Vercel Functions 2026-08-30

Use these rules for Vercel Functions and the project settings, builds, networks, and caches that expose or execute them. Apply the secure coding rules for the chosen language and framework alongside these platform rules. Treat application users, deployments, build code, workload identities, and external services as separate trust boundaries.

Runtime selection

• Select and verify the runtime used by each deployed function. For managed Node.js, use the supported 24.x or 22.x line; 24.x is the default. Migrate remaining Node.js 20 deployments to a supported line: new deployments using Node.js 20 are blocked, and existing deployments continuing to run does not restore upstream security support.
• Set package.json engines.node to the intended major, such as 24.x, and align local and CI runtimes. This overrides the dashboard Node.js setting; broad ranges such as >=20 can select a newer major. Vercel manages minor and patch updates, so verify the deployed process.version instead of claiming an exact patch pin.
• Select Python 3.12, 3.13, or 3.14 through .python-version, pyproject.toml requires-python, or Pipfile.lock, and verify the selected interpreter in the build. A missing or unsupported selection falls back to 3.12; make an unexpected fallback fail validation.
• For Bun, set bunVersion in vercel.json deliberately: 1.4.x opts into Bun 1.4 and its breaking changes, while 1.x selects the prior 1.3 line. Verify dependencies against the deployed Bun version; installing packages with Bun alone does not select the function runtime.
• Check beta