← All digests#11 · 12 Oct 2026, 05:45 pm IST · manual · success · email skipped
5 Oct – 12 Oct · IST · last 7 days
22 repos checked · 20 releases · 270 lines of notes
1 security 4 breaking+ 18 still open from earlier weeks
Security first, then breaking changes. Within each, flags both the rules and the AI agree on come first, and flags only the rules raised (AI judged routine) are shown quietly at the end. Nothing is hidden: the AI can add a flag but never remove one.
Express v5.3.0 fixes header conflicts in res.send and updates dependencies including qs, proxy-addr, and body-parser to resolve multiple vulnerabilities. It also adds conditional revalidation for QUERY requests and updates content-type handling.
Flagged in an earlier digest and not yet marked as reviewed, so an unread security fix can't quietly age out. Marked ones leave this list the next time the page loads.
Keycloak 26.8.0 promotes Verifiable Credential Issuance (OID4VCI) to preview, introduces experimental OID4VP credential verification, and resolves several security vulnerabilities across components.
Rules matchedCVE-2026-12388
Dependencies first, then the tools we're evaluating. Sub-package and pre-release streams are tucked into collapsed lines, never removed.
Pre-release update directing users to the external changelog for release details.
Release cadence and momentum for the tools we're evaluating, as of the last run.
| Repo | Releases · 90 days | Last | Median gap | Stars |
|---|---|---|---|---|
| better-auth/better-auth | 23 | 11d ago | 1.2d | ★ 30,265+5 since 11 Oct |
| drizzle-team/drizzle-orm | 3 | 4d ago | 5.9d | ★ 36,003+7 since 11 Oct |
| getlago/lago |
Tracked repos with no release in the window.
All repos were checked.
Rules matchedCVE-2026-2391CVE-2026-82417CVE-2026-82562CVE-2026-90711+7 more
Adds clients.search, anonymous session network binding, brute-force form submission mode, and DPoP strict refresh token binding. It also moves experiment and feature flag status transitions to PATCH requests.
Adds Redis Sentinel support and credentials, introduces a new Dockerfile.staging, adds the LAGO_WEBHOOK_ALLOW_PRIVATE_URLS setting, and removes flat filters and enriched expanded events in events-processor.
No release notes provided.
Rules matchedmajor version bump: v4.13.13 → v5.0.0-rc.1
No release notes provided.
Rules matchedmajor version bump: v4.13.13 → v5.0.0-rc.0
CVE-2026-14781CVE-2026-19608CVE-2026-54515Fixes a critical Magic Link account-takeover vulnerability (GHSA-965c-763c-88jm) and an issue where OAuth Proxy accepted sign-in state as a provider profile. Also adds optional OAuth redirect URI validation and fixes several adapter and header issues.
Rules matchedGHSA-965c-763c-88jmsecurityvulnerabilityadvisory+1 more
Keycloak 26.7.5 is a maintenance release that addresses multiple security fixes across OIDC, SAML, and token exchange, alongside bug fixes and an upgrade to Quarkus 3.33.4.
Rules matchedCVE-2026-16103CVE-2026-9798CVE-2026-18206CVE-2026-18203+8 more
Fixes a security vulnerability (GHSA-5r4p-p66f-jhc7) where `serveStatic` double-decoded request paths, potentially bypassing middleware. Request paths containing `%` after decoding are now rejected by default unless configured otherwise.
Rules matchedGHSA-5r4p-p66f-jhc7Security
This maintenance release applies security fixes and bumps Go to 1.26.8 for a security patch. It also includes matching performance improvements and a toggle for Nexus callback source header inspection.
Rules matchedsecurity
This patch release resolves CVEs and updates Go to 1.25.14 for a security patch. It also adds a Nexus callback header inspection toggle and matching performance improvements.
Rules matchedsecurity
This release provides a security fix and performance improvements when reading request parts and parsing content types. It also updates documentation and adds a sponsor.
Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisoriesmajor version bump: v5.12.5 → v6.0.0-alpha.4
This patch release addresses several CVE vulnerabilities including denial of service, privilege escalation, and account lockout issues. It also upgrades Quarkus to 3.33.3.2 and resolves several bug fixes.
Rules matchedCVE-2026-90997CVE-2026-79651CVE-2026-74909CVE-2026-19607+3 more
This release patches a security advisory and backports performance improvements for content-type parsing and request-part validation.
Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisories
Resolves security issues around inherited request configuration properties and ReDoS in proxy bypass hostname processing. Also breaks compatibility by disallowing Promises/functions/objects in header types and enabling CIDR ranges in NO_PROXY.
Rules matchedSecurityBreaking Change⚠️ Breaking
Temporal v1.32.0 promotes Standalone Activities to GA, introduces Standalone Nexus Operations pre-release, and enables the unified query converter by default with strict type validation. It also alters VisibilityRow Go types and callback URL behavior for security reasons.
Rules matchedsecuritybreaking change
Rule flagged; AI judged routine — check the notes
Hyperswitch v1.127.0 adds new features including GooglePay InternalGateway flow, stored card synchronization updates, blocklist scoping, and multiple connector enhancements.
Rules matchedinjection
Moves sweep-related API methods from BalanceAccountsApi to CustomPayoutSchedulesSweepsApi. Also introduces new APIs for payout schedules, top-ups, cash-outs, and updates Checkout API to v72.
Rules matchedBreaking Changemajor version bump: v15.0.2 → v16.0.0
Removes the organizationTemplates resource and modifies beta -mcp connection enum values, while adding new endpoints for Guardian settings, experiments, and searching.
Rules matchedBreaking Change⚠️ Breaking
Introduces consent non-repudiation, Experiment Center EA, and OIDC client support, while removing Organization Templates.
Rule flagged; AI judged routine — check the notes
Release notes link to the external changelog with no details provided in the text.
Rules matchedmajor version bump: v15.6.1 → v16.0.0
Rule flagged; AI judged routine — check the notes
Release notes link to the external changelog for details on v87.0.0.
Rules matchedmajor version bump: v86.4.2 → v87.0.0
Rule flagged; AI judged routine — check the notes
Release notes refer users to the changelog for full details.
Rules matchedmajor version bump: v22.6.2 → v23.0.0
Pre-release update directing users to the external changelog for release details.
Pre-release update directing users to the external changelog for release details.
Adds agent skills and anonymous-session support to the package. Fixes enterprise login cookie handling and surfaces anonymous-session expiry errors.
Updates defaultCliVersion to 1.9.1 and fixes SAA activity task validation routing. Includes fixes for scaler state clearing and task queue user data observation.
Fixes an issue where postgres-js did not use prepared queries when calling explicit .prepare(name).
Updates the hono peer dependency range to allow Hono v5 prereleases and keeps internal types private in the bundled type declarations.
Expands the hono peer dependency range to include Hono v5 prereleases and hides internal types in the bundled d.ts file.
Allows Hono v5 prereleases in the hono peer dependency range and ensures internal types are kept private in generated declaration files.
Allows Hono v5 prereleases in peer dependencies to resolve npm installation errors and hides internal types in the bundled d.ts file.
Updates peer dependency definitions to accept Hono v5 prereleases and restricts internal types from the bundled d.ts file.
Updates the hono peer dependency range to accept Hono v5 prereleases to prevent ERESOLVE errors. Also ensures internal types remain private in bundled type definitions.
Updates the hono peer dependency range to allow Hono v5 prereleases and avoid ERESOLVE install errors. Internal types are also kept private in the bundled type definitions.
Expands the hono peer dependency range to accept Hono v5 prereleases and resolves ERESOLVE errors. Additionally keeps internal types private within bundled type definitions.
Includes Docker build adjustments, such as increasing the Node heap size for the single-image front build, and several CI workflow improvements.
| 4d ago |
| 12d |
| ★ 10,673+2 since 11 Oct |
| honojs/hono | 30 | 1d ago | 3.2d | ★ 32,498+18 since 11 Oct |
| juspay/hyperswitch | 2 | 14d ago | 34.9d | ★ 45,310+3 since 11 Oct |
| temporalio/temporal | 4 | 3d ago | 5.9d | ★ 23,629+24 since 11 Oct |