chore(deps): bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: @astrojs/vercel, tsx and vercel.

Updates @astrojs/vercel from 11.0.2 to 11.0.3

Release notes

Sourced from @​astrojs/vercel's releases.

@​astrojs/vercel@​11.0.3

Patch Changes

• #17370 3a43cf0 Thanks @​matthewp! - Improves internal ISR route handling

Changelog

Sourced from @​astrojs/vercel's changelog.

11.0.3

Patch Changes

• #17370 3a43cf0 Thanks @​matthewp! - Improves internal ISR route handling

Commits

• e7d7935 [ci] release (#17373)
• 3a43cf0 fix(@​astrojs/vercel): improve internal ISR route handling (#17370)
• See full diff in compare view

Updates tsx from 4.23.0 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

• support tsImport after global preload (8d4ffc2)
• watch: avoid clearing piped output (95d0672)
• watch: treat script and dependency paths literally (79fddde)

Performance Improvements

• index transform cache lazily (e818ad6)
• load esbuild lazily in CLI (d067938)
• map Node TypeScript formats directly (cdcc623)
• use sync module hooks on Node v22.22.3+ (f8992f1)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 79fddde fix(watch): treat script and dependency paths literally
• e818ad6 perf: index transform cache lazily
• cdcc623 perf: map Node TypeScript formats directly
• d067938 perf: load esbuild lazily in CLI
• 95d0672 fix(watch): avoid clearing piped output
• 6fd4607 docs: add per-page metadata
• f4176d8 docs: generate sitemap
• 8d4ffc2 fix: support tsImport after global preload
• f0e89b2 docs: document Node's public type-stripping API vs internal loader path
• f8992f1 perf: use sync module hooks on Node v22.22.3+
• See full diff in compare view

Updates vercel from 55.0.0 to 56.3.2

Release notes

Sourced from vercel's releases.

vercel@56.3.2

Patch Changes

• 145eb34: Improve vercel ai-gateway coding-agents setup prompts: use the searchable team picker, keep the multiselect key legend visible after the first selection, and narrow the prompt lines by moving context off the question line.

  The apply step now offers a coding-agent handoff: when the key is stored in the macOS Keychain it asks whether to write the files or "Copy a prompt for my agent" (which creates the key, stores it in the Keychain, and copies agent-ready setup instructions — with no plaintext key — to the clipboard); without the Keychain it stays a plain yes/no confirm. A new --apply <edit|prompt> flag drives this non-interactively — --apply prompt writes the prompt to stdout so it can be piped into an agent (… --apply prompt --yes | claude -p), and in machine mode it rides along as a prompt JSON field.

vercel@56.3.1

Patch Changes

• b08b736: Support linked-project deploys with project-scoped tokens that cannot fetch owner user/team resources.

vercel@56.3.0

Minor Changes

• 238543c: Support Python services that declare their web app and development workflow sidecars through a pyproject.toml entrypoint in vercel dev.

Patch Changes

• d5751d6: Allow Env, Target, Flags rules, Routes, Redirects, Firewall, and Git commands to select a project explicitly with --project, including from an unlinked directory.

• 1d8e0ee: Extract project-link validation shared by routes, redirects, and firewall commands.

• b0aa678: Consolidate suggested-command and subcommand-argument helpers while preserving explicit project context and required-argument validation.

• c06b596: Fix vercel domains add sending the alias mutation under a stale ambient team scope. When run inside a directory linked to a project in another team, the command now resolves the local project link (like vercel domains ls) and scopes the domain/alias request to the linked team, so a same-name project in the ambient team can no longer be targeted by mistake.

• a39869e: Fix vercel dev returning 404 for api/ functions using the rust, python, ruby, or go runtimes when the project has a framework dev command (e.g. Next.js). These runtimes are registered by backend framework presets, which caused the dev server to misclassify api/ functions as the frontend build and skip building them.

• a55e7df: Replace user-facing experimentalServices references with services in error/warning messages and rename error codes (NO_EXPERIMENTAL_SERVICES_CONFIGURED → NO_SERVICES_CONFIGURED, MISSING_EXPERIMENTAL_SERVICES → MISSING_SERVICES). The deprecated v1 config key should no longer appear in guidance shown to users.

• e4866e9: Skip the Rust target/ directory by default for Rust projects.

  Rust projects produce a target/ directory of build artifacts that can be hundreds of MB. It's rebuilt on Vercel during the deployment (and cached server-side), so uploading it only slows deployments down. When a root Cargo.toml is detected, target/ is now ignored by default during vercel deploy and vercel dev. Users can opt back in with !/target in their .vercelignore.

  Also hardened the local file scanner used by vercel dev so that a directory removed mid-scan (a common race with cargo build churning target/) is skipped instead of crashing the process.

• 7ea6c7a: Preserve buildCommand and combine preDeployCommand when writing inferred services config to vercel.json in V2 format.

• 4cce813: Write [SENSITIVE] placeholder instead of an empty string when vercel env pull encounters sensitive environment variables whose values cannot be read, so an unset value is distinguishable from a redacted one

• Updated dependencies [b0ed8e5]

• Updated dependencies [c555d3a]

• Updated dependencies [238543c]

• Updated dependencies [f97e2e0]

  • @​vercel/python@​6.51.0
  • @​vercel/build-utils@​13.34.0
  • @​vercel/static-build@​2.11.8
  • @​vercel/backends@​0.8.25
  • @​vercel/container@​0.0.5
  • @​vercel/elysia@​0.1.102

... (truncated)

Changelog

Sourced from vercel's changelog.

56.3.2

Patch Changes

• 145eb34: Improve vercel ai-gateway coding-agents setup prompts: use the searchable team picker, keep the multiselect key legend visible after the first selection, and narrow the prompt lines by moving context off the question line.

  The apply step now offers a coding-agent handoff: when the key is stored in the macOS Keychain it asks whether to write the files or "Copy a prompt for my agent" (which creates the key, stores it in the Keychain, and copies agent-ready setup instructions — with no plaintext key — to the clipboard); without the Keychain it stays a plain yes/no confirm. A new --apply <edit|prompt> flag drives this non-interactively — --apply prompt writes the prompt to stdout so it can be piped into an agent (… --apply prompt --yes | claude -p), and in machine mode it rides along as a prompt JSON field.

56.3.1

Patch Changes

• b08b736: Support linked-project deploys with project-scoped tokens that cannot fetch owner user/team resources.

56.3.0

Minor Changes

• 238543c: Support Python services that declare their web app and development workflow sidecars through a pyproject.toml entrypoint in vercel dev.

Patch Changes

• d5751d6: Allow Env, Target, Flags rules, Routes, Redirects, Firewall, and Git commands to select a project explicitly with --project, including from an unlinked directory.

• 1d8e0ee: Extract project-link validation shared by routes, redirects, and firewall commands.

• b0aa678: Consolidate suggested-command and subcommand-argument helpers while preserving explicit project context and required-argument validation.

• c06b596: Fix vercel domains add sending the alias mutation under a stale ambient team scope. When run inside a directory linked to a project in another team, the command now resolves the local project link (like vercel domains ls) and scopes the domain/alias request to the linked team, so a same-name project in the ambient team can no longer be targeted by mistake.

• a39869e: Fix vercel dev returning 404 for api/ functions using the rust, python, ruby, or go runtimes when the project has a framework dev command (e.g. Next.js). These runtimes are registered by backend framework presets, which caused the dev server to misclassify api/ functions as the frontend build and skip building them.

• a55e7df: Replace user-facing experimentalServices references with services in error/warning messages and rename error codes (NO_EXPERIMENTAL_SERVICES_CONFIGURED → NO_SERVICES_CONFIGURED, MISSING_EXPERIMENTAL_SERVICES → MISSING_SERVICES). The deprecated v1 config key should no longer appear in guidance shown to users.

• e4866e9: Skip the Rust target/ directory by default for Rust projects.

  Rust projects produce a target/ directory of build artifacts that can be hundreds of MB. It's rebuilt on Vercel during the deployment (and cached server-side), so uploading it only slows deployments down. When a root Cargo.toml is detected, target/ is now ignored by default during vercel deploy and vercel dev. Users can opt back in with !/target in their .vercelignore.

  Also hardened the local file scanner used by vercel dev so that a directory removed mid-scan (a common race with cargo build churning target/) is skipped instead of crashing the process.

• 7ea6c7a: Preserve buildCommand and combine preDeployCommand when writing inferred services config to vercel.json in V2 format.

• 4cce813: Write [SENSITIVE] placeholder instead of an empty string when vercel env pull encounters sensitive environment variables whose values cannot be read, so an unset value is distinguishable from a redacted one

• Updated dependencies [b0ed8e5]

• Updated dependencies [c555d3a]

• Updated dependencies [238543c]

• Updated dependencies [f97e2e0]

  • @​vercel/python@​6.51.0
  • @​vercel/build-utils@​13.34.0
  • @​vercel/static-build@​2.11.8

... (truncated)

Commits

• 917f31e Version Packages (#17147)
• 145eb34 [cli] Improve ai-gateway coding-agents setup prompts (#17136)
• e35de4d Version Packages (#17140)
• b08b736 Add support for project-only tokens to vercel deploy (#16999)
• dc224ce Version Packages (#17126)
• d5751d6 feat(cli): add --project support for env, target, flags, routes, redirects, f...
• a55e7df [services] Replace experimentalServices in user-facing messages (#17077)
• 7ea6c7a [services] Preserve buildCommand and preDeployCommand in V2 config infer (#16...
• b0aa678 refactor(cli): consolidate suggested command helpers (#17110)
• 1d8e0ee refactor(cli): extract project link helper (#17109)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openresource-dev	Ready	Preview, Comment	Jul 27, 2026 3:04am