@vercel/client@18.2.3
📦 vercel-cliView on GitHub →
🐛 1 fixes🔧 5 symbols
Summary
This patch fixes a security vulnerability where `.vercelignore`d files could be re-added during `vercel deploy --prebuilt`. It also includes dependency updates.
🐛 Bug Fixes
- Fix `vercel deploy --prebuilt` re-adding `.vercelignore`d files through `filePathMap`. Source paths referenced by `.vc-config.json` `filePathMap` entries are now re-checked against the project's `.vercelignore`/`.nowignore` rules and rejected when they resolve outside the deployment root, so a tampered or lower-trust build artifact can no longer reintroduce ignored files (e.g. `.env`) into the deployment upload set.