="true"`.

Vercel has enhanced its security posture against React Server Components vulnerabilities like React2Shell. This includes significant updates to the Seawall WAF, incorporating over 20 unique bypass techniques discovered through a $1 million bug bounty program, and the implementation of a defense-in-depth strategy with a compute-layer runtime mitigation. This mitigation directly prevents code execution via the `constructor` property during React rendering, covering 96% of Vercel traffic. React Server Components are a foundational change in React 19, enabling improved initial page load times, code portability, and SEO by rendering components on the server. React 19 also introduces new directives like 'use client' and 'use server' to distinguish component execution environments, and Actions (including Server Actions) for simplified form handling and asynchronous operations. New hooks like `useActionState` and `useFormStatus` further enhance state management for form submissions and user feedback.

Vercel's Frontend Cloud provides a suite of tools for building and scaling web applications with managed infrastructure. It emphasizes an iterative workflow with per-PR preview deployments, quick UI changes, and decoupling deploys from releases using Edge Middleware for experimentation. It offers seamless API and database integrations, robust authentication, an API gateway with security features, and Secure Compute for private backend connections. The platform features a scalable serverless compute model that supports zero-configuration deployments for various frameworks and serverless functions, automatically optimizing frontend assets and deploying them to a global CDN, while enabling backend logic through serverless functions mapped by directory structure.

Vercel's security capabilities combine real-time DDoS mitigation, a powerful Web Application Firewall (WAF), and seamless SIEM integrations. The WAF automatically mitigated 87 billion attacks from 19 million unique IPs in Q4 2024. Enhancements include 40x faster DDoS protection through real-time stream processing, improved WAF responses with 403 Forbidden for persistent threats, and increased visibility through DDoS mitigation notifications and enhanced Firewall data in Monitoring. Enterprise customers can leverage custom firewall rules for IP blocking to restrict access to applications based on IP addresses, and Vercel Secure Compute provides private network connections for Serverless Functions and builds, with dedicated IP addresses and logical separation from other networks, enabling restricted access to authorized sources. This enhances security for sensitive data transmission and backend infrastructure connections.

Vercel Functions now support increased concurrency (up to 100,000), a unified Web Standard API signature (Request/Response), zero-config streaming responses, longer execution durations (up to 5 minutes on Pro, 15 on Enterprise), faster cold starts through runtime and framework optimizations, and automatic regional failover for Node.js runtimes. Logging limits have also been increased for better observability. This post highlights how Vercel's autoscaling and serverless capabilities enable platforms to handle dynamic workloads. Additionally, Vercel has introduced default helpers for serverless Node.js functions, providing direct access to request query parameters, cookies, and body, as well as methods for setting response status, sending JSON, and sending plain text or buffers, simplifying development and improving performance compared to frameworks like Express.js.

Vercel Drains (formerly Log Drains) now support exporting OpenTelemetry traces, Web Analytics events, and Speed Insights metrics in addition to logs. This provides a unified pipeline for streaming complete observability data to external systems like Datadog, Honeycomb, Grafana, and Elastic. Drains can be configured as custom HTTP endpoints or through turnkey integrations. Data is correlated across logs, traces, analytics, and performance metrics, enabling end-to-end observability. Available on Pro and Enterprise plans.

Vercel's platform demonstrated its ability to handle massive traffic surges during Black Friday and Cyber Monday 2025, processing over 115.8 billion requests with consistent performance. Key metrics include 518,027 peak requests per second, 6.1 million deployments, 24 million AI Gateway requests, 43.2 billion Fluid compute invocations, 56.9 billion cache hits, 1.8 billion ISR reads, 1.5 billion ISR writes, 7.5 billion firewall actions, 415 million bots blocked, and 2.4 billion humans verified. This post details Vercel's response to a critical npm supply chain attack, including identifying affected projects, purging build caches, and notifying customers. The attack involved compromised npm packages (`chalk`, `debug`, `ansi-styles`) containing wallet-drainer malware. Vercel's security and engineering teams acted rapidly to mitigate the impact by identifying and purging build caches for all affected projects, ensuring that Vercel customers were not impacted by the malicious code. The incident response timeline and technical details of the phishing campaign targeting npm maintainers are also provided, along with recommendations for customers to enhance their dependency management and security practices. Vercel also outlines ongoing prevention measures to strengthen its supply chain security posture.

Vercel partnered with Biome to stress test and strengthen their `noFloatingPromises` lint rule. Engineers devised creative test cases involving arrays of Promises, Promise-like objects, structural typing tricks, conditional type aliases, Proxy-based Promises, frozen Promise objects, Promise-returning object members, property getters, type remapping with getters, short-circuit operators, randomized expressions, and optional chaining fallbacks to identify subtle edge cases and ensure robust error handling in asynchronous code.

Vercel successfully performed a full production failover of its core control-plane database from Azure West US to East US 2 with zero customer impact. This exercise involved testing all control-plane traffic, including API requests, background jobs, and deployment/build operations. While preview and development traffic routing was affected, production CDN traffic, served by a separate globally-replicated DynamoDB architecture, remained isolated. The preparation involved addressing issues with proprietary Cosmos DB clients lacking failover awareness, patching delays in write region detection from five minutes to five milliseconds, and resolving partition-level inconsistencies during failover. The live exercise confirmed system resilience, with all services remaining operational and on-call teams managing events effectively. Lessons learned from this graceful failover and previous staging tests are informing the near-term roadmap for more aggressive offline region operations and edge cases in write traffic transition.

Vercel's Fluid Compute model addresses the serverless database connection leak problem by leveraging `waitUntil` to keep functions alive long enough to close idle connections before suspension. This ensures proper connection lifecycle management, similar to serverful environments, with minimal cost implications due to Active CPU Pricing. Best practices include configuring low connection idle timeouts, defining pools globally, avoiding a maximum pool size of 1, and utilizing rolling releases.

Vercel Blob provides durable, cost-efficient storage integrated with Vercel's application delivery network. It leverages Amazon S3 for reliability and offers Blob Data Transfer for cost-optimized delivery of high-volume assets, distinct from the latency-optimized Fast Data Transfer. Blob integrates deeply with Vercel's caching infrastructure, serving assets directly from the cache on hits and fetching from Blob storage on misses. It supports large uploads up to 5TB with multipart uploads, resumable uploads, and a web-standard API. Vercel KV is a serverless, Redis-compatible, durable key-value store powered by Upstash. Vercel Postgres is a serverless SQL database built for the frontend cloud, powered by Neon, offering seamless integration with frameworks like Next.js for server-first data mutations.

Vercel has addressed a critical vulnerability (CVE-2025-29927) in Next.js Middleware that allowed for bypasses. The vulnerability stemmed from an internal `x-middleware-subrequest` header used to prevent recursion, which could be manipulated. Patches have been released for Next.js 15.x, 14.x, 13.5.9, and 12.3.5. Vercel's own platform was incidentally invulnerable due to its decoupled routing system. Next steps include improving partner communication, streamlining security reporting, enhancing internal processes, formalizing an LTS policy, documenting internal headers, and further investigating Middleware security.

Vercel's build infrastructure has been significantly enhanced with the introduction of 'Hive', a new low-level untrusted and ephemeral compute platform. Hive is designed for secure, reliable, and performant builds, utilizing a multi-tenant architecture with KVM and Firecracker microVMs (cells). Optimizations include Docker image caching and block device snapshotting for rapid VM startup, reducing provisioning times from 90 seconds to 5 seconds for Secure Compute customers. Overall build performance has improved by an average of 30%. Secure Compute integrates with Hive via WireGuard tunnels managed by a Key Exchange Service, enabling secure connections to private networks and backends with ephemeral keys and frequent instance rotation.

Vercel's platform is used to analyze and understand the behavior of AI crawlers, including their scale, geographic distribution, JavaScript rendering capabilities, content type priorities, and crawling inefficiencies. This analysis helps site owners optimize their content for AI consumption and provides insights into the evolving web landscape. This post details research into Google's crawling and rendering of JavaScript-heavy sites, debunking common myths about its capabilities and providing empirical evidence on how Googlebot processes modern web applications, including those built with Next.js and React Server Components. The research involved analyzing over 100,000 Googlebot fetches and implementing custom Edge Middleware to track rendering success rates and content indexing.

Vercel is deeply invested in Svelte's success and continuously works to make its platform the best place to build and deploy Svelte apps. This includes close collaboration with Svelte maintainers, with several Svelte core team members working at Vercel. Vercel's platform supports SvelteKit and other frameworks through the Build Output API, enabling features like Incremental Static Regeneration (ISR), streaming serverless function responses, dynamic image optimization, and Skew Protection. This post details Rich Harris's vision for Svelte's future, including its edge-first approach and how Vercel's infrastructure will support its growth and adoption.

Vercel's platform enables customers to achieve significant site performance improvements through the adoption of modern frameworks like Next.js and content management systems like Sitecore. This includes achieving faster load times, improved Interaction to Next Paint (INP) scores, and outperforming a large percentage of global websites. The platform's architecture supports scalable deployments, efficient content management, and localization, empowering marketing teams to independently manage a greater portion of the customer journey. This post details how React 18's selective hydration with Suspense can significantly improve INP by making hydration non-blocking, allowing components to become interactive faster. A case study on nextjs.org showed a reduction in TBT from 430ms to 80ms and improved INP to 48ms. Other optimization techniques include using CSS for animations, throttling/debouncing events, reducing DOM size, optimizing SVG rendering, using web workers, and lazy loading assets.

The Vercel Toolbar has been enhanced with new developer tools for accessibility audits, Open Graph previews, and interaction timing (INP) measurement. It can now also be used in production environments via a Chrome extension, allowing team members to flag issues on live sites. These additions complement existing features like comments, CMS integration, layout shift analysis, and quick links, aiming to improve collaboration and user experience throughout the development workflow. Draft Mode has been integrated with the toolbar for seamless content editing.

Vercel offers a Web UI for managing DNS records, simplifying custom domain configuration. This includes presets for common record types like MX records and support for wildcard domains. The platform also enables programmatic assignment of custom domains, subdomains, and SSL certificates to users via the Vercel Domains API, facilitating multi-tenant applications. This is integrated with Vercel Postgres for data storage and leverages the Edge Network for performance. Dub leveraged the Vercel Domains API to efficiently manage custom domains, enabling them to provision new domains on behalf of their users via API calls and cost-effectively provide SSL certificates, contributing to their growth to 3,000 active domains and 5 million redirects per month.

Vercel's platform supports the creation and deployment of interactive 3D graphics experiences, leveraging technologies like React Three Fiber and physics engines for dynamic and engaging web content. This post details how to build an interactive WebGL experience using Next.js, focusing on prototyping with react-three-fiber and drei, and introducing a new Vercel-developed tool for optimizing 3D rendering performance in the browser.

Vercel's platform supports advanced deployment strategies like blue-green deployments by leveraging immutable deployments, serverless architecture, Skew Protection, Edge Config, and Middleware. This allows for safe, cost-efficient rollouts with minimal infrastructure overhead and granular control over traffic allocation and user experience. The platform also enables innovative strategies like multicolor and shadow rollouts. Skew Protection ensures that clients that loaded the form with the old field name talk to servers with the exact same version which respectively know how to handle that field name.

Vercel's platform supports advanced deployment strategies like blue-green deployments by leveraging immutable deployments, serverless architecture, Skew Protection, Edge Config, and Middleware. This allows for safe, cost-efficient rollouts with minimal infrastructure overhead and granular control over traffic allocation and user experience. The platform also enables innovative strategies like multicolor and shadow rollouts. Skew Protection ensures that clients that loaded the form with the old f. Deployment protection offers flexible ways to make Preview Deployments private and accessible with Vercel Authentication or Shareable Links. Advanced Deployment Protection provides header secrets for programmatic access (e.g., E2E testing), password protection, and the ability to protect Production Deployments.

Vercel provides guidance on achieving PCI compliance for e-commerce by leveraging iframes for secure payment processing. This approach isolates sensitive payment data from Vercel's environment, directly transmitting it to the payment processor. This significantly reduces the scope of PCI DSS compliance for customers and enhances overall security by ensuring Vercel never processes or stores cardholder data. The post outlines selecting a compliant payment provider and provides pseudo-code for embedding payment forms via iframes, emphasizing the use of the `sandbox` attribute for security.

Vercel's Developer Experience Platform now includes Conformance for automated static analysis to detect and prevent performance, security, and code quality issues early in the development lifecycle. Code Owners provides framework-defined ownership for smart reviewer assignments and escalation protocols. A reimagined dashboard offers a unified view of project health, Conformance scores, and team responsibilities, enabling better tracking of technical debt and proactive issue resolution. These features are integrated into Vercel Spaces for enhanced monorepo and code-first views, improving collaboration and onboarding. Vercel Runs provides a unified dashboard for visualizing builds from any tool (local, CI, deployments) for easier debugging and historical log analysis.

Vercel provides guidance on preventing CSRF attacks through anti-CSRF tokens, SameSite cookie attributes, Referer header checks, and the proper use of HTTP methods (GET for retrieval, POST for state changes). This ensures robust security for web applications by mitigating unauthorized actions performed on behalf of authenticated users. The SameSite attribute dictates when and how cookies are sent in cross-site requests, with options for Strict, Lax, and None, where None requires the Secure attribute.

Vercel's Next.js has introduced `optimizePackageImports` to automatically optimize package imports, addressing performance issues caused by barrel files. This feature analyzes package entry points to directly import modules, bypassing the overhead of barrel files. It offers significant improvements in local development speed, production build times, and faster cold starts in serverless environments. The system also handles recursive barrel files and is pre-configured for common libraries, with plans for further automation.

Vercel's platform provides comprehensive guidance and tooling for optimizing image formats on the web. This includes understanding compression algorithms (lossy vs. lossless), pixel density and resolution, bit depth, chroma subsampling (e.g., 4:4:4, 4:2:2), alpha channels for transparency, and metadata handling (including privacy concerns with EXIF data). The platform supports various image formats like JPEG, PNG, WebP, and AVIF, detailing their specific use cases and technical trade-offs. This post details the use of the `next/image` component to serve next-gen image formats like WebP, reducing image file sizes significantly and improving loading times through lazy loading and viewport intersection detection. The `<Image />` component also helps prevent layout shift.

Vercel's platform and tooling, including the next/font module, provide comprehensive solutions for optimizing web font loading and rendering. This includes leveraging `font-display` CSS properties, `size-adjust` and other font-face descriptors for layout shift prevention, and resource hints like `preconnect` and `preload` to reduce download times. The `next/font` module automates these optimizations by downloading fonts at build time, serving them locally, and automatically preloading them. This post details the transition from complex manual optimizations to the simplified and more performant `next/font` solution, which automatically handles self-hosting, subsetting, and layout shift prevention by calculating `size-adjust` on the server.

Vercel's Visual Editing feature, developed in partnership with headless CMS providers like Sanity, Builder.io, and TinaCMS, allows for direct click-to-edit content on preview deployments. This technology enables content editors to modify content directly on the Vercel preview interface, with changes synchronizing back to the headless CMS. It supports any web framework and aims to streamline collaboration between developers and content teams by eliminating the need to access the CMS dashboard for minor edits. TinaCMS integration specifically enables visual editing for Markdown, MDX, and JSON content stored in Git repositories, leveraging Vercel's preview deployments and Tina's data layer.

Vercel has developed an interactive virtual product tour to provide prospective users with a no-commitment experience of the Vercel platform. This tour breaks down complex product information into digestible, interactive slides, highlighting key features and backend functionalities. It offers personalized experiences for logged-in users and a mobile-friendly, social media-like card-based interface. Accessibility was a core consideration, with ARIA attributes and keyboard navigation implemented. Technically, the tour uses a `DemoContext` for state management, syncs slide progression with URL query parameters for deep linking, and dynamically positions and animates a tooltip to guide user attention. Animations are carefully timed using CSS transitions and event listeners to ensure a smooth and predictable user experience.

Vercel Web Analytics provides first-party, privacy-friendly tracking for page views, traffic analytics, and custom events. It uses a hash-based user identification method that discards data after 24 hours, eliminating the need for cookies and third-party scripts. The system is designed for minimal impact on page loading speed, being significantly smaller than Google Analytics. It integrates seamlessly with frameworks like Next.js, React, SvelteKit, Nuxt, and Remix via an `Analytics` component. This post announces the expansion of Vercel Analytics to Gatsby projects, automatically installing the `gatsby-plugin-vercel` during the build step to report Core Web Vitals.

Vercel Comments enables teams to streamline feedback loops on preview deployments, allowing stakeholders to comment directly on UI elements and interactions. This feature was used to gather community feedback for the Next.js 13 documentation, resulting in a higher quality output. The system supports public commenting and provides context for product owners, leading to faster iterations and improved issue resolution. It integrates with Slack for synchronized discussions and can be configured with

Vercel has launched a new, robust notification system for its platform, leveraging the capabilities of Knock. This system provides real-time, per-user in-app feeds, customizable multi-channel notifications (email, in-app), and batching for noisy events like domain misconfigurations. It allows for dynamic updates to notification preferences without redeploying infrastructure. The system is observable through the Knock dashboard, enabling debugging and performance evaluation. Key features include notifications for deployment failures and batched domain misconfiguration alerts.

Turbopack is a new high-performance bundler for React Server Components and TypeScript codebases, built on an incremental, cache-based architecture using Rust. It aims to significantly improve development server startup times and update speeds compared to existing bundlers like Webpack and Vite. It will eventually power both development and production builds for Next.js, with potential for shared team caches via Vercel Remote Caching and an incremental migration path for Webpack users.

Vercel introduced a feature to transfer projects between accounts and plans without downtime, preserving deployment settings and dependencies. This allows seamless upgrades from Hobby to Team plans and transfers between Teams, eliminating the need for redeployments.

Vercel has enhanced its project creation and Git integration capabilities. This includes enabling project-level Git connections, allowing multiple Git providers per Vercel account and per project, which is particularly beneficial for larger teams. The project creation flow has been updated to allow searching for existing repositories, reducing page loads and accelerating the time to deployment. The template library has also been integrated into the project creation flow, providing easier access. This integration extends to Bitbucket, enabling automatic deployments with built-in CI/CD, DNS, and TLS for every git push, with preview deployments for feature branches and instant rollbacks on the default branch.

This post introduces the initial configuration options for Functions, detailing how to set environment variables, manage timeouts, and configure memory allocation. It lays the groundwork for fine-tuning function execution environments. The dashboard now allows configuring different Environment Variables for Production, Preview, and Development. A new `vercel env pull` command in the Vercel CLI enables downloading Development Environment Variables into a local `.env` file. `vercel env add` and `v

Vercel introduced the ability to cancel ongoing deployments directly from the dashboard, preventing them from completing and unblocking queued deployments. For teams requiring higher throughput, the 'Concurrent Builds' setting was highlighted as a way to increase the number of simultaneous deployments. This post introduces the auto job cancellation feature for Vercel for GitHub, where the system will always build the latest commit immediately. If a new job is received while a build is in progress, the current job is canceled and the latest job is started. An opt-out is available via `vercel.json`.

Deploy Hooks allow triggering Vercel deployments via external events, enabling automated rebuilds and deployments based on CMS updates, cron jobs, or other system events. This feature includes debounced builds for reliability, straightforward revoking of hooks, and clear identification of hook-triggered deployments in the event timeline.

Vercel introduces `vercel dev` to provide a unified, single-command local development experience that emulates the production environment. This tool supports hot-reloading for frontend frameworks and serverless functions, simplifying the workflow for various languages and static site generators.

Vercel automatically issues and renews free wildcard SSL certificates for all deployed applications, leveraging Let's Encrypt's ACME protocol for both HTTP and DNS challenges. This eliminates manual SSL configuration for developers, ensuring all sites are HTTPS-enabled by default.