[services] frontend + backend routing bugfixes by ricardo-agz · Pull Request #15018 · vercel/vercel

ricardo-agz · 2026-02-11T23:59:47Z

Fixes a few issues relating to Next.js/Vite + FastAPI project routing

Fixes issue where if you have a Vite app mounted at the root + a Next.js app mounted at /dashboard and you ping a route like: /dashboard/nonexistent-route, it falls back to Vite's index.html instead of Next.js's 404
Moves service functions to an internal _svc namespace to prevent an issue where hitting /backend would be handled by FastAPI instead of Next.js 404
Also adds a few e2e fixture tests for services
Moves some helper functions like normalizeRoutePrefix() to routing-utils

Warning

High Risk Change

This PR fixes routing bugs by scoping service routes with ownership guards and moving function outputs to a reserved internal namespace, which are infrastructure-level routing changes that could affect request handling across services.

Removes isRouteOwningBuilder condition, applying route scoping to all builders
Adds reserved /_svc prefix validation and internal function path namespace
Modifies route source generation with ownership guards to prevent cross-service route capture

^{Risk assessment for commit b25567b.}

…port-v2-fixtures

changeset-bot · 2026-02-11T23:59:54Z

🦋 Changeset detected

Latest commit: b25567b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@vercel/fs-detectors	Patch
@vercel/routing-utils	Patch
vercel	Patch
@vercel/client	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

packages/cli/src/commands/build/index.ts

github-actions · 2026-02-12T00:14:15Z

📦 CLI Tarball Ready

The Vercel CLI tarball for this PR is now available!

Quick Test

You can test this PR's CLI directly by running:

npx https://vercel-9ewuj9pp7.vercel.sh/tarballs/vercel.tgz --help

Use in vercel.json

To use this CLI version in your project builds, add to your vercel.json:

{
  "build": {
    "env": {
      "VERCEL_CLI_VERSION": "vercel@https://vercel-9ewuj9pp7.vercel.sh/tarballs/vercel.tgz"
    }
  }
}

github-actions · 2026-02-12T00:14:21Z

🧪 Unit Test Strategy

Comparing: a960cf2 → b25567b (view diff)

Strategy: Affected packages only

✅ Only testing packages that have been modified or depend on modified packages.

Affected packages - 40 (100%)

@vercel-internals/get-package-json
@vercel/backends
@vercel/build-utils
@vercel/cervel
@vercel/cli-auth
@vercel/client
@vercel/config
@vercel/detect-agent
@vercel/edge
@vercel/elysia
@vercel/error-utils
@vercel/express
@vercel/fastify
@vercel/firewall
@vercel/frameworks
@vercel/fs-detectors
@vercel/functions
@vercel/gatsby-plugin-vercel-builder
@vercel/go
@vercel/h3
@vercel/hono
@vercel/hydrogen
@vercel/koa
@vercel/nestjs
@vercel/next
@vercel/node
@vercel/oidc
@vercel/oidc-aws-credentials-provider
@vercel/python
@vercel/python-analysis
@vercel/redwood
@vercel/related-projects
@vercel/remix-builder
@vercel/routing-utils
@vercel/ruby
@vercel/rust
@vercel/static-build
@vercel/static-config
examples
vercel

Results

Unit tests: Only affected packages will run unit tests
E2E tests: Handled separately (Version Packages PRs or run-e2e-tests label)
Type checks: Only affected packages will run type checks

This comment is automatically generated based on the affected testing strategy

socket-security · 2026-02-12T03:00:05Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@docusaurus/preset-classic@3.9.2
	npm/@docusaurus/core@3.9.2

View full report

brookemosby

LGTM

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## vercel@50.17.0 ### Minor Changes - Install builder packages on demand ([#15023](#15023)) - Display functions exceeding 250MB uncompressed size limit with total size and breakdown of largest dependencies (requires environment variable VERCEL_ANALYZE_BUILD_OUTPUT=1). ([#14067](#14067)) ### Patch Changes - Add `--format=json` option to `vercel integration list` and show project name in table header when results are scoped to a project ([#15007](#15007)) - Fix builder import resolution from pre-installed depenencies ([#15041](#15041)) - Services routing improvements: ([#15018](#15018)) - Fix route ownership scoping so parent service catch-alls (e.g. Vite SPA fallback) don't capture sibling service prefixes - Move shared ownership-guard helpers (`getOwnershipGuard`, `scopeRouteSourceToOwnership`) to `@vercel/routing-utils` - Place runtime service function outputs under internal `/_svc/<service>/index` namespace to prevent filesystem path leakage - Block `/_svc` as a reserved routePrefix in service validation - Scope all builder-emitted routes (not just route-owning builders) to their service ownership before merging - Updated dependencies \[]: - @vercel/static-build@2.8.37 - @vercel/build-utils@13.4.0 - @vercel/next@4.15.28 - @vercel/redwood@2.4.9 - @vercel/rust@1.0.5 ## @vercel/client@17.2.41 ### Patch Changes - Updated dependencies \[[`3cd0b559f1815fdb13f7aa05114bae2b0b0b0e68`](3cd0b55)]: - @vercel/routing-utils@5.3.3 - @vercel/build-utils@13.4.0 ## @vercel/fs-detectors@5.8.6 ### Patch Changes - Services routing improvements: ([#15018](#15018)) - Fix route ownership scoping so parent service catch-alls (e.g. Vite SPA fallback) don't capture sibling service prefixes - Move shared ownership-guard helpers (`getOwnershipGuard`, `scopeRouteSourceToOwnership`) to `@vercel/routing-utils` - Place runtime service function outputs under internal `/_svc/<service>/index` namespace to prevent filesystem path leakage - Block `/_svc` as a reserved routePrefix in service validation - Scope all builder-emitted routes (not just route-owning builders) to their service ownership before merging - Updated dependencies \[[`3cd0b559f1815fdb13f7aa05114bae2b0b0b0e68`](3cd0b55)]: - @vercel/routing-utils@5.3.3 - @vercel/frameworks@3.17.1 ## @vercel/routing-utils@5.3.3 ### Patch Changes - Services routing improvements: ([#15018](#15018)) - Fix route ownership scoping so parent service catch-alls (e.g. Vite SPA fallback) don't capture sibling service prefixes - Move shared ownership-guard helpers (`getOwnershipGuard`, `scopeRouteSourceToOwnership`) to `@vercel/routing-utils` - Place runtime service function outputs under internal `/_svc/<service>/index` namespace to prevent filesystem path leakage - Block `/_svc` as a reserved routePrefix in service validation - Scope all builder-emitted routes (not just route-owning builders) to their service ownership before merging  > [!NOTE] > Low Risk Change > > This PR is an automated Changesets release that only updates version numbers in package.json files and adds changelog entries - no source code changes are present. > > - Deletes changeset markdown files after consuming them > - Bumps version numbers in 4 package.json files > - Adds changelog entries documenting previous changes > > <sup>Risk assessment for [commit 9186d29](https://github.com/vercel/vercel/commit/9186d293adee9d555b8582f5c1d0cec87689acf1).</sup>  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

ricardo-agz added 16 commits February 8, 2026 14:30

builders v2 + v3 support

3c58176

improved support

4e848c5

vade fix

24f8188

fixes

34f90e9

cross-service route leakage fix

0076565

clean

35217c0

cleaning

f42833a

services fixtures

056064b

prefixed v3 at the root fix

afbdb41

fix fixture

79fb377

fix fixture

bfee802

test fix

2d0b471

Merge branch 'main' into ricardo/services-builders-v2-v3-prefixed-sup…

04ab8e4

…port-v2-fixtures

update fixtures

586bd0d

clean stray add

df808d5

fixes

1c7dd31

ricardo-agz requested review from a team, agadzik, chloetedder and ijjk as code owners February 11, 2026 23:59

ricardo-agz marked this pull request as draft February 12, 2026 00:02

ricardo-agz commented Feb 12, 2026

View reviewed changes

packages/cli/src/commands/build/index.ts Show resolved Hide resolved

ricardo-agz added the run-e2e-tests label Feb 12, 2026

Merge branch 'main' into ricardo/vite-fix-plus-e2e-fixtures

40753b8

vercel bot deployed to Preview February 12, 2026 00:14 View deployment

vercel bot deployed to Preview February 12, 2026 01:15 View deployment

message

1271176

vercel bot deployed to Preview February 12, 2026 01:21 View deployment

cs

e9ad393

vercel bot deployed to Preview February 12, 2026 01:29 View deployment

multi runtime fixtures

c31e979

vercel bot deployed to Preview February 12, 2026 02:22 View deployment

rb fixture

5d8ee68

vercel bot deployed to Preview February 12, 2026 02:26 View deployment

fixtures

b8af1a2

vercel bot deployed to Preview February 12, 2026 02:43 View deployment

timeout

e5566cc

vercel bot deployed to Preview February 12, 2026 02:58 View deployment

probe fix

20c85d7

vercel bot deployed to Preview February 12, 2026 03:45 View deployment

removed docs

4a8cb18

vercel bot deployed to Preview February 12, 2026 03:59 View deployment

Merge branch 'main' into ricardo/vite-fix-plus-e2e-fixtures

1c52b75

vercel bot deployed to Preview February 12, 2026 05:03 View deployment

ricardo-agz marked this pull request as ready for review February 12, 2026 05:18

ricardo-agz requested a review from nsidnev February 12, 2026 05:18

Merge branch 'main' into ricardo/vite-fix-plus-e2e-fixtures

b25567b

vercel bot deployed to Preview February 12, 2026 06:22 View deployment

nsidnev approved these changes Feb 12, 2026

View reviewed changes

brookemosby approved these changes Feb 12, 2026

View reviewed changes

ricardo-agz merged commit 3cd0b55 into main Feb 12, 2026
473 of 479 checks passed

ricardo-agz deleted the ricardo/vite-fix-plus-e2e-fixtures branch February 12, 2026 21:01

vercel-release-bot mentioned this pull request Feb 12, 2026

Version Packages #15035

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[services] frontend + backend routing bugfixes#15018

[services] frontend + backend routing bugfixes#15018
ricardo-agz merged 30 commits intomainfrom
ricardo/vite-fix-plus-e2e-fixtures

ricardo-agz commented Feb 11, 2026 •

edited by vercel bot

Loading

Uh oh!

changeset-bot bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Feb 12, 2026

Uh oh!

brookemosby left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ricardo-agz commented Feb 11, 2026 • edited by vercel bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 CLI Tarball Ready

Quick Test

Use in vercel.json

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 Unit Test Strategy

Results

Uh oh!

socket-security bot commented Feb 12, 2026

Uh oh!

brookemosby left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ricardo-agz commented Feb 11, 2026 •

edited by vercel bot

Loading

changeset-bot bot commented Feb 11, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading