Information disclosure in Flags SDK (CVE-2025-46332)Vercel discovered and patched an information disclosure vulnerability in the Flags SDK (CVE-2025-46332). Users should upgrade to flags@4.0.0.Dominik Ferber, Jack Wilson
Serve personalized content faster with Vary supportVercel now supports the HTTP Vary header, enabling faster delivery of personalized, cached content based on location and language. Improve site performance and reduce compute automatically with Edge Network caching.Luba Kravchenko, Joe Haddad
Create custom WAF rules directly from the Vercel Firewall tabVercel customers can now create custom WAF rules directly from the chart displayed on the Firewall tab of the Vercel dashboard.Casey Gowrie, Malavika Tadeusz
Optionally disable deployment_status webhook events for GitHub ActionsYou can now disable webhook events that Vercel sends to GitHub Actions that create many notifications on GitHub pull requests.Erika Rowland, Tom Knickman
Checks API support added for Marketplace integration providersVercel Marketplace now supports the Checks API, enabling providers to deliver automated post-deployment tests and surface results directly in the dashboard. Improve developer experience with seamless quality checks and actionable insights+2Fabio Benedetti, Dima Voytenko, and 2 others
Protection against React Router and Remix vulnerabilitiesSecurity researchers reviewing the Remix web framework have discovered two high-severity vulnerabilities in React Router. Vercel proactively deployed mitigation to the Vercel Firewall and Vercel customers are protected.Casey Gowrie, Ethan Shea
Improved experience for managing project domainsWe've significantly improved the Project Domains page to provide a faster, cleaner, and more intuitive management experience.Rhys Sullivan, Meg Bird
Pro customers can now deploy faster without build queuesOn-demand concurrent builds are now available for Pro and Enterprise teams with a new 5-minute slot size for greater flexibility.+4Mariano Cocirio, Ali Smesseim, and 4 others