Aug 8-11 Dev Roundup: Keycloak, Django, BullMQ Fixes

August 11, 2026 - This audit tracks verified releases across the modern web and infrastructure stack for the August 8-11 window, following last week's roundup through August 7. Two security releases lead the week: Keycloak 26.7.1 patches 12 CVEs, and Django's 6.0.8/5.2.17 releases close four, including an admin-panel XSS. BullMQ shipped two dependency-security patches back to back on August 10. Every item below is sourced from an official changelog, GitHub release tag, or vendor security bulletin; items still in pre-release or dev-build status are flagged as such.

Executive Summary

• Keycloak 26.7.1 (Aug 5) - security release patching 12 CVEs, including a JWE request-object signature-bypass and a hardcoded role-mapper privilege escalation.
• Django 6.0.8 and 5.2.17 (Aug 4) - 4 CVEs fixed, including a GDALRaster server-side file-write bypass and an admin URLField XSS.
• BullMQ 6.0.10 and 6.0.11 (Aug 10) - two same-day dependency-security patches; 6.0.10 also makes ioredis optional for the Postgres queue backend.
• Docker Desktop 4.86.0 (Aug 10) - ships a three-tier risk-labeling safety system for the Gordon AI agent, alongside Docker Engine 29.7.2 and Compose v5.4.0.
• Node.js 26.7.0 (Aug 5) - adds Perfetto tracing support and STORE-based private-key loading; NestJS 11.1.29 (Aug 10) fixes SSE retry-field serialization and a stateful middleware regex bug.
• Vercel Sandbox now runs on versioned Managed Images (Aug 10), switching its default OS from Amazon Linux to Ubuntu 26.04.
• Pre-release iteration continues on Vue 3.6.0-rc.3 and SvelteKit 3.0.0-next.18 (Aug 10-11), and Authentik 2026.8.0-rc7 (Aug 10, release candidate, not yet GA).

Identity & Authentication

Keycloak 26.7.1 - 12-CVE Security Release

Keycloak 26.7.1 landed August 5 as a dedicated security release. Confirmed CVEs include CVE-2026-9793 (a JWE-encrypted request object can bypass signature-algorithm enforcement) and CVE-2026-4629 (privilege escalation via hardcoded role-mapper injection), alongside ten further advisories: CVE-2026-14209, 14614, 14615, 15572, 15573, 16071, 16100, 16102, 16442, 16443. See the official release notes and the GitHub release tag for the full advisory list. A companion Client Libraries 26.0.12 update shipped the same day. Teams running self-hosted Keycloak should prioritize this patch.

Authentik, Clerk & Better Auth

• Authentik 2026.8.0-rc7 (Aug 10) is a release candidate adding OAuth2 token-exchange delegation work; the latest stable build remains 2026.5.6 (Jul 22) - do not treat the rc as production-ready.
• Clerk shipped percentage/fixed-amount Billing discounts and redeemable promo codes on Aug 10, following beta Client ID Metadata Documents for OAuth clients (Aug 6) and Google Workspace Directory Sync (Aug 5).
• Better Auth v1.6.26 (Aug 4) fixes session cleanup on user deletion, an email-OTP flow that leaked whether an address was already registered, a JWT-minting deadlock on SQLite, and switches Redis storage from KEYS to SCAN.

Containers, Edge & Cloud Infrastructure

Docker: Desktop, Engine & Compose

Docker Desktop 4.86.0 (Aug 10) introduces a three-mode risk-tier safety system for the Gordon AI agent and fixes container stop-timeout/restart-policy handling during engine shutdown. Docker Engine 29.7.2 (Aug 5) fixes a service-command panic and an image-pull regression affecting hardlinks/file permissions, and bumps BuildKit to v0.32.2. Docker Compose v5.4.0 (Aug 3) adds a reconciliation workflow that avoids unnecessary volume/network recreation.

Cloudflare & Vercel

• Cloudflare One Client for Windows v2026.6.905.0 (Aug 10) fixes reconnection after sleep/wake.
• Cloudflare added a Live Logs tab for Tunnel in the core dashboard (Aug 10), with multi-connector aggregation and level/event/method filtering.
• Vercel Sandbox (Aug 10) moved to versioned, open-source Managed Images (Sandbox SDK v3), replacing deprecated runtimes and switching the default OS from Amazon Linux to Ubuntu 26.04, with digest-pinning for immutability.

Kubernetes, AWS, Railway & Render

• Kubernetes v1.37.0-rc.0 (Aug 6) is the first release candidate ahead of a stable v1.37.0 targeted for Aug 26.
• AWS's weekly roundup (Aug 10) covers Lambda network bandwidth up to 3,000 Mbps (Aug 5), Bedrock AgentCore runtime instances reaching GA (Aug 6), and the open-sourced "Dogwood" Cedar-based policy language for AI agent governance (Aug 6).
• Railway Changelog #0302 (Aug 7) adds a Cloud Agents beta, automatic Postgres patching on CVE disclosure, and an Android app.
• Render cut median service build time by 40% (Aug 7) across all runtimes via faster CPU/disk build nodes.

Meta-Frameworks & UI Systems

Next.js, Vue & SvelteKit

Next.js continued canary iteration with v16.3.1-canary.11 and canary.10 (both Aug 10), covering cache-item encoding and a Turbopack fix for cross-referenced constants; React core itself has no release newer than 19.2.8 (Jul 21). Vue core v3.6.0-rc.3 (Aug 11) is a release candidate for Vue 3.6/Vapor Mode with hydration and Teleport-cleanup fixes. SvelteKit 3.0.0-next.18 (Aug 10) is a breaking change that splits adapter Vite plugins into pre and post phases; next.17 (also Aug 10) changed cross-page form-action navigation and added a snapshot helper.

shadcn/ui, MUI & Motion

• shadcn/ui shipped a new Questionnaire component for multi-step question flows, available across Base UI, React Aria, and Radix in all eight styles.
• Material UI v9.3.1 (Aug 6) fixed exit transitions getting stuck and shipped codemod transforms in @mui/codemod.
• Motion 13.0.0 (Aug 5) dropped the optional @emotion/is-prop-valid dependency in favor of an explicit <MotionConfig isValidProp> prop, and fixed an AnimatePresence/propagate node-removal bug.

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS v11.1.29 (Aug 10) fixes SSE retry-field serialization for a zero value, adds SSE comment support, removes the stateful g flag from middleware overlap regexes, and adds an override-mimetype option to the file-type validator. Node.js v26.7.0 (Aug 5, Current) adds Perfetto performance-tracing support, Symbol.dispose in ModuleHooks, and a --test-coverage-include-all test-runner flag. Node's most recent security release remains July 29 (an incomplete fix for CVE-2026-48934 in HTTPS Agent TLS session reuse) - nothing new on the security side this window.

Django Security Releases

Django shipped 6.0.8 and 5.2.17 on Aug 4, fixing four CVEs: CVE-2026-15307 (High - spatial lookups accepted str/dict values passed to GDALRaster, enabling server-side file-write/request forgery), CVE-2026-15920 (Moderate - stored XSS via URLField values rendered unvalidated in admin display_for_field), CVE-2026-15830 (Moderate - DoS via deeply nested GEOMETRYCOLLECTION WKT, now capped at 198 levels), and CVE-2026-15337 (Low - DoS via oversized language codes in check_for_language()).

Laravel 13.24

Laravel's rolling 13.x release notes list version 13.24 (Aug 5) adding dominant-color detection and HEIC support to the image API, a modelKeys() query-builder method, and an array_keys validation rule. Laravel doesn't publish a separate per-tag changelog, so treat the exact date as sourced from the rolling notes rather than a dedicated release page.

Databases, ORMs & Background Jobs

BullMQ Security Patches

BullMQ v6.0.10 (Aug 10, 12:01 UTC) and v6.0.11 (Aug 10, 21:29 UTC) shipped back to back with dependency security patches; v6.0.10 additionally makes ioredis optional so the Postgres queue backend no longer pulls in its internals.

Prisma, Supabase, Firebase & Temporal

• Prisma's v8 line is iterating through nightly dev builds past rc.1 - v8.0.0-rc.1-dev.13 (Aug 10) touches integer representations and aggregate precision; these are unreleased dev builds, not a formal version bump.
• Supabase's Developer Update for August 2026 (Aug 7) covers Pipelines public alpha, ChatGPT sign-in beta, Unified Logs, Grafana Cloud integration, and CipherStash encryption.
• Firebase CLI v15.26.0 (Aug 5) adds AI-agent auto-detection for non-interactive mode, a two-phase login flow, and a crashlytics:onboard:web command.
• Temporal's changelog shows Projects for Temporal Cloud reaching GA (Aug 7) and Serverless Workers for GCP Cloud Run entering pre-release (Aug 6).

No Notable Changes This Window

Verified as unchanged in the Aug 8-11 window, with no new official release found: React core, Nuxt, Svelte core, Astro, Radix UI Primitives, Tailwind CSS, Fastify, Express, ElysiaJS, Hono, FastAPI, Auth0, Auth.js/NextAuth, Podman, PostgreSQL, pgvector, Redis, MongoDB, ClickHouse, DuckDB, Drizzle ORM, RabbitMQ, and Apache Kafka. Their most recent confirmed releases predate this window and were covered in prior audits or remain unchanged.