← All breaking-change reports

Vercel API breaking change: response-prop-removed on POST /v1/projects/{idOrName}/avatar

vercel · breaking · source: OpenAPI spec diff

What changed

According to the OpenAPI spec diff (vercel/vercel-oas-v1.27.0-to-v1.28.0), the following surface changed:

response-prop-removed: POST /v1/projects/{idOrName}/avatar -> 200 publicSource

Who is affected

The publicSource field was removed from all project response schemas (project get/list/update, microfrontends project lists, deployment projectSettings).

To find out whether your repo is hit — file and line number, no code leaving your machine:

npx mendapi sync  # the one network call: fetch the change feed
npx mendapi scan --repo .  # local scan, nothing leaves your machine

How to fix it

mendapi ships a deterministic migration pack for this change (vercel-project-public-source-removal). Preview the patch locally (dry-run is the default; nothing is modified without --apply):

npx mendapi fix --repo . --migration vercel-project-public-source-removal

The pack is idempotent, gold-regression tested, and safe on partially migrated code.

What the migration does:

The publicSource field was removed from all project response schemas (project get/list/update, microfrontends project lists, deployment projectSettings). Request side still accepts it but marks it deprecated for backwards compatibility, so writers keep working for now; readers get undefined. The mechanical fix is to remove reads of publicSource from response handling (destructuring, conditionals, display logic). Writers should also drop the deprecated request property proactively, but that part is optional today. There is no replacement field; source visibility is no longer reported through these endpoints.

Before:

const { publicSource, name } = project;
if (publicSource) showPublicBadge();

After:

const { name } = project;
// publicSource removed from project responses upstream (v1.28.0); read deleted.

Detected and tracked by mendapi — Dependabot for every API you depend on. Scans run locally; your code never leaves your machine.

Related

Change data is recorded from upstream provider releases, changelogs and OpenAPI spec diffs; every article names its source.