build(deps): bump vercel from 55.0.0 to 56.1.0 in /docs-website

[dependabot]

Bumps vercel from 55.0.0 to 56.1.0.

Release notes

Sourced from vercel's releases.

vercel@56.1.0

Minor Changes

• fac79dc: Make the CLI bin native-aware: resolve and spawn a @vercel/vc-native-* binary when present, otherwise no-op into the existing JS CLI. Part 1 of 2; no optionalDependencies are wired yet, so this release is a no-op that confirms the JS path is unaffected. Part 2 wires the release flow to publish natives before vercel.

Patch Changes

• e01c1d2: Harden filesystem trust boundaries: vercel init no longer materializes symlink or hardlink entries from downloaded example archives (blocking tar link-following path traversal, CVE-2024-12905 / CVE-2025-48387, and upgrading tar-fs to 1.16.5), the deploy root-directory check now normalizes paths before the containment test so a sibling directory sharing the project's path prefix can no longer be selected, and ai-gateway coding-agents setup now flags in its plan when a target config path is a symlink so the approval prompt reflects the file the write actually lands on.

vercel@56.0.0

Major Changes

• 4998ec8: vercel routes export now uses --output (-o) instead of --format to select the output file format (json or ts, dotted forms like .ts also accepted). This frees --format to align with the standard output-format convention used by other commands. Update any scripts from routes export --format ts to routes export --output ts.

Minor Changes

• 5ae15fa: Add vercel ai-gateway coding-agents setup to connect Claude Code to the AI Gateway from an existing API key (--key): it sets the gateway base URL and authentication in ~/.claude/settings.json (honoring CLAUDE_CONFIG_DIR), never pins a default model, is idempotent, masks the key in output, skips unparseable configs instead of clobbering them, edits existing config files in place so your own keys and formatting are untouched, and emits a structured JSON result in non-interactive mode.
• 24c2b3c: Automatically install a marketplace product's declared agent skills after vercel integration add provisions it, replacing the interactive confirmation prompt. The transcript ends with an install summary linking to the product's marketplace page, and failed installs fall back to printing the manual npx skills add command.
• 607f0ef: Add service information to deploy-manifest.
• 8642a47: Remove the vercel oauth-apps sub-command, reverting the OAuth / connected apps parity scope.
• 57e2091: vercel env pull now keeps variables that only exist in the local env file instead of deleting them. Kept variables are listed in the command output. CLI-managed variables (VERCEL_OIDC_TOKEN and analytics IDs) are still removed when they no longer exist upstream.

Patch Changes

• 2a403e2: Add Codex support to vercel ai-gateway coding-agents setup. It writes a vercel model provider to ~/.codex/config.toml (OpenAI-compatible base URL, responses wire API) without pinning a default model, and exports the gateway API key via your shell rc (honoring CODEX_HOME and fish/ZDOTDIR). Merging into an existing config.toml edits assignments in place, preserving your comments and formatting.

• 683f013: ai-gateway coding-agents setup can now provision a key for you: run it without --key and it creates an AI Gateway API key (prompting for the owning team and a name, or using --name/--scope and the current scope with --yes), then writes that key into the agent configs.

  Re-running when everything is already set up is no longer a dead end: it prompts to rotate the key or switch team, and --reconfigure does the same non-interactively (useful for a rotated or expired key, or a different org). A plain re-run stays a no-op.

• e64b222: ai-gateway coding-agents setup now detects the Codex desktop app and asks for consent before configuring Codex, since the desktop app cannot use custom model providers and stops working when one is set (the Codex CLI keeps working). Non-interactive and --yes runs configure Codex only when it is explicitly requested with --agent/--all; JSON output gains a warnings array and a requires_consent skip reason, and a run refused for lack of consent exits 1 with a self-contained requires_consent error payload (structured warnings, skip entries, and a runnable next[] command). A declined agent's configuration is left untouched.

• 7190684: ai-gateway coding-agents setup now configures only the agents detected on the machine when run non-interactively without --agent/--all, exits with code 1 (without creating an API key) when no agent configuration can be written, and on Windows reports the environment variable to set instead of writing a shell file that is never loaded (unless --shell-rc is passed explicitly). Non-interactive re-runs with --key on an already-configured macOS Keychain setup now refresh the stored key instead of silently keeping the old one.

• 097395b: ai-gateway coding-agents setup can now put limits on a key it creates: a spend cap (--budget with --refresh-period / --include-byok) and an expiry (--expiration 7d|30d|60d|90d|1y|none). Interactively it asks whether to set each. The limits are sent only when creating a key; reusing one with --key is unaffected.

• fcdf5cd: Store the coding-agents setup API key in the macOS login Keychain instead of writing it into plaintext config files. When available it's used automatically: env-based agents resolve the key from the shell at runtime (a managed shell-rc block runs security find-generic-password), so the secret never lands in a config file. Pass --no-keychain, or run off macOS, to embed the key directly; it also falls back to embedding if the Keychain write fails.

• c66bae3: Add OpenCode support to vercel ai-gateway coding-agents setup. It supplies the gateway API key to OpenCode's native vercel provider in ~/.config/opencode/opencode.json (honoring XDG_CONFIG_HOME) without pinning a default model. With the macOS Keychain in use, the key is kept out of the config and resolved from AI_GATEWAY_API_KEY (exported from the shell rc) at runtime instead.

• 2ffbf59: Add Pi support to vercel ai-gateway coding-agents setup. It writes the gateway credential to Pi's native vercel-ai-gateway auth entry in ~/.pi/agent/auth.json (created 0600, honoring PI_CODING_AGENT_DIR) without pinning a default model.

• bb16ec9: ai-gateway coding-agents setup now previews before it writes. --dry-run and the pre-apply summary show the planned per-file changes as a masked diff, the resolved key/quota/expiry, and the .bak backups it would create (suppressed with --no-backup), then ask for confirmation before applying. For non-standard setups, --agent-config <id>=<path> overrides an agent's config-file location and --shell-rc <path> the shell rc; interactively it offers a custom path when an agent isn't found at its default location.

• 35fba40: Attribute marketplace agent-skill auto-installs in the skills CLI's install telemetry by passing --metadata (origin, flow, integration and product slugs) to the npx skills add invocation. Older skills versions (< 1.5.16) ignore the flag and install unchanged.

• fd8e544: Preserve an environment's serving mode when feature flag rules are added, updated, moved, or removed. When the environment is serving a fixed variant, the CLI identifies that variant and warns that rule changes will not affect flag evaluation until the environment uses targeting again.

• Updated dependencies [607f0ef]

• Updated dependencies [7bbfd48]

• Updated dependencies [9637ae6]

• Updated dependencies [f11c4c4]

  • @​vercel/build-utils@​13.33.0

... (truncated)

Changelog

Sourced from vercel's changelog.

56.1.0

Minor Changes

• fac79dc: Make the CLI bin native-aware: resolve and spawn a @vercel/vc-native-* binary when present, otherwise no-op into the existing JS CLI. Part 1 of 2; no optionalDependencies are wired yet, so this release is a no-op that confirms the JS path is unaffected. Part 2 wires the release flow to publish natives before vercel.

Patch Changes

• e01c1d2: Harden filesystem trust boundaries: vercel init no longer materializes symlink or hardlink entries from downloaded example archives (blocking tar link-following path traversal, CVE-2024-12905 / CVE-2025-48387, and upgrading tar-fs to 1.16.5), the deploy root-directory check now normalizes paths before the containment test so a sibling directory sharing the project's path prefix can no longer be selected, and ai-gateway coding-agents setup now flags in its plan when a target config path is a symlink so the approval prompt reflects the file the write actually lands on.

56.0.0

Major Changes

• 4998ec8: vercel routes export now uses --output (-o) instead of --format to select the output file format (json or ts, dotted forms like .ts also accepted). This frees --format to align with the standard output-format convention used by other commands. Update any scripts from routes export --format ts to routes export --output ts.

Minor Changes

• 5ae15fa: Add vercel ai-gateway coding-agents setup to connect Claude Code to the AI Gateway from an existing API key (--key): it sets the gateway base URL and authentication in ~/.claude/settings.json (honoring CLAUDE_CONFIG_DIR), never pins a default model, is idempotent, masks the key in output, skips unparseable configs instead of clobbering them, edits existing config files in place so your own keys and formatting are untouched, and emits a structured JSON result in non-interactive mode.
• 24c2b3c: Automatically install a marketplace product's declared agent skills after vercel integration add provisions it, replacing the interactive confirmation prompt. The transcript ends with an install summary linking to the product's marketplace page, and failed installs fall back to printing the manual npx skills add command.
• 607f0ef: Add service information to deploy-manifest.
• 8642a47: Remove the vercel oauth-apps sub-command, reverting the OAuth / connected apps parity scope.
• 57e2091: vercel env pull now keeps variables that only exist in the local env file instead of deleting them. Kept variables are listed in the command output. CLI-managed variables (VERCEL_OIDC_TOKEN and analytics IDs) are still removed when they no longer exist upstream.

Patch Changes

• 2a403e2: Add Codex support to vercel ai-gateway coding-agents setup. It writes a vercel model provider to ~/.codex/config.toml (OpenAI-compatible base URL, responses wire API) without pinning a default model, and exports the gateway API key via your shell rc (honoring CODEX_HOME and fish/ZDOTDIR). Merging into an existing config.toml edits assignments in place, preserving your comments and formatting.

• 683f013: ai-gateway coding-agents setup can now provision a key for you: run it without --key and it creates an AI Gateway API key (prompting for the owning team and a name, or using --name/--scope and the current scope with --yes), then writes that key into the agent configs.

  Re-running when everything is already set up is no longer a dead end: it prompts to rotate the key or switch team, and --reconfigure does the same non-interactively (useful for a rotated or expired key, or a different org). A plain re-run stays a no-op.

• e64b222: ai-gateway coding-agents setup now detects the Codex desktop app and asks for consent before configuring Codex, since the desktop app cannot use custom model providers and stops working when one is set (the Codex CLI keeps working). Non-interactive and --yes runs configure Codex only when it is explicitly requested with --agent/--all; JSON output gains a warnings array and a requires_consent skip reason, and a run refused for lack of consent exits 1 with a self-contained requires_consent error payload (structured warnings, skip entries, and a runnable next[] command). A declined agent's configuration is left untouched.

• 7190684: ai-gateway coding-agents setup now configures only the agents detected on the machine when run non-interactively without --agent/--all, exits with code 1 (without creating an API key) when no agent configuration can be written, and on Windows reports the environment variable to set instead of writing a shell file that is never loaded (unless --shell-rc is passed explicitly). Non-interactive re-runs with --key on an already-configured macOS Keychain setup now refresh the stored key instead of silently keeping the old one.

• 097395b: ai-gateway coding-agents setup can now put limits on a key it creates: a spend cap (--budget with --refresh-period / --include-byok) and an expiry (--expiration 7d|30d|60d|90d|1y|none). Interactively it asks whether to set each. The limits are sent only when creating a key; reusing one with --key is unaffected.

• fcdf5cd: Store the coding-agents setup API key in the macOS login Keychain instead of writing it into plaintext config files. When available it's used automatically: env-based agents resolve the key from the shell at runtime (a managed shell-rc block runs security find-generic-password), so the secret never lands in a config file. Pass --no-keychain, or run off macOS, to embed the key directly; it also falls back to embedding if the Keychain write fails.

• c66bae3: Add OpenCode support to vercel ai-gateway coding-agents setup. It supplies the gateway API key to OpenCode's native vercel provider in ~/.config/opencode/opencode.json (honoring XDG_CONFIG_HOME) without pinning a default model. With the macOS Keychain in use, the key is kept out of the config and resolved from AI_GATEWAY_API_KEY (exported from the shell rc) at runtime instead.

• 2ffbf59: Add Pi support to vercel ai-gateway coding-agents setup. It writes the gateway credential to Pi's native vercel-ai-gateway auth entry in ~/.pi/agent/auth.json (created 0600, honoring PI_CODING_AGENT_DIR) without pinning a default model.

• bb16ec9: ai-gateway coding-agents setup now previews before it writes. --dry-run and the pre-apply summary show the planned per-file changes as a masked diff, the resolved key/quota/expiry, and the .bak backups it would create (suppressed with --no-backup), then ask for confirmation before applying. For non-standard setups, --agent-config <id>=<path> overrides an agent's config-file location and --shell-rc <path> the shell rc; interactively it offers a custom path when an agent isn't found at its default location.

• 35fba40: Attribute marketplace agent-skill auto-installs in the skills CLI's install telemetry by passing --metadata (origin, flow, integration and product slugs) to the npx skills add invocation. Older skills versions (< 1.5.16) ignore the flag and install unchanged.

• fd8e544: Preserve an environment's serving mode when feature flag rules are added, updated, moved, or removed. When the environment is serving a fixed variant, the CLI identifies that variant and warns that rule changes will not affect flag evaluation until the environment uses targeting again.

• Updated dependencies [607f0ef]

• Updated dependencies [7bbfd48]

• Updated dependencies [9637ae6]

... (truncated)

Commits

• f3efd0e Version Packages (#17078)
• fac79dc feat(cli): native trampoline with JS fallback, drop postinstall (#17011)
• e01c1d2 [cli] Harden filesystem trust boundaries (#17064)
• 2aee1cf Version Packages (#16989)
• fd8e544 [flags] Preserve serving mode when flag rules change (#16996)
• e64b222 [cli] coding-agents setup: warn before breaking the Codex desktop app (#16894)
• 7190684 [cli] coding-agents setup: safer non-interactive defaults and failures (#16887)
• 2ffbf59 [cli] coding-agents setup: add Pi support (#16866)
• c66bae3 [cli] coding-agents setup: add OpenCode support (#16865)
• 2a403e2 [cli] coding-agents setup: add Codex support (#16864)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
haystack-docs	Ready	Preview, Comment	Jul 15, 2026 2:27pm

[julian-risch]

Except for the one major change in 56.0 none of the changes seem to be a risk of any kind.