fix(vercel): update vercel dependencies by ocavue · Pull Request #17450 · withastro/astro

ocavue · 2026-07-19T09:52:23Z

Changes

Updated all four @vercel/* dependencies to the latest versions.
For two of them with major version bumping, I've added a Changesets file with changelog links. I do not find any real breaking changes for users based on changelogs.

Testing

CI should pass.

Docs

Changesets file has added because we need to trigger a release to @astrojs/vercel.

github-actions · 2026-07-19T09:53:37Z

⚠️ Dependency Count

This PR adds 11 new dependencies (2175 → 2186), which exceeds the threshold of 10.

⚠️ New Duplicate Dependencies (found: 6, threshold: 1)

📦 Package	📋 Versions
zod	3 versions zod@3.25.76 zod@4.1.11 root@ @earendil-works/pi-ai@0.83.0 @anthropic-ai/sdk@0.91.1 zod@4.3.6
jose	2 versions jose@5.10.0 root@ @flue/runtime@2.0.3 @modelcontextprotocol/client@2.0.0 jose@6.2.3
execa	2 versions execa@5.1.1 execa@8.0.1
get-stream	3 versions get-stream@5.2.0 get-stream@6.0.1 get-stream@8.0.1
human-signals	2 versions human-signals@2.1.0 human-signals@5.0.0
npm-run-path	2 versions npm-run-path@4.0.1 npm-run-path@5.3.0

💡 To find out what depends on a specific package, run: pnpm -r why example-package

📊 Dependency Size Changes

Warning

This PR adds 5.1 MB of new dependencies, which exceeds the threshold of 100 kB.

📦 Package	📏 Size
zod@4.1.11	4 MB
jose@5.10.0	552.3 kB
@vercel/cli-exec@1.0.1	133.9 kB
@vercel/analytics@1.6.1 → @vercel/analytics@2.0.1	62 kB
execa@5.1.1	57.5 kB
@vercel/oidc@3.2.0 → @vercel/oidc@3.8.5	48.7 kB
xdg-app-paths@5.5.1	46.6 kB
human-signals@2.1.0	44.3 kB
xdg-portable@7.3.0	41.6 kB
@vercel/cli-config@0.2.4	35.7 kB
@vercel/functions@3.4.3 → @vercel/functions@3.9.5	33.4 kB
os-paths@4.4.0	32.1 kB
@vercel/nft@1.3.2 → @vercel/nft@1.11.0	15.8 kB
@vercel/routing-utils@5.3.3 → @vercel/routing-utils@6.5.0	13.8 kB
get-stream@6.0.1	12.2 kB
npm-run-path@4.0.1	8.1 kB

Total size change: 5.1 MB

⚠️ Package Trust Level Decreased

Caution

Decreased trust levels may indicate a higher risk of supply chain attacks. Please review these changes carefully.

📦 Package	🔒 Before	🔓 After
jose	trustedPublisher	provenance
@vercel/functions	provenance	none
@vercel/oidc	provenance	none
@vercel/routing-utils	provenance	none

changeset-bot · 2026-07-19T09:58:10Z

🦋 Changeset detected

Latest commit: c76eab3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 25 packages

Name	Type
@astrojs/vercel	Patch
@test/astro-vercel-basic	Patch
@test/astro-vercel-image	Patch
@test/astro-vercel-integration-assets	Patch
@test/vercel-isr-edge-no-middleware	Patch
@test/vercel-isr-with-edge-middleware	Patch
@test/vercel-isr	Patch
@test/vercel-max-duration	Patch
@test/vercel-edge-middleware-with-edge-file	Patch
@test/vercel-edge-middleware-without-edge-file	Patch
@test/astro-vercel-no-output	Patch
@test/astro-vercel-outdir-outside-root	Patch
@test/astro-vercel-prerendered-error-pages	Patch
@test/astro-vercel-redirects-serverless	Patch
@test/astro-vercel-redirects	Patch
@test/vercel-server-islands-static	Patch
@test/vercel-server-islands	Patch
@test/astro-vercel-serverless-prerender	Patch
@test/astro-vercel-serverless-with-dynamic-routes	Patch
@test/astro-vercel-static-assets	Patch
@test/vercel-static-headers	Patch
@test/astro-vercel-static	Patch
@test/vercel-streaming	Patch
@test/astro-vercel-with-web-analytics-enabled-output-as-static	Patch
vercel-hosted-astro-project	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copilot

Pull request overview

This PR updates the @astrojs/vercel integration’s Vercel-related dependencies to their latest versions, including major bumps for @vercel/analytics and @vercel/routing-utils, and adds a Changesets entry to trigger a patch release with relevant changelog links.

Changes:

Bumped @vercel/analytics from ^1.6.1 → ^2.0.1 and @vercel/routing-utils from ^5.3.3 → ^6.4.0.
Bumped @vercel/functions and @vercel/nft to newer non-major versions.
Updated pnpm-lock.yaml accordingly and added a Changesets file documenting the major dependency bumps.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
`pnpm-lock.yaml`	Updates the lockfile to reflect the new `@vercel/*` dependency graph and resolutions.
`packages/integrations/vercel/package.json`	Bumps the four `@vercel/*` dependencies used by `@astrojs/vercel`.
`.changeset/vercel-deps.md`	Adds a patch changeset referencing the major bumps and linking to upstream changelogs.

Files not reviewed (1)

pnpm-lock.yaml: Generated file

ematipico · 2026-07-21T05:42:30Z

There's a dependency with a decreased level of trust, what do we make it? I would prefer keeping dependencies locked instead of decreasing the security

ematipico

I have mixed feelings

ematipico · 2026-07-21T05:43:47Z

+  jose@5.10.0:
+    resolution: {integrity: sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg==}
+
  jose@6.2.3:
    resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==}


Really?? Two versions??

~~I will submit issue(s) to the Vercel team and ask why.~~

Update: Fable 5 gives me an analysis, and I think it's reasonable enough.

Why jose@5.10.0 is stuck at level 1 (provenance).

It was published 2025-02-17, five months before npm trusted publishing existed (GA 2025-07-31), so it physically cannot carry the trustedPublisher marker. panva switched jose's CI to trusted publishing on 2025-10-29 (first trusted release: 6.1.1), but the v5 line ended at 5.10.0, so its status is frozen unless panva back-publishes a 5.10.1.

Why jose@5 got installed.

The PR bumps @vercel/functions 3.4.3 → 3.7.5, which pins @vercel/oidc exactly (3.2.0 → 3.8.0; workspace:* becomes an exact pin at publish). @vercel/oidc@3.2.0 had zero dependencies; 3.6.1 added jose: ^5.9.6 (PR https://github.com/vercel/vercel/pull/16532, verifyVercelOidcToken). jose@6.2.3 stays because @modelcontextprotocol/sdk needs jose@^6, and two majors can't dedupe.

Why @vercel/oidc uses jose v5, the deepest root.

jose v6 is ESM-only and dropped Node 18; require() of it only works on Node >=20.19/22.12. But @vercel/oidc compiles to CJS (its dist literally does require("jose")) with engines: node >= 20, which includes 20.0-20.18 where that would crash, and the sibling vercel CLI still supports Node 18 and pins jose 5.9.6. v5 is the newest major their support matrix allows: a deliberate compatibility choice, not neglect.

That I know, I didn't need Fable 5 :P

It was sarcasm from my part. I still have mixed feelings

That I know, I didn't need Fable 5 :P

I also know why we have jose v5 added in the lock file (because Vercel requires it).

What Fable 5 tells me is why Vercel picked this out-of-date version.

(I can figure it out myself too, of course, but AI makes this workflow faster)

I still have mixed feelings

Well, Vercel wants their packages to continue supporting Node.js v18.0, hence the use of older dependencies. This makes perfect sense to me.

TypeScript v7, the latest major release just last month, still supports Node.js v16.20.

On the other hand, some of my own projects don't even support Node.js v22. Node.js v24 is required. :P

I personally think it's perfectly fine for different teams to have different dependency strategies.

github-actions Bot added the pkg: integration Related to any renderer integration (scope) label Jul 19, 2026

This was referenced Jul 19, 2026

fix(deps): update dependency @vercel/analytics to v2 #17437

Open

fix(deps): update dependency @vercel/routing-utils to v6 #17438

Closed

ocavue marked this pull request as ready for review July 19, 2026 10:22

ocavue force-pushed the ocavue/vercel-deps branch from de25661 to e8f52c7 Compare July 19, 2026 12:59

ocavue requested a review from Copilot July 19, 2026 13:49

Copilot started reviewing on behalf of ocavue July 19, 2026 13:50 View session

Copilot AI reviewed Jul 19, 2026

View reviewed changes

ematipico reviewed Jul 21, 2026

View reviewed changes

ematipico force-pushed the ocavue/vercel-deps branch from ff6d107 to c6280c9 Compare August 20, 2026 14:23

ematipico approved these changes Aug 20, 2026

View reviewed changes

ocavue mentioned this pull request Aug 26, 2026

ci: enable PR duplicate packages check #17829

Merged

fix(vercel): update vercel dependencies

dd5bd8c

ocavue force-pushed the ocavue/vercel-deps branch from c6280c9 to dd5bd8c Compare August 26, 2026 12:54

Merge remote-tracking branch 'origin/main' into ocavue/vercel-deps

c76eab3

Navigation Menu

Uh oh!

Uh oh!

fix(vercel): update vercel dependencies - #17450

fix(vercel): update vercel dependencies#17450
ocavue wants to merge 2 commits into
mainfrom
ocavue/vercel-deps

ocavue commented Jul 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 19, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

ematipico commented Jul 21, 2026

Uh oh!

ematipico left a comment

Uh oh!

ematipico Jul 21, 2026

Uh oh!

ocavue Jul 21, 2026 •

edited

Loading

Uh oh!

ocavue Jul 21, 2026 •

edited

Loading

Uh oh!

ematipico Jul 21, 2026

Uh oh!

ocavue Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

ocavue commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Testing

Docs

Uh oh!

github-actions Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Dependency Count

⚠️ New Duplicate Dependencies (found: 6, threshold: 1)

📊 Dependency Size Changes

⚠️ Package Trust Level Decreased

Uh oh!

changeset-bot Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

ematipico commented Jul 21, 2026

Uh oh!

ematipico left a comment

Choose a reason for hiding this comment

Uh oh!

ematipico Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

ocavue Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ocavue Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ematipico Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

ocavue Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ocavue commented Jul 19, 2026 •

edited

Loading

github-actions Bot commented Jul 19, 2026 •

edited

Loading

changeset-bot Bot commented Jul 19, 2026 •

edited

Loading

ocavue Jul 21, 2026 •

edited

Loading

ocavue Jul 21, 2026 •

edited

Loading