← All digests#12 · 19 Oct 2026, 08:49 am IST · cron · success · email sent
12 Oct – 19 Oct · IST · last 7 days
23 repos checked · 40 releases · 2,179 lines of notes
25 security 4 breaking+ 20 still open from earlier weeks
Security first, then breaking changes. Within each, flags both the rules and the AI agree on come first, and flags only the rules raised (AI judged routine) are shown quietly at the end. Nothing is hidden: the AI can add a flag but never remove one.
Hardens SAML against replay attacks and unvalidated assertions, scopes WebAuthn and API keys, and serializes session creation with unlinking. Also introduces database schema updates for consumed assertions and ACS URLs.
Flagged in an earlier digest and not yet marked as reviewed, so an unread security fix can't quietly age out. Marked ones leave this list the next time the page loads.
Express v5.3.0 fixes header conflicts in res.send and updates dependencies including qs, proxy-addr, and body-parser to resolve multiple vulnerabilities. It also adds conditional revalidation for QUERY requests and updates content-type handling.
Dependencies first, then the tools we're evaluating. Sub-package and pre-release streams are tucked into collapsed lines, never removed.
Fixes factor name mapping for out-of-band channels in mfaChallenge.
Release cadence and momentum for the tools we're evaluating, as of the last run.
| Repo | Releases · 90 days | Last | Median gap | Stars |
|---|---|---|---|---|
| adyen/adyen-node-api-library | 2 | 24d ago | 14.9d | ★ 139no earlier snapshot yet |
| better-auth/better-auth | 29 | 0d ago | 0.8d | ★ 30,360+95 since 12 Oct |
| drizzle-team/drizzle-orm |
Tracked repos with no release in the window.
All repos were checked.
Rules matchedGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-4rf2-xqvf-8rcxGHSA-6v34-w48w-44rc+2 more
Resolves multiple security vulnerabilities across SAML, WebAuthn, API keys, and session lifecycle management. Includes database schema migrations to support SAML replay protection.
Rules matchedGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-6v34-w48w-44rc
Addresses security vulnerabilities in SAML assertion handling, session race conditions, dashboard session verification, and multitenancy isolation. Requires additive database migrations for SAML replay defense.
Rules matchedGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-6v34-w48w-44rc+1 more
Patches several security issues involving SAML replay protection, tenant scoping for WebAuthn, API key permissions, dashboard session expiry, and session unlinking. Adds new tables and columns for SAML assertion tracking.
Rules matchedGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6GHSA-6v34-w48w-44rc+1 more
Implements security patches for SAML assertion replay, dashboard session verification, session race conditions, and tenant isolation. Adds database schema changes to track consumed assertions and ACS URLs.
Rules matchedGHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454cGHSA-w9fp-wv6g-pqv8GHSA-3r7x-rhvc-fw28+1 more
Applies security fixes across SAML handling, dashboard session expiry, session unlink serialization, and multitenant scoping. Includes additive database migrations for SAML assertion tracking.
Rules matchedGHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454cGHSA-3r7x-rhvc-fw28GHSA-wfg2-vqfg-rqh6+1 more
This release resolves multiple security issues, including app-scoped API key permission boundaries, dashboard session expiration enforcement, tenant-scoped WebAuthn sign-in, and a session race condition during account unlinking.
Rules matchedGHSA-w9fp-wv6g-pqv8GHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454c
This release fixes security vulnerabilities regarding app-scoped API key updates, dashboard session expiry enforcement, WebAuthn tenant scoping, and session creation race conditions during account unlinking.
Rules matchedGHSA-w9fp-wv6g-pqv8GHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454c
This release patches multiple security issues involving API key scoping, dashboard session expiry checks, WebAuthn tenant scoping, and session creation race conditions during account unlinking.
Rules matchedGHSA-w9fp-wv6g-pqv8GHSA-6v34-w48w-44rcGHSA-2pc4-vw9j-454c
This release prevents an app-scoped API key from modifying its parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
This release fixes a vulnerability that allowed app-scoped API keys to update their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
This release restricts app-scoped API keys from modifying their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
This release addresses a vulnerability by preventing app-scoped API keys from updating their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
This release blocks app-scoped API keys from updating their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
Fixes an issue where app-scoped API keys could update their parent connectionUriDomain.
Rules matchedGHSA-4rf2-xqvf-8rcx
This release resolves multiple authentication and session issues, including stale cookies persisting after session expiration or revocation, and password reset handling during session revocation failures. It also introduces features to manage and link OAuth clients and protected resources.
Rules matchedsecurity
This release fixes an open redirect vulnerability in createRouteUrl and resolves bugs related to cookie attribute preservation and token refresh error status codes.
Rules matchedGHSA-5vvp-h2v6-59j6Securityadvisories
Addresses numerous security vulnerabilities and CVEs across identity brokering, authentication, admin permissions, and third-party dependencies.
Rules matchedCVE-2026-15943CVE-2026-18569CVE-2026-82968CVE-2026-94001+8 more
Security release addressing security advisory GHSA-389g-gv7q-r4x8, along with several performance improvements and bug fixes.
Rules matchedGHSA-389g-gv7q-r4x8Securityadvisories
Updates dependencies to address CVEs and bumps the default CLI to 1.9.1. It also includes validation and configuration updates for internal callback namespace checks and conditional task garbage collection.
Rule flagged; AI judged routine — check the notes
Includes performance improvements for body decoding, header parsing, and child logger levels, alongside type and documentation updates. Also resolves an issue where HTTP QUERY requests threw errors on empty bodies.
Rules matchedsecuritymajor version bump: v5.12.7 → v6.0.0-alpha.5
Rule flagged; AI judged routine — check the notes
Adds new crypto features including crypto.parsePKCS12, a generic MAC API, and SIV cipher modes, alongside new utility functions for debouncing and throttling. It also introduces net.BoundSocket transfer support and performance histogram analysis additions.
Rules matchedsecurity
CVE-2026-2391CVE-2026-82417CVE-2026-82562CVE-2026-90711Keycloak 26.8.0 promotes Verifiable Credential Issuance (OID4VCI) to preview, introduces experimental OID4VP credential verification, and resolves several security vulnerabilities across components.
Rules matchedCVE-2026-12388CVE-2026-14781CVE-2026-19608CVE-2026-54515+5 more
Fixes a critical Magic Link account-takeover vulnerability (GHSA-965c-763c-88jm) and an issue where OAuth Proxy accepted sign-in state as a provider profile. Also adds optional OAuth redirect URI validation and fixes several adapter and header issues.
Rules matchedGHSA-965c-763c-88jmsecurityvulnerabilityadvisory+1 more
Keycloak 26.7.5 is a maintenance release that addresses multiple security fixes across OIDC, SAML, and token exchange, alongside bug fixes and an upgrade to Quarkus 3.33.4.
Rules matchedCVE-2026-16103CVE-2026-9798CVE-2026-18206CVE-2026-18203+8 more
Fixes a security vulnerability (GHSA-5r4p-p66f-jhc7) where `serveStatic` double-decoded request paths, potentially bypassing middleware. Request paths containing `%` after decoding are now rejected by default unless configured otherwise.
Rules matchedGHSA-5r4p-p66f-jhc7Security
This maintenance release applies security fixes and bumps Go to 1.26.8 for a security patch. It also includes matching performance improvements and a toggle for Nexus callback source header inspection.
Rules matchedsecurity
This patch release resolves CVEs and updates Go to 1.25.14 for a security patch. It also adds a Nexus callback header inspection toggle and matching performance improvements.
Rules matchedsecurity
This release provides a security fix and performance improvements when reading request parts and parsing content types. It also updates documentation and adds a sponsor.
Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisoriesmajor version bump: v5.12.5 → v6.0.0-alpha.4
This patch release addresses several CVE vulnerabilities including denial of service, privilege escalation, and account lockout issues. It also upgrades Quarkus to 3.33.3.2 and resolves several bug fixes.
Rules matchedCVE-2026-90997CVE-2026-79651CVE-2026-74909CVE-2026-19607+3 more
This release patches a security advisory and backports performance improvements for content-type parsing and request-part validation.
Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisories
Resolves security issues around inherited request configuration properties and ReDoS in proxy bypass hostname processing. Also breaks compatibility by disallowing Promises/functions/objects in header types and enabling CIDR ranges in NO_PROXY.
Rules matchedSecurityBreaking Change⚠️ Breaking
Temporal v1.32.0 promotes Standalone Activities to GA, introduces Standalone Nexus Operations pre-release, and enables the unified query converter by default with strict type validation. It also alters VisibilityRow Go types and callback URL behavior for security reasons.
Rules matchedsecuritybreaking change
Rule flagged; AI judged routine — check the notes
Hyperswitch v1.127.0 adds new features including GooglePay InternalGateway flow, stored card synchronization updates, blocklist scoping, and multiple connector enhancements.
Rules matchedinjection
Directs users to the external changelog for full release notes.
Directs users to the external changelog for full release notes.
Directs users to the external changelog for full release notes.
Adds client profiles, attack protection CAPTCHA policies, client grants search, and CIMD external metadata status and dynamic registration.
Patch release linking to the full diff comparison with no details provided in the release notes.
Adds a FedCM browser account chooser for Google sign-in and supports assigning client_credentials scopes during OAuth client registration. Also fixes relations v2 schema handling in the Drizzle adapter.
This patch resolves various bugs across Google One Tap sign-in, OAuth endpoint error responses, DPoP verification, and MongoDB pagination sorting. It also adds an optional self-service signing key rotation feature for private_key_jwt clients.
Fixes error handlers to complete before responses are sent, adds isContinuation to postLogin.shouldRedirect, and fixes DPoP validation behind proxies that rewrite request URLs.
Adds Fraud and Risk Management (FRM) framework flows, new connector integrations, blocklist profile cloning, and platform-level dispute endpoints. Also includes various connector fixes and process tracker improvements.
Updates the default CLI to 1.9.1 and bumps the klauspost/compress dependency to v1.18.7. It also includes internal callback namespace binding configuration and makes fair task garbage collection conditional on rangeid.
| 10d ago |
| 5.9d |
| ★ 36,080+77 since 12 Oct |
| getlago/lago | 6 | 11d ago | 12d | ★ 10,689+16 since 12 Oct |
| honojs/hono | 29 | 8d ago | 1.7d | ★ 32,586+88 since 12 Oct |
| juspay/hyperswitch | 3 | 2d ago | 34.9d | ★ 45,359+49 since 12 Oct |
| temporalio/temporal | 6 | 6d ago | 4.2d | ★ 23,812+183 since 12 Oct |