Last weekly digest 19 Oct 2026, 08:49 am ISTNext scheduled Monday 8–9 AM ISTView it as emailed →
Last 30 days, built from stored results (no live fetch for this range). Releases no refresh or run has stored yet are not shown; use Backfill on the Repos page to fill it in. Releases not yet analysed show rules-only flags. How it works →
Security first, then breaking changes. Within each, flags both the rules and the AI agree on come first, and flags only the rules raised (AI judged routine) are shown quietly at the end. Nothing is hidden: the AI can add a flag but never remove one.
This release updates the OAuth device-code approval flow, alters the custom DeviceAuthorizationGrant interface, and adds CIBA backchannel authentication support. It introduces breaking interface updates and requires database schema migrations for new deviceCode and sectorIdentifier columns.
Dependencies first, then the tools we're evaluating. Sub-package and pre-release streams are tucked into collapsed lines, never removed.
Fixes factor name mapping for out-of-band channels in mfaChallenge.
Adds agent skills and anonymous-session support to the package. Fixes enterprise login cookie handling and surfaces anonymous-session expiry errors.
Release cadence and momentum for the tools we're evaluating, as of the last run.
| Repo | Releases · 90 days | Last | Median gap | Stars |
|---|---|---|---|---|
| adyen/adyen-node-api-library | 2 | 24d ago | 14.9d | ★ 139no earlier snapshot yet |
| better-auth/better-auth | 29 | 0d ago | 0.8d | ★ 30,360+95 since 12 Oct |
| drizzle-team/drizzle-orm |
Tracked repos with no release in the window.
All repos were checked.
Rules matchedBreaking Change
Fixes ID token validation for Twitch and Paybin, PostgreSQL migration diffs for int8 columns, and rate limit header values. Custom Paybin issuers now require publishing RS256 signing keys at a standard well-known endpoint.
Adds websocketMask and websocketUnmask to the http module and updates dependencies including SQLite and Acorn. Node now also throws when WebAssembly or RX support is missing.
Adds attack protection CAPTCHA policies, client grants search, anonymous session network binding, and DPoP strict refresh token binding. It also moves experiment and feature flag status transitions to the PATCH method.
Adds clients.search, anonymous session network binding, brute-force form submission mode, and DPoP strict refresh token binding. It also moves experiment and feature flag status transitions to PATCH requests.
Adds Redis Sentinel support and credentials, introduces a new Dockerfile.staging, adds the LAGO_WEBHOOK_ALLOW_PRIVATE_URLS setting, and removes flat filters and enriched expanded events in events-processor.
Introduces consent non-repudiation, Experiment Center EA, and OIDC client support, while removing Organization Templates.
No release notes provided.
Rules matchedmajor version bump: v4.13.13 → v5.0.0-rc.1
No release notes provided.
Rules matchedmajor version bump: v4.13.13 → v5.0.0-rc.0
Rule flagged; AI judged routine — check the notes
Release notes link to the external changelog with no details provided in the text.
Rules matchedmajor version bump: v15.6.1 → v16.0.0
Rule flagged; AI judged routine — check the notes
Release notes link to the external changelog for details on v87.0.0.
Rules matchedmajor version bump: v86.4.2 → v87.0.0
Rule flagged; AI judged routine — check the notes
Release notes refer users to the changelog for full details.
Rules matchedmajor version bump: v22.6.2 → v23.0.0
Introduces early-access support for anonymous sessions with Session Transfer Ticket linking.
Directs users to the external changelog for full release notes.
Pre-release update directing users to the external changelog for release details.
Release notes refer users to the changelog for full details.
Release notes refer users to the changelog for full details.
Release notes refer users to the changelog for full details.
Directs users to the external changelog for full release notes.
Pre-release update directing users to the external changelog for release details.
Release notes link to the external changelog for details on v87.1.0-alpha.1.
Release notes link to the external changelog for details on v87.1.0-beta.1.
Release notes refer users to the changelog for full details.
Directs users to the external changelog for full release notes.
Pre-release update directing users to the external changelog for release details.
Release notes refer users to the changelog for full details.
Release notes link to the external changelog with no details provided in the text.
Release notes link to the external changelog with no details provided in the text.
Adds client profiles, attack protection CAPTCHA policies, client grants search, and CIMD external metadata status and dynamic registration.
Fixes a CI issue to prevent beta releases from deleting package.json and updates beta version numbering to start at .0.
Adds clients search and brute-force form submission mode in beta, and syncs API changes from version 7.3.0.
Patch release linking to the full diff comparison with no details provided in the release notes.
Adds a FedCM browser account chooser for Google sign-in and supports assigning client_credentials scopes during OAuth client registration. Also fixes relations v2 schema handling in the Drizzle adapter.
This patch resolves various bugs across Google One Tap sign-in, OAuth endpoint error responses, DPoP verification, and MongoDB pagination sorting. It also adds an optional self-service signing key rotation feature for private_key_jwt clients.
Fixes error handlers to complete before responses are sent, adds isContinuation to postLogin.shouldRedirect, and fixes DPoP validation behind proxies that rewrite request URLs.
Adds a bannedUserMessage function, Vercel BotID captcha support, and CLI schema check commands. Also rejects passwords exceeding maxPasswordLength before hashing and fixes multiple adapter schema validation and query race condition bugs.
Adds Fraud and Risk Management (FRM) framework flows, new connector integrations, blocklist profile cloning, and platform-level dispute endpoints. Also includes various connector fixes and process tracker improvements.
Updates the default CLI to 1.9.1 and bumps the klauspost/compress dependency to v1.18.7. It also includes internal callback namespace binding configuration and makes fair task garbage collection conditional on rangeid.
Updates defaultCliVersion to 1.9.1 and fixes SAA activity task validation routing. Includes fixes for scaler state clearing and task queue user data observation.
Fixes an issue where postgres-js did not use prepared queries when calling explicit .prepare(name).
Adds warnings for silent migration skips during drizzle-kit checks.
Introduces support for the Netlify DB driver in Drizzle ORM.
Adds the Mount Middleware (`hono/mount`) and deprecates `app.mount()`. Also includes minor bug fixes for JSX and client test improvements.
Fixes TypeScript declaration bundling, ETag header case matching, JSX style property unit conversions, and middleware short-circuit response handling.
Separates runtime adapters into standalone scoped packages, deprecates internal `hono/<adapter>` imports, and deprecates `hono/cloudflare-pages` without replacement. Includes internal tooling migrations to pnpm and oxlint.
Addresses several bug fixes across JSX, content negotiation, routing, JWT parsing, and AWS Lambda/Lambda@Edge adapter handlers.
Expands the hono peer dependency range to include Hono v5 prereleases and hides internal types in the bundled d.ts file.
Updates the hono peer dependency range to allow Hono v5 prereleases and keeps internal types private in the bundled type declarations.
Allows Hono v5 prereleases in the hono peer dependency range and ensures internal types are kept private in generated declaration files.
Includes Docker build adjustments, such as increasing the Node heap size for the single-image front build, and several CI workflow improvements.
Adds sub-merchant data support to Payments App boarding-token requests and updates the Node HTTPS client to reuse agents across requests.
| 10d ago |
| 5.9d |
| ★ 36,080+77 since 12 Oct |
| getlago/lago | 6 | 11d ago | 12d | ★ 10,689+16 since 12 Oct |
| honojs/hono | 29 | 8d ago | 1.7d | ★ 32,586+88 since 12 Oct |
| juspay/hyperswitch | 3 | 2d ago | 34.9d | ★ 45,359+49 since 12 Oct |
| temporalio/temporal | 6 | 6d ago | 4.2d | ★ 23,812+183 since 12 Oct |
Allows Hono v5 prereleases in peer dependencies to resolve npm installation errors and hides internal types in the bundled d.ts file.
Updates peer dependency definitions to accept Hono v5 prereleases and restricts internal types from the bundled d.ts file.
Updates the hono peer dependency range to accept Hono v5 prereleases to prevent ERESOLVE errors. Also ensures internal types remain private in bundled type definitions.
Updates the hono peer dependency range to allow Hono v5 prereleases and avoid ERESOLVE install errors. Internal types are also kept private in the bundled type definitions.
Expands the hono peer dependency range to accept Hono v5 prereleases and resolves ERESOLVE errors. Additionally keeps internal types private within bundled type definitions.
No release notes provided.
No release notes provided.