← All provider guides

Vercel SDK migration: six breaking changes inside the v1.28 minor series

vercel sdk migration 1775 tracked change records

Most SDK migrations announce themselves with a major version. The Vercel SDK's v1.28 series did not. Between v1.27.0 and v1.28.9 — nine patch-level releases inside one minor — the OpenAPI surface behind @vercel/sdk dropped response fields, withdrew a request flag, reshaped a scalar into an array, widened a path parameter, and moved fields off a single-resource read entirely. Every one of these breaks real consuming code, and none of them is the kind of change a lockfile bump warns you about. That is the profile this tool exists for: changes detected by diffing the vendor's own OAS snapshots, each mapped to a codemod you can preview as a diff.

The six packs, exactly as the registry ships them

This list is read directly from the mendapi migration pack registry at page build time, so it matches what the codemods actually do:

Vercel Web Analytics: dheCipherSuite response dimension discontinued (v1.28.9)

Pack vercel-web-analytics-dhe-cipher-suite-removal:

  • Remove dheCipherSuite reads (destructuring, dimension lists, object properties, and consuming statements) from web-analytics query consumers
  • Remove unreferenced dheCipherSuite bindings from flat destructuring patterns (AST track)

Vercel Projects: enableFunctionsExtendedMaxDuration flag withdrawn from the API surface (v1.28.0)

Pack vercel-project-extended-max-duration-removal:

  • Remove enableFunctionsExtendedMaxDuration payload flags and reads, plus single-line consumers of the discontinued project-functions-extended-max-duration-updated event type
  • Remove unreferenced enableFunctionsExtendedMaxDuration bindings from flat resourceConfig destructuring patterns (AST track)

Vercel Projects: publicSource dropped from all project response schemas (v1.28.0)

Pack vercel-project-public-source-removal:

  • Remove publicSource response reads and ignored request writes from project API consumers; event-payload reads are preserved (that surface survives)

Vercel Marketplace stores: product.agentSkillUrl reshaped into the agentSkills array (v1.28.3)

Pack vercel-store-agent-skill-url-to-agent-skills:

  • Rewrite product.agentSkillUrl member reads to agentSkills?.[0] (scalar-to-array successor)

Vercel VCR: single-image fetch path parameter widened from imageId to imageIdOrDigest (v1.28.9)

Pack vercel-vcr-image-id-or-digest-rename:

  • getRepositoryImage: rename the imageId option key to imageIdOrDigest inside the call options object (delete call sites keep imageId — that parameter survives)

Vercel Marketplace: experimentation edge-config fields dropped from the single-resource read (v1.28.9) — reads move to the list endpoint

Pack vercel-integration-resource-edge-config-read-move:

  • Rewrite single-resource installation reads that consume the removed experimentation fields into a list-endpoint read plus find-by-partnerId

Preview each migration as one diff

Every pack runs locally as a dry run by default. On the bundled fixture repos the six packs rewrite 3, 3, 1, 1, 1 and 1 files respectively, each writing a unified patch you can read before anything is applied:

npx mendapi scan
# -> which files touch the Vercel SDK, with line numbers
mendapi fix --migration vercel-project-public-source-removal
# -> dry run: changes.patch + fix-report.json, nothing applied
mendapi fix --migration vercel-project-public-source-removal --apply
# -> applies the reviewed diff

Nothing leaves your machine at any step; zero network calls is the default and only mode. The report records which rule fired where, and every rewritten file carries a syntax-check verdict, so review is a read of the patch, not an audit of the tool.

What the codemods refuse to touch

A migration tool earns trust by what it leaves alone. Reads and writes that are not anchored to the affected API surface stay untouched: the same property name on an unrelated object is never rewritten, and the publicSource pack explicitly preserves event-payload reads because that surface survives the change. Every rule is locked by golden-fixture regression tests with negative controls (fixture lines that must survive byte-for-byte), so a rule that starts over-firing fails our build before it reaches your repo.

The part no codemod fixes

Honest scope: the packs handle the mechanical rewrites. They do not decide how your product should react to a discontinued analytics dimension or a withdrawn duration flag — those are behavior decisions, not rewrites. The tracked Vercel history counts 83 breaking or deprecation entries, and the platform-behavior ones stay not code-fixable by verdict, because pretending a codemod covers them is how migrations go wrong.

Related

Every entry on this page is generated from the mendapi change database at build time and links its upstream source.