Aug 7-10 Dev Roundup: Prisma v8, Next.js, Fastify, Hono

Executive Summary

• Prisma ORM shipped v8.0.0-rc.1 (Aug 7) — first release candidate for v8, with a breaking change to count() return types.
• Next.js 15.5.23 (Aug 7) patches a Flight/Server Component traversal guard; the 16.3.1 canary line continued shipping Turbopack fixes through Aug 8.
• Fastify v5.11.3 (Aug 8) and Hono v4.13.1 (Aug 7) both landed bug-fix releases touching request/response edge cases.
• BullMQ v6.0.9 (Aug 7) fixes a completed event bug that returned a raw serialized string instead of the deserialized job return value.
• Auth0 opened early access to Custom Token Exchange – Session Delegation (Aug 7), letting an authorized actor assume a user's session while preserving both identities via an act claim.
• Vercel and Cloudflare both shipped AI-infrastructure updates Aug 7–8: unified Workers AI/AI Gateway billing, Vercel Sandbox microVM support for agents, and public Container Registry repos.
• Railway added Cloud Agents (beta) and automatic Postgres CVE patching; Render cut median build times ~40% — both Aug 7.
• Supabase's self-hosted stack switches its default API gateway from Kong to Envoy the week of Aug 9 — a breaking change for self-hosters with custom TLS/kong.yml configs.
• Quiet in this window (Aug 7–10): Docker, Kubernetes, Podman, React, Vue, Nuxt, Svelte/Astro, Tailwind CSS, MUI, Radix UI, Motion, Keycloak, Authentik, Clerk, Django, Laravel, PostgreSQL, Redis, MongoDB, Drizzle ORM, RabbitMQ, Kafka, and Temporal had no dated release or advisory — closest activity for several of these landed Aug 3–6 and is called out below for context.

Containers, Edge & Infrastructure

Docker, Kubernetes and Podman had no dated release, changelog entry or advisory in the Aug 7–10 window. The nearest verifiable activity was Docker Compose v5.4.0 (Aug 3) and Docker Engine 29.7.2 (Aug 5) — both just outside the window.

Cloudflare: unified Workers AI billing

On Aug 7, Cloudflare merged Workers AI and AI Gateway onto a shared binding and REST API, so Workers AI inference can now be paid for out of AI Gateway prepaid credits while inheriting AI Gateway's observability, caching and security layer. The same day, Cloudflare also announced container-image support for Mesh nodes, with Compose, Kubernetes and OCI runtime compatibility.

Vercel: agents, registries and audit logs

Vercel shipped a cluster of updates across Aug 7–8: Grok Imagine Image 2.0 landed in the AI Gateway, Hermes Agent gained AI Gateway plus Vercel Sandbox microVM support, Container Registry repositories can now be made public for read-only pulls, and Audit Log Drains added Datadog, Splunk and Panther as Enterprise destinations.

AWS, Railway & Render

AWS added Amazon Cognito as a skill in its Agent Toolkit for AWS (Aug 7), letting AI coding agents scaffold user pools, OAuth2 flows and JWT authorizers directly. The same day, Railway introduced Cloud Agents (beta) and automatic Postgres CVE patching, while Render moved builds to faster nodes, cutting median build time from ~38s to ~21s.

Identity & Authentication (IAM)

Of six IAM projects tracked (Keycloak, Authentik, Clerk, Auth0, Better Auth, Auth.js), only Auth0 had a confirmed change in the window.

Auth0: Session Delegation early access

On Aug 7, Auth0 opened Open Early Access for Custom Token Exchange – Session Delegation, which lets an authorized actor — for example a support agent — establish a web session as another user while preserving both identities through a standards-based act claim and a full audit trail.

Keycloak (26.7.1, Aug 5), Better Auth (v1.6.26/v1.7.0-rc.4, Aug 4–5) and Clerk's OAuth Client ID Metadata Documents change (Aug 6) all landed just before the window and are worth watching next cycle. No new CVEs were confirmed for any IAM project in this window.

Meta-Frameworks & Core Web Standards

Next.js

Next.js 15.5.23 (Aug 7) ships a single targeted fix: porting ReplyServer traversal guards to FlightClient. On the canary line, 16.3.1-canary.9 (Aug 8) resolves a Turbopack deadlock in scope-and-block handling, alongside async-module re-export and tracing fixes.

SvelteKit

SvelteKit's pre-release channel stayed active toward its 3.0 line: @sveltejs/[email protected] (Aug 7) fixes route-resolution module generation, alongside same-day next-tagged updates to the package, enhanced-img, and adapter packages. The stable 2.x line had no release in this window.

React, Vue, Nuxt, Svelte (core) and Astro had no releases dated Aug 7–10 — their most recent tags all land Aug 3–6, just outside the window.

Backend Frameworks & Runtimes

Fastify v5.11.3

Released Aug 8, v5.11.3 fixes trailer-state clearing between requests, corrects requestCompleted to pass null instead of undefined, and resets regex lastIndex state in the content-type parser.

Hono v4.13.1

Released Aug 7, v4.13.1 fixes trie-router slash counting, re-acquires the stream writer lock correctly in pipe(), and stops the ETag middleware from caching unsafe methods or non-2xx responses:

import { Hono } from 'hono'
import { etag } from 'hono/etag'

const app = new Hono()
app.use('*', etag())

// v4.13.1: ETag middleware now skips unsafe HTTP methods
// (POST/PUT/PATCH/DELETE) and non-2xx responses, so error
// pages and mutations are no longer cached as if they were
// valid, cacheable GET responses.

Django shipped security releases 6.0.8 / 5.2.17 on Aug 4 (just outside the window) fixing four CVEs, including a high-severity SSRF/file-write issue via spatial lookups (CVE-2026-15307). Laravel's v13.24.0 and v12.65.0 (Aug 4–5) are similarly just prior to the window. NestJS, Node.js, Express, ElysiaJS and FastAPI had no activity Aug 7–10.

UI Systems, Styling & Motion

No release landed inside Aug 7–10 for shadcn/ui, Radix UI, Tailwind CSS, MUI or Motion. The closest real activity: [email protected] and MUI v9.3.1 both landed Aug 6, and Motion's major v13.0.0 release shipped Aug 5 — all one to two days ahead of this window.

Databases, ORMs & Background Jobs

Prisma ORM v8.0.0-rc.1

Released Aug 7, v8.0.0-rc.1 is the first release candidate for Prisma 8 and carries two breaking changes: aggregate results now decode via the declared codec, so count() returns bigint instead of number; and the SQL driver interface now splits into separate query() and execute() methods.

// Prisma 7.x
const total: number = await prisma.user.count()

// Prisma 8.0.0-rc.1 — breaking change
const total: bigint = await prisma.user.count()

BullMQ v6.0.9

Also Aug 7, BullMQ v6.0.9 fixes the completed event so returnvalue is passed as the deserialized value rather than a raw JSON string; the companion Rust bindings (vrs1.2.3) fix a worker delay in picking up new jobs.

queueEvents.on('completed', ({ jobId, returnvalue }) => {
  // v6.0.9: returnvalue is now the deserialized value,
  // not a raw JSON string you have to JSON.parse() yourself.
  console.log(jobId, returnvalue)
})

Supabase: self-hosted gateway cutover

Supabase's self-hosted stack switches its default API gateway from Kong to Envoy the week of Aug 9 — the service becomes api-gw and defaults to plain HTTP on port 8000, dropping Kong's built-in HTTPS listener. Self-hosters with custom TLS or a customized kong.yml need to adjust before the cutover; hosted Supabase Cloud projects are unaffected.

PostgreSQL, pgvector, Redis, MongoDB, ClickHouse, DuckDB, Drizzle ORM, RabbitMQ, Apache Kafka and Temporal had no dated release or advisory in this window.

Methodology

This roundup covers Aug 7–10, 2026 and lists only releases, changelog entries and advisories confirmed directly against each project's official GitHub releases page, changelog, or security-advisory feed. Categories with no dated activity in the window are reported as quiet rather than padded with older or speculative items; nearby pre-window releases are called out explicitly with their real dates for context.