{"slug": "breaking-vercel-permissions-can-now-return-use-github", "title": "Vercel: permissions can now return \"use:github\"", "summary": "Vercel added \"use:github\" as a new value to the permissions array on UserEvent objects, reachable from one Vercel operation, according to the company's API change notice. Vercel called the change additive, but it breaks exhaustive switches, strict parsers and generated client enums that read payload.permissions[]. Code consuming Vercel's UserEvent objects must handle the new value, which joins existing entries such as \"use:ai-gateway\" and \"read:user\".", "body_md": "## What changed\n\nProducer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.\n\nAffects `payload.permissions[]` on `UserEvent` reachable from 1 operation.\n\nNew value: `use:github`.\n\ncan now return \"use:github\"\n\n## Who is affected\n\nCode that reads Vercel's UserEvent objects, used by 1 Vercel operation.\n\n## Before and after\n\n| Where | Before | After | \n|---|---|---|\n| UserEvent.payload.permissions[] | \"*\", \"manage:speed-insights\", \"manage:web-analytics\", \"read-write:access-group\", \"read-write:ai-gateway-api-key\", \"read-write:ai-gateway-budgets\", \"read-write:ai-gateway-guardrails\", \"read-write:ai-gateway-private-models\", \"read-write:ai-gateway-rules\", \"read-write:ai-gateway-virtual-model-configs\", \"read-write:alerts\", \"read-write:automations\", \"read-write:billing\", \"read-write:blob\", \"read-write:connect\", \"read-write:deployment\", \"read-write:domain\", \"read-write:domain-registrar\", \"read-write:drains\", \"read-write:edge-cache\", \"read-write:edge-config\", \"read-write:firewall\", \"read-write:integration-configuration\", \"read-write:integration-resource\", \"read-write:kms\", \"read-write:messageboard\", \"read-write:project\", \"read-write:project-env-vars\", \"read-write:project-env-vars-non-production\", \"read-write:project-env-vars-production\", \"read-write:project-flags-non-production\", \"read-write:project-flags-production\", \"read-write:project-members\", \"read-write:project-protection-bypass\", \"read-write:project-trusted-sources\", \"read-write:remote-cache\", \"read-write:sandbox\", \"read-write:schedule\", \"read-write:team-members\", \"read-write:vcr\", \"read:access-group\", \"read:ai-gateway-budgets\", \"read:ai-gateway-guardrails\", \"read:ai-gateway-private-models\", \"read:ai-gateway-rules\", \"read:ai-gateway-virtual-model-configs\", \"read:alerts\", \"read:audit-log\", \"read:automations\", \"read:billing\", \"read:connect\", \"read:deployment\", \"read:domain\", \"read:event\", \"read:firewall\", \"read:integration-configuration\", \"read:integration-resource\", \"read:kms\", \"read:messageboard\", \"read:monitoring\", \"read:project\", \"read:project-env-vars-non-production\", \"read:project-env-vars-production\", \"read:project-flags\", \"read:project-members\", \"read:project-trusted-sources\", \"read:remote-cache\", \"read:sandbox\", \"read:schedule\", \"read:speed-insights\", \"read:team\", \"read:user\", \"read:vcr\", \"read:web-analytics\", \"read:webhooks\", \"use:ai-gateway\" | \"*\", \"manage:speed-insights\", \"manage:web-analytics\", \"read-write:access-group\", \"read-write:ai-gateway-api-key\", \"read-write:ai-gateway-budgets\", \"read-write:ai-gateway-guardrails\", \"read-write:ai-gateway-private-models\", \"read-write:ai-gateway-rules\", \"read-write:ai-gateway-virtual-model-configs\", \"read-write:alerts\", \"read-write:automations\", \"read-write:billing\", \"read-write:blob\", \"read-write:connect\", \"read-write:deployment\", \"read-write:domain\", \"read-write:domain-registrar\", \"read-write:drains\", \"read-write:edge-cache\", \"read-write:edge-config\", \"read-write:firewall\", \"read-write:integration-configuration\", \"read-write:integration-resource\", \"read-write:kms\", \"read-write:messageboard\", \"read-write:project\", \"read-write:project-env-vars\", \"read-write:project-env-vars-non-production\", \"read-write:project-env-vars-production\", \"read-write:project-flags-non-production\", \"read-write:project-flags-production\", \"read-write:project-members\", \"read-write:project-protection-bypass\", \"read-write:project-trusted-sources\", \"read-write:remote-cache\", \"read-write:sandbox\", \"read-write:schedule\", \"read-write:team-members\", \"read-write:vcr\", \"read:access-group\", \"read:ai-gateway-budgets\", \"read:ai-gateway-guardrails\", \"read:ai-gateway-private-models\", \"read:ai-gateway-rules\", \"read:ai-gateway-virtual-model-configs\", \"read:alerts\", \"read:audit-log\", \"read:automations\", \"read:billing\", \"read:connect\", \"read:deployment\", \"read:domain\", \"read:event\", \"read:firewall\", \"read:integration-configuration\", \"read:integration-resource\", \"read:kms\", \"read:messageboard\", \"read:monitoring\", \"read:project\", \"read:project-env-vars-non-production\", \"read:project-env-vars-production\", \"read:project-flags\", \"read:project-members\", \"read:project-trusted-sources\", \"read:remote-cache\", \"read:sandbox\", \"read:schedule\", \"read:speed-insights\", \"read:team\", \"read:user\", \"read:vcr\", \"read:web-analytics\", \"read:webhooks\", \"use:ai-gateway\", \"use:github\" | \n| UserEvent.payload.nextPermissions[] | \"*\", \"manage:speed-insights\", \"manage:web-analytics\", \"read-write:access-group\", \"read-write:ai-gateway-api-key\", \"read-write:ai-gateway-budgets\", \"read-write:ai-gateway-guardrails\", \"read-write:ai-gateway-private-models\", \"read-write:ai-gateway-rules\", \"read-write:ai-gateway-virtual-model-configs\", \"read-write:alerts\", \"read-write:automations\", \"read-write:billing\", \"read-write:blob\", \"read-write:connect\", \"read-write:deployment\", \"read-write:domain\", \"read-write:domain-registrar\", \"read-write:drains\", \"read-write:edge-cache\", \"read-write:edge-config\", \"read-write:firewall\", \"read-write:integration-configuration\", \"read-write:integration-resource\", \"read-write:kms\", \"read-write:messageboard\", \"read-write:project\", \"read-write:project-env-vars\", \"read-write:project-env-vars-non-production\", \"read-write:project-env-vars-production\", \"read-write:project-flags-non-production\", \"read-write:project-flags-production\", \"read-write:project-members\", \"read-write:project-protection-bypass\", \"read-write:project-trusted-sources\", \"read-write:remote-cache\", \"read-write:sandbox\", \"read-write:schedule\", \"read-write:team-members\", \"read-write:vcr\", \"read:access-group\", \"read:ai-gateway-budgets\", \"read:ai-gateway-guardrails\", \"read:ai-gateway-private-models\", \"read:ai-gateway-rules\", \"read:ai-gateway-virtual-model-configs\", \"read:alerts\", \"read:audit-log\", \"read:automations\", \"read:billing\", \"read:connect\", \"read:deployment\", \"read:domain\", \"read:event\", \"read:firewall\", \"read:integration-configuration\", \"read:integration-resource\", \"read:kms\", \"read:messageboard\", \"read:monitoring\", \"read:project\", \"read:project-env-vars-non-production\", \"read:project-env-vars-production\", \"read:project-flags\", \"read:project-members\", \"read:project-trusted-sources\", \"read:remote-cache\", \"read:sandbox\", \"read:schedule\", \"read:speed-insights\", \"read:team\", \"read:user\", \"read:vcr\", \"read:web-analytics\", \"read:webhooks\", \"use:ai-gateway\" | \"*\", \"manage:speed-insights\", \"manage:web-analytics\", \"read-write:access-group\", \"read-write:ai-gateway-api-key\", \"read-write:ai-gateway-budgets\", \"read-write:ai-gateway-guardrails\", \"read-write:ai-gateway-private-models\", \"read-write:ai-gateway-rules\", \"read-write:ai-gateway-virtual-model-configs\", \"read-write:alerts\", \"read-write:automations\", \"read-write:billing\", \"read-write:blob\", \"read-write:connect\", \"read-write:deployment\", \"read-write:domain\", \"read-write:domain-registrar\", \"read-write:drains\", \"read-write:edge-cache\", \"read-write:edge-config\", \"read-write:firewall\", \"read-write:integration-configuration\", \"read-write:integration-resource\", \"read-write:kms\", \"read-write:messageboard\", \"read-write:project\", \"read-write:project-env-vars\", \"read-write:project-env-vars-non-production\", \"read-write:project-env-vars-production\", \"read-write:project-flags-non-production\", \"read-write:project-flags-production\", \"read-write:project-members\", \"read-write:project-protection-bypass\", \"read-write:project-trusted-sources\", \"read-write:remote-cache\", \"read-write:sandbox\", \"read-write:schedule\", \"read-write:team-members\", \"read-write:vcr\", \"read:access-group\", \"read:ai-gateway-budgets\", \"read:ai-gateway-guardrails\", \"read:ai-gateway-private-models\", \"read:ai-gateway-rules\", \"read:ai-gateway-virtual-model-configs\", \"read:alerts\", \"read:audit-log\", \"read:automations\", \"read:billing\", \"read:connect\", \"read:deployment\", \"read:domain\", \"read:event\", \"read:firewall\", \"read:integration-configuration\", \"read:integration-resource\", \"read:kms\", \"read:messageboard\", \"read:monitoring\", \"read:project\", \"read:project-env-vars-non-production\", \"read:project-env-vars-production\", \"read:project-flags\", \"read:project-members\", \"read:project-trusted-sources\", \"read:remote-cache\", \"read:sandbox\", \"read:schedule\", \"read:speed-insights\", \"read:team\", \"read:user\", \"read:vcr\", \"read:web-analytics\", \"read:webhooks\", \"use:ai-gateway\", \"use:github\" | \n\n## Code that breaks\n\n```\nswitch (response.payload.permissions[0]) {\n  // existing branches …\n  // no branch for \"use:github\"\n  default:\n    throw new Error(\"unexpected permissions\");\n}\n```\n\nBased on Vercel’s published API specification. [How severity is decided](https://driftwatch.et/method).", "url": "https://wpnews.pro/news/breaking-vercel-permissions-can-now-return-use-github", "canonical_source": "https://driftwatch.et/changes/vercel-2026-10-19-e5852f1f", "published_at": "2026-10-19 22:02:06+00:00", "updated_at": "2026-10-19 22:45:22.113791+00:00", "lang": "en", "topics": ["developer-tools", "ai-infrastructure"], "entities": ["Vercel", "UserEvent"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/breaking-vercel-permissions-can-now-return-use-github", "markdown": "https://wpnews.pro/news/breaking-vercel-permissions-can-now-return-use-github.md", "text": "https://wpnews.pro/news/breaking-vercel-permissions-can-now-return-use-github.txt", "jsonld": "https://wpnews.pro/news/breaking-vercel-permissions-can-now-return-use-github.jsonld"}}