The Deploy Log | Tools and products | Free, no signup

React2Shell protections

Vercel | In Edition 12, Saturday 6 Dec 2025

The call on this one

DEPLOYif you run Next.js 15.0.0 through 16.0.6

SOURCE Vercel, Resources for protecting against React2Shell

Vercel releases npx fix-react2shell-next to update affected Next.js apps, with Vercel Agent able to open pull requests that upgrade vulnerable projects and WAF rules filtering known exploit patterns.

Added to The Deploy Log Tuesday 15 Sep 2026, updated Thursday 17 Sep 2026. Read Edition 12, the edition that carried it.

43 rows from Vercel in The Deploy Log are dated on or before this one, this one included.

The same day from Vercel: DeepSeek V3.2 (0 days apart). After it: GPT-5.2 on AI Gateway, 7 days later.

Week of December 1, 2025 | December 2025

One line every time AI actually ships, as it ships, 24/7. Follow the wire: Threads | Bluesky

One line every time AI actually ships, around the clock, free on Threads and Bluesky. Every one is in The Deploy Log with its source.

Follow on Threads Follow on Bluesky

The Saturday edition is the week in one, free to read on the site, and by email if you want it: get it by email.