chore: bump vercel from 50.44.0 to 52.2.0#369
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [vercel](https://github.com/vercel/vercel/tree/HEAD/packages/cli) from 50.44.0 to 52.2.0. - [Release notes](https://github.com/vercel/vercel/releases) - [Changelog](https://github.com/vercel/vercel/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/vercel/vercel/commits/vercel@52.2.0/packages/cli) --- updated-dependencies: - dependency-name: vercel dependency-version: 52.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Contributor
|
Deploy preview for team-scope-test ready!
Deployed with vercel-action |
Contributor
|
Deploy preview for zeit-now-deployment-action-example-angular ready!
Deployed with vercel-action |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 2 files
Architecture diagram
sequenceDiagram
participant CLI as Vercel CLI
participant Auth as @vercel/cli-auth
participant Keychain as OS Keychain
participant FileStore as File System (Token File)
participant API as Vercel API
participant Static as Static Deployment
participant Env as Env Command
Note over CLI,Env: Major changes from 50.44.0 → 52.2.0
CLI->>Auth: authenticate(tokenSource)
alt Keyring available (NEW)
Auth->>Keychain: store/read auth token
Keychain-->>Auth: token value
else Keyring unavailable
Auth->>FileStore: read/write token file (fallback)
FileStore-->>Auth: token value
end
Auth-->>CLI: authenticated session
CLI->>API: deploy (static files)
alt Configuration files detected (CHANGED - breaking)
API->>Static: exclude config files from upload
Note over API,Static: vercel.json, now.json no longer deployed
else Normal files
API->>Static: deploy as before
end
CLI->>API: vercel env update (CHANGED)
opt Sensitive env var targeting Development
API->>Env: block update (policy check)
Env-->>CLI: error with docs link
end
CLI->>API: non-interactive re-auth (CHANGED)
alt CLI in CI or --token mode
CLI->>CLI: detect non-interactive stdin
CLI->>API: check scope authorization
alt Missing scope
CLI->>CLI: fail fast with actionable message
Note over CLI: No browser code flow attempted
else Valid scope
API-->>CLI: re-authenticate
end
end
CLI->>API: vercel edge-config tokens --remove (CHANGED)
alt Input is token ID
CLI->>API: DELETE /v1/edge-config/:id/tokens (ids)
else Input is plaintext token
CLI->>API: DELETE /v1/edge-config/:id/tokens (tokens)
end
CLI->>CLI: next.command suggestion (CHANGED)
CLI->>CLI: strip --token/-t flags from suggested command
Note over CLI: Prevents token leak in non-interactive reruns
Requires human review: Production dependency major version bump (50 52) with breaking changes (config file exclusion, auth token storage). High risk of impact on CI/deployment logic. Requires human review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vercel from 50.44.0 to 52.2.0.
Release notes
Sourced from vercel's releases.
... (truncated)
Changelog
Sourced from vercel's changelog.
... (truncated)
Commits
02c78f5Version Packages (#16151)68edb7aVersion Packages (#16138)24686d0auth: Make it possible to store CLI credentials in OS keychain (#16083)8d6cfdetest(cli): fix windows and non-interactive token unit test regressions (#16134)0252860fix(cli): prevent token leaks in non-interactive next commands (#16113)ae90f00feat(cli):edge-config tokens --removeaccepts ids or plaintext tokens (#16...4eec0e5Version Packages (#16068)34b7a27fix!: exclude configuration files from static deployments (#16056)5c9d1b5[CLI] adding vc env run in help flag (#16044)4d87b5bfix(cli): clean up test projects in env var E2E tests (#16055)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vercel since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Upgrade
vercelCLI from 50.44.0 to 52.2.0 to pick up safer auth handling and a breaking change that excludes configuration files from static deployments.public/) or adjust the build.VERCEL_TOKENhas the needed scopes; non-interactive re-auth now fails fast if scopes are missing.vercel env update --sensitivefor Development must be updated; sensitive vars are not allowed on Development.Written for commit ba21fbc. Summary will update on new commits.