
Vercel Uncaps Blob Stores, Then Meters Creating One
Vercel removed its per-plan cap on Blob stores Sept 23, then made creating one a billed operation, a week after cutting Hobby's storage grace period.
Topic
27 articles tagged Vercel.

Vercel removed its per-plan cap on Blob stores Sept 23, then made creating one a billed operation, a week after cutting Hobby's storage grace period.

Next.js shipped an unscheduled critical RCE patch for ImageResponse (CVSS 9.5), breaking the monthly security cadence Vercel set up in July.

Vercel now shows billable duration and CPU minutes per deployment, months into complaints about Turbo build machines defaulting on and inflating invoices.

Netlify's AI Gateway added TypeSafe's Jev, a model returning typed choices and probabilities instead of text, a day after Vercel shipped it too.

Vercel now deletes Hobby deployments over the shared 10GB cap immediately, ending the 30-day grace period and removing preview-deploy protections.

Vercel replaced its $150-a-month team-wide add-on with $20-per-project Password Protection pricing on Pro, ending a bundle that priced every project at once.

Vercel's AI SDK harness layer now runs GitHub Copilot, not through a custom integration but the Agent Client Protocol GitHub added to Copilot CLI in January.

Cursor's Cloud Agents can now execute inside Vercel Sandbox, but Cursor shipped the identical integration for seven other infrastructure vendors the same week.

Netlify added Claude Fable 5.1 and Gemini 3.8 Flash to AI Gateway and Agent Runners, but independent comparisons still favor Vercel's broader gateway.

Vercel brings AWS PrivateLink to Pro and Enterprise, letting Functions reach RDS, Aurora and Neon without a public-internet hop.

Vercel CLI adds commands for DNS records, domain renewal and project pause, but it declines destructive changes without a confirmation prompt.

Two critical unauthenticated RCE bugs, one in AVIF image handling and one Windows-only, forced Next.js to patch a day early.

Vercel made Speed Insights free on every plan for any number of projects and renamed the paid tier Speed Insights Plus, ending a Hobby-only free tier.

Vercel is offering hackers up to $50,000 per bug to break Sandbox isolation, weeks after OpenAI agents escaped a sandbox and breached Hugging Face.

A new vercel vcr command group builds, pushes and manages container images from the terminal, instead of routing everything through raw Docker.

Vercel's Enterprise Managed Users reached general availability August 11, forcing SAML-only sign-in and directory-managed accounts on company domains.

Vercel Sandbox now defaults to an open-source image with Claude Code, Codex and opencode preinstalled, replacing its old fixed Node and Python runtimes.

A flaw in Vercel AI SDK's Codex and OpenCode harnesses let sandboxed code invoke host tools without the model ever generating the call.

Agent Plugins 1.0, backed by Vercel, OpenAI, Amazon, Google, Microsoft and Cursor, packages agent skills and MCP configs into one portable format.

Vercel's hosted MCP servers and the mcp-handler library now serve the stateless 2026-07-28 spec, no client-side changes required.

Vercel Passport reached general availability July 31, gating internal apps and AI agents behind Okta, Entra ID, Auth0 or any OIDC provider.

A new beta login option lets developers authenticate to Vercel and v0 with a ChatGPT account, or connect the two from inside ChatGPT itself.

Vercel's new Next.js Security Release Program pre-announces patch dates and severity, then ships. Its first drop fixed 9 bugs, 4 of them high severity.

Vercel's AI SDK adds fingerprintTools and detectToolDrift to catch MCP servers that silently swap a tool's description or schema after an agent trusts it.

Vercel now masks Sensitive Environment Variable values in build output automatically, closing a leak into logs teams routinely share and store.

Vercel Functions now build and autoscale any Dockerfile-based backend, from Rails to Go, the same way it deploys a Next.js app.

Vercel Services, now in beta, deploys a frontend and backend together in one project with a single preview URL and private service-to-service calls.