← All digests#9 · 11 Oct 2026, 10:52 pm IST · manual · success · email –
4 Oct – 11 Oct · IST · last 7 days
22 repos checked · 22 releases · 274 lines of notes
1 security 4 breaking+ 18 still open from earlier weeks
Security first, then breaking changes. Within each, flags both the rules and the AI agree on come first, and flags only the rules raised (AI judged routine) are shown quietly at the end. Nothing is hidden: the AI can add a flag but never remove one.
Express v5.3.0 fixes header conflicts in res.send and updates dependencies including qs, proxy-addr, and body-parser to resolve multiple vulnerabilities. It also adds conditional revalidation for QUERY requests and updates content-type handling.
Flagged in an earlier digest and not yet marked as reviewed, so an unread security fix can't quietly age out. Marked ones leave this list the next time the page loads.
Keycloak 26.8.0 promotes Verifiable Credential Issuance (OID4VCI) to preview, introduces experimental OID4VP credential verification, and resolves several security vulnerabilities across components.
Rules matchedCVE-2026-12388
Dependencies first, then the tools we're evaluating. Sub-package and pre-release streams are tucked into collapsed lines, never removed.
Pre-release update directing users to the external changelog for release details.
Release cadence and momentum for the tools we're evaluating, as of the last run.
| Repo | Releases · 90 days | Last | Median gap | Stars |
|---|---|---|---|---|
| better-auth/better-auth | 23 | 10d ago | 1.2d | ★ 30,262no earlier snapshot yet |
| drizzle-team/drizzle-orm | 3 | 3d ago | 5.9d | ★ 35,998no earlier snapshot yet |
| getlago/lago |
Tracked repos with no release in the window.
All repos were checked.
Rules matchedCVE-2026-2391CVE-2026-82417CVE-2026-82562CVE-2026-90711+7 more
CVE-2026-14781CVE-2026-19608CVE-2026-54515Fixes a critical Magic Link account-takeover vulnerability (GHSA-965c-763c-88jm) and an issue where OAuth Proxy accepted sign-in state as a provider profile. Also adds optional OAuth redirect URI validation and fixes several adapter and header issues.
Rules matchedGHSA-965c-763c-88jmsecurityvulnerabilityadvisory+1 more
Keycloak 26.7.5 is a maintenance release that addresses multiple security fixes across OIDC, SAML, and token exchange, alongside bug fixes and an upgrade to Quarkus 3.33.4.
Rules matchedCVE-2026-16103CVE-2026-9798CVE-2026-18206CVE-2026-18203+8 more
Fixes a security vulnerability (GHSA-5r4p-p66f-jhc7) where `serveStatic` double-decoded request paths, potentially bypassing middleware. Request paths containing `%` after decoding are now rejected by default unless configured otherwise.
Rules matchedGHSA-5r4p-p66f-jhc7Security
This maintenance release applies security fixes and bumps Go to 1.26.8 for a security patch. It also includes matching performance improvements and a toggle for Nexus callback source header inspection.
Rules matchedsecurity
This patch release resolves CVEs and updates Go to 1.25.14 for a security patch. It also adds a Nexus callback header inspection toggle and matching performance improvements.
Rules matchedsecurity
This release provides a security fix and performance improvements when reading request parts and parsing content types. It also updates documentation and adds a sponsor.
Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisoriesmajor version bump: v5.12.5 → v6.0.0-alpha.4
This patch release addresses several CVE vulnerabilities including denial of service, privilege escalation, and account lockout issues. It also upgrades Quarkus to 3.33.3.2 and resolves several bug fixes.
Rules matchedCVE-2026-90997CVE-2026-79651CVE-2026-74909CVE-2026-19607+3 more
This release patches a security advisory and backports performance improvements for content-type parsing and request-part validation.
Rules matchedGHSA-4mh8-r7rc-xpvcSecurityadvisories
Resolves security issues around inherited request configuration properties and ReDoS in proxy bypass hostname processing. Also breaks compatibility by disallowing Promises/functions/objects in header types and enabling CIDR ranges in NO_PROXY.
Rules matchedSecurityBreaking Change⚠️ Breaking
Temporal v1.32.0 promotes Standalone Activities to GA, introduces Standalone Nexus Operations pre-release, and enables the unified query converter by default with strict type validation. It also alters VisibilityRow Go types and callback URL behavior for security reasons.
Rules matchedsecuritybreaking change
Rule flagged; AI judged routine — check the notes
Hyperswitch v1.127.0 adds new features including GooglePay InternalGateway flow, stored card synchronization updates, blocklist scoping, and multiple connector enhancements.
Rules matchedinjection
Pre-release update directing users to the external changelog for release details.
Pre-release update directing users to the external changelog for release details.
Adds agent skills and anonymous-session support to the package. Fixes enterprise login cookie handling and surfaces anonymous-session expiry errors.
Fixes a CI issue to prevent beta releases from deleting package.json and updates beta version numbering to start at .0.
Adds clients search and brute-force form submission mode in beta, and syncs API changes from version 7.3.0.
Updates defaultCliVersion to 1.9.1 and fixes SAA activity task validation routing. Includes fixes for scaler state clearing and task queue user data observation.
Fixes an issue where postgres-js did not use prepared queries when calling explicit .prepare(name).
Updates the hono peer dependency range to allow Hono v5 prereleases and keeps internal types private in the bundled type declarations.
Expands the hono peer dependency range to include Hono v5 prereleases and hides internal types in the bundled d.ts file.
Allows Hono v5 prereleases in the hono peer dependency range and ensures internal types are kept private in generated declaration files.
Allows Hono v5 prereleases in peer dependencies to resolve npm installation errors and hides internal types in the bundled d.ts file.
Updates peer dependency definitions to accept Hono v5 prereleases and restricts internal types from the bundled d.ts file.
Updates the hono peer dependency range to accept Hono v5 prereleases to prevent ERESOLVE errors. Also ensures internal types remain private in bundled type definitions.
Updates the hono peer dependency range to allow Hono v5 prereleases and avoid ERESOLVE install errors. Internal types are also kept private in the bundled type definitions.
Expands the hono peer dependency range to accept Hono v5 prereleases and resolves ERESOLVE errors. Additionally keeps internal types private within bundled type definitions.
Includes Docker build adjustments, such as increasing the Node heap size for the single-image front build, and several CI workflow improvements.
| 4d ago |
| 12d |
| ★ 10,671no earlier snapshot yet |
| honojs/hono | 30 | 1d ago | 3.2d | ★ 32,482no earlier snapshot yet |
| juspay/hyperswitch | 2 | 13d ago | 34.9d | ★ 45,308no earlier snapshot yet |
| temporalio/temporal | 4 | 2d ago | 5.9d | ★ 23,606no earlier snapshot yet |