← All digests#7 · 11 Oct 2026, 10:06 pm IST · cron · success · email sent
Security first, then breaking changes. Within each, flags both the rules and the AI agree on come first, and flags only the rules raised (AI judged routine) are shown quietly at the end. Nothing is hidden: the AI can add a flag but never remove one.
Express v5.3.0 fixes header conflicts in res.send and updates dependencies including qs, proxy-addr, and body-parser to resolve multiple vulnerabilities. It also adds conditional revalidation for QUERY requests and updates content-type handling.
Dependencies first, then the tools we're evaluating. Sub-package and pre-release streams are tucked into collapsed lines, never removed.
Pre-release update directing users to the external changelog for release details.
Release cadence and momentum for the tools we're evaluating, as of the last run.
| Repo | Releases · 90 days | Last | Median gap | Stars |
|---|---|---|---|---|
| better-auth/better-auth | 23 | 10d ago | 1.2d | ★ 30,261no earlier snapshot yet |
| drizzle-team/drizzle-orm | 3 | 3d ago | 5.9d | ★ 35,998no earlier snapshot yet |
| getlago/lago |
Tracked repos with no release in the window.
All repos were checked.
Rules matchedCVE-2026-2391CVE-2026-82417CVE-2026-82562CVE-2026-90711+7 more
Pre-release update directing users to the external changelog for release details.
Pre-release update directing users to the external changelog for release details.
Adds agent skills and anonymous-session support to the package. Fixes enterprise login cookie handling and surfaces anonymous-session expiry errors.
Fixes a CI issue to prevent beta releases from deleting package.json and updates beta version numbering to start at .0.
Adds clients search and brute-force form submission mode in beta, and syncs API changes from version 7.3.0.
Updates defaultCliVersion to 1.9.1 and fixes SAA activity task validation routing. Includes fixes for scaler state clearing and task queue user data observation.
Fixes an issue where postgres-js did not use prepared queries when calling explicit .prepare(name).
Updates the hono peer dependency range to allow Hono v5 prereleases and keeps internal types private in the bundled type declarations.
Expands the hono peer dependency range to include Hono v5 prereleases and hides internal types in the bundled d.ts file.
Allows Hono v5 prereleases in the hono peer dependency range and ensures internal types are kept private in generated declaration files.
Allows Hono v5 prereleases in peer dependencies to resolve npm installation errors and hides internal types in the bundled d.ts file.
Updates peer dependency definitions to accept Hono v5 prereleases and restricts internal types from the bundled d.ts file.
Updates the hono peer dependency range to accept Hono v5 prereleases to prevent ERESOLVE errors. Also ensures internal types remain private in bundled type definitions.
Updates the hono peer dependency range to allow Hono v5 prereleases and avoid ERESOLVE install errors. Internal types are also kept private in the bundled type definitions.
Expands the hono peer dependency range to accept Hono v5 prereleases and resolves ERESOLVE errors. Additionally keeps internal types private within bundled type definitions.
Updates Docker build configuration, including increasing Node heap size, and enhances Docker CI timeouts and reporting.
| 4d ago |
| 12d |
| ★ 10,671no earlier snapshot yet |
| honojs/hono | 30 | 1d ago | 3.2d | ★ 32,482no earlier snapshot yet |
| juspay/hyperswitch | 2 | 13d ago | 34.9d | ★ 45,307no earlier snapshot yet |
| temporalio/temporal | 4 | 2d ago | 5.9d | ★ 23,606no earlier snapshot yet |