build(deps-dev): bump vercel from 58.4.4 to 60.1.3

[dependabot]

Bumps vercel from 58.4.4 to 60.1.3.

Changelog

Sourced from vercel's changelog.

vercel

59.11.7

Patch Changes

• 1109c9e: Update CLI command behavior.

59.11.6

Patch Changes

• f5fd254: Stage native binary dependencies with pnpm deploy --frozen-lockfile (hoisted layout) and prune the tree to what the CLI's non-builder runtime dependencies can reach, instead of a handwritten, flattened allowlist. The binary now ships exactly the versions in pnpm-lock.yaml, nested dependency versions are preserved (fixes vercel sandbox loading lru-cache@6 instead of lru-cache@10), and platform-specific optional dependencies are resolved for the --target platform. Staging happens outside the repository so pkg cannot follow stray requires into workspace node_modules, and dependency test files are excluded from the snapshot. The binary smoke test accepts the usage exit code 2 that most --help commands return.
• e492148: Correct metrics help examples for the v1 catalog and use a rolling pageview time range.
• f5fd254: On non-native CLI, resolve URL-pinned builders from CLI dependencies when a cached .vercel/builders copy does not match the pin, instead of npm-installing the preview tarball. Publish preview tarballs at flat filenames (e.g. vercel-node.tgz) so yarn 1 and pnpm 8 can both install them. Preview pack also hoists nested registry deps of those tarball pins onto the parent (e.g. js-yaml from @vercel/python-analysis) because yarn 1 does not install them.

59.11.5

Patch Changes

• ffe0cab: Fix vercel flags split and vercel flags rules add help examples to use false/true variant values, and treat flags / @flags-sdk/vercel as notable dependencies in vercel skills.

59.11.4

Patch Changes

• a3c4302: Clarify --trigger-branch help on vercel connect create and vercel connect attach. The flag targets a git branch's preview deployment; production is selected by omitting the flag, not by passing production as a branch name.
• 2c5ed83: Fix firewall overview failing on plans without IP Bypass. The command no longer errors when the bypass endpoint is unavailable, and reports system mitigation status from the project rather than the plan-gated bypass API. With --json, a bypassUnavailable field now explains why bypass is null.
• aae0a62: Reduce vercel deploy startup time by lazy-loading modules that are only needed for first-time project setup, --dry output, and experimental services detection (@vercel/frameworks, @vercel/fs-detectors, the vercel.json schema validator, and vercel env pull).

59.11.3

Patch Changes

• 36a6a4e: Only list internal trace sampling rules with vercel traces config ls.
• Updated dependencies [1817491]
  • @​vercel/build-utils@​14.9.1
  • @​vercel/backends@​7.0.2
  • @​vercel/container@​7.0.1
  • @​vercel/elysia@​7.0.1
  • @​vercel/express@​7.0.2
  • @​vercel/fastify@​7.0.1
  • @​vercel/go@​10.0.1
  • @​vercel/h3@​7.0.1
  • @​vercel/hono@​7.0.1
  • @​vercel/hydrogen@​8.0.1
  • @​vercel/koa@​7.0.1
  • @​vercel/nestjs@​7.0.1
  • @​vercel/next@​11.0.2
  • @​vercel/node@​12.0.1

... (truncated)

Commits

• See full diff in compare view

Attestation changes

This version has no provenance attestation, while the previous version (58.4.4) was attested. Review the package versions before updating.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
betterman	Ready	Preview	Sep 30, 2026 1:54am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: dab350de-f64e-4e41-a9bc-08e731e399fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 2/5

[High risk] Bumps the Vercel deployment CLI to a major version.

This PR is not safe to merge until the CI, deployment, and provenance gates are reconciled with the new CLI pin.

Findings

1.  CI rejects the new pin ▶
2.  Production rejects the new CLI ▶
3.  Required provenance is missing ▶
4.  Production runbook names old version ▶

Fix with agent prompt

### Issue 1
package.json:35
**CI rejects the new pin.** CI runs `check-osv-exceptions.mjs`, which rejects any Vercel version other than `58.4.4`, so this upgrade fails that check. The script also expects Vercel to depend on `sandbox@3.4.0`, while the new lockfile specifies `4.1.0`; both assumptions need re-evaluation.

### Issue 2
package.json:35
**Production rejects the new CLI.** The deployment workflow installs the pinned CLI from `main` but still requires `vercel --version` to equal `58.4.4`. With this `60.0.1` pin, that step exits before building or deploying. A CI test also requires the workflow check to match the package pin, so it fails as well.

### Issue 3
package.json:35
**Required provenance is missing.** The PR description states that `vercel@60.0.1` has no provenance attestation. CI and deployment both require verified SLSA provenance for the installed CLI, so this version cannot pass their mandatory gate. Keep that gate and select an attested release or explicitly resolve the verification policy before upgrading.

### Issue 4
package.json:35
**Production runbook names old version.** The runbook still identifies `58.4.4` as the pinned CLI and describes its provenance as the accepted deployment policy. After this upgrade, operators following it would use the wrong version and lack accurate guidance for the new provenance decision. Update the runbook alongside the pin.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR upgrades the pinned Vercel CLI from 58.4.4 to 60.0.1 and refreshes its dependency tree.

• Existing CI exception checks and the production version check still require the old pin.
• The mandatory provenance gate conflicts with the PR’s statement that the new release is unattested.
• The production runbook still documents the old pin.

_{Reviews (1) · Last reviewed commit: "build(deps-dev): bump vercel from 58.4.4..."}

[greptile-apps]

CI rejects the new pin. CI runs check-osv-exceptions.mjs, which rejects any Vercel version other than 58.4.4, so this upgrade fails that check. The script also expects Vercel to depend on sandbox@3.4.0, while the new lockfile specifies 4.1.0; both assumptions need re-evaluation.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 35

Comment:
**CI rejects the new pin.** CI runs `check-osv-exceptions.mjs`, which rejects any Vercel version other than `58.4.4`, so this upgrade fails that check. The script also expects Vercel to depend on `sandbox@3.4.0`, while the new lockfile specifies `4.1.0`; both assumptions need re-evaluation.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Production rejects the new CLI. The deployment workflow installs the pinned CLI from main but still requires vercel --version to equal 58.4.4. With this 60.0.1 pin, that step exits before building or deploying. A CI test also requires the workflow check to match the package pin, so it fails as well.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 35

Comment:
**Production rejects the new CLI.** The deployment workflow installs the pinned CLI from `main` but still requires `vercel --version` to equal `58.4.4`. With this `60.0.1` pin, that step exits before building or deploying. A CI test also requires the workflow check to match the package pin, so it fails as well.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Required provenance is missing. The PR description states that vercel@60.0.1 has no provenance attestation. CI and deployment both require verified SLSA provenance for the installed CLI, so this version cannot pass their mandatory gate. Keep that gate and select an attested release or explicitly resolve the verification policy before upgrading.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 35

Comment:
**Required provenance is missing.** The PR description states that `vercel@60.0.1` has no provenance attestation. CI and deployment both require verified SLSA provenance for the installed CLI, so this version cannot pass their mandatory gate. Keep that gate and select an attested release or explicitly resolve the verification policy before upgrading.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Production runbook names old version. The runbook still identifies 58.4.4 as the pinned CLI and describes its provenance as the accepted deployment policy. After this upgrade, operators following it would use the wrong version and lack accurate guidance for the new provenance decision. Update the runbook alongside the pin.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 35

Comment:
**Production runbook names old version.** The runbook still identifies `58.4.4` as the pinned CLI and describes its provenance as the accepted deployment policy. After this upgrade, operators following it would use the wrong version and lack accurate guidance for the new provenance decision. Update the runbook alongside the pin.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[amanthanvi]

Closing without merging: this upgrade cannot pass the repository's own supply-chain gate, and never will as things stand upstream.

scripts/check-vercel-provenance.mjs (required by ci_contracts/nextjs) requires the vercel package to carry a verified SLSA provenance attestation built from the public vercel/vercel/.github/workflows/release.yml workflow. vercel@60.0.1 has no attestation at all — and per Vercel's own statement on vercel/vercel#17408, CLI publishing moved to a private repository from 58.5.1 onward and npm does not support provenance attestations for private-source publishes. The whole 59.x/60.x/61.x line (including the current latest, 61.0.0) ships without provenance.

This is why the repo deliberately returned to attested 58.4.4 (see CHANGELOG, "Supply chain: return deployment tooling to attested Vercel CLI 58.4.4"). Until either Vercel restores public provenance publication or the project deliberately relaxes that gate, every vercel bump will fail these checks. Leaving that policy call to the maintainer rather than weakening the gate here.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.