Daily Dev Stack Audit: Next.js Security Release Lands Tomorrow, BullMQ Breaks API

Executive Summary

• Next.js confirms its critical-severity security release lands tomorrow, August 26, 2026 (patched builds 16.3.3 and 15.5.24) — the second day of a countdown we flagged yesterday and repeat here since it is now imminent.
• BullMQ's v6.1.0 release removed several legacy APIs (Queue#client, Worker#blockingClient, the old repeatable-jobs methods) in favor of a new pluggable IQueueBackend abstraction — teams pinned to 6.0.x should review before upgrading.
• Astro shipped back-to-back patches (7.2.5 and 7.2.6) on August 24, fixing a dev-mode crash with optimized server dependencies alongside 24 smaller bug fixes.
• Vue 3.6 reached release candidate 5 with Vapor Mode nearing stable, while Authentik 2026.8.0 achieved official OpenID Certified™ status.
• Laravel shipped security hardening in v12.67.0 (timing-safe maintenance-mode bypass check, tightened validation rule bypass), and Railway's Config as Code path is being phased out — new projects must migrate off it by August 28.

Identity & Access Management

Authentik 2026.8.0 is now officially OpenID Certified™ across the OP Basic, Implicit, Hybrid, Config, and Form-Post profiles, plus RP-Initiated and front-/back-channel logout. The release also adds user-facing "Access Requests" for applications and entitlements, and new "Agent" service accounts that act on behalf of a parent user.

Clerk now lets developers define custom OAuth scopes (for example messages:read, tools:execute) in the dashboard, giving OAuth client applications finer-grained per-app permissions that are advertised via OAuth metadata for discovery.

Better Auth v1.7.1 fixes cold-start auth/transaction-context loss under concurrent requests, and tightens SSO organization auto-assignment to require both a verified provider domain and a verified stored user email — closing a path where a changed provider domain mid-request could join a user to the wrong organization.

Reminder: Keycloak 26.7.2 (covered in yesterday's audit) remains the version to be running if you haven't patched — it closed an unauthenticated account-takeover path in the reset-credentials flow (CVE-2026-18963, CVSS 9.1).

Meta-Frameworks & Web Standards

The Next.js security release pre-announced for tomorrow, August 26, ships patched builds 16.3.3 and 15.5.24. No CVE detail is public yet, but Vercel's advance notice and its critical-severity label make this worth scheduling a deploy window for now. In the meantime, Next.js 16.3.2 (August 21) backports fixes for app-entry export scope validation and Turbopack worker chunk loading.

Vue.js 3.6.0-rc.5 landed August 21, the latest release candidate for the 3.6 line introducing "Vapor Mode," a new SFC compilation mode aimed at cutting baseline bundle size and improving runtime performance without a virtual DOM.

SvelteKit pushed @sveltejs/[email protected] on the SvelteKit 3 preview track, adding an applyReroute helper for adapters that split serverless-function deployments, alongside matching adapter-vercel and adapter-netlify prereleases.

Astro 7.2.6 (August 24) fixes a dev-mode bug where new FetchState(request) could fail with optimized server dependencies enabled. It follows 7.2.5, released the same day, which bundled 24 patch fixes across font URLs, SSR request normalization, and companion Vercel/Netlify/MDX/Cloudflare adapter releases.

Containers, Edge & Infrastructure

Docker Desktop 4.88.0 (August 24) improves Docker VMM memory handling on Mac — hosts can now allocate more than 28GiB — and fixes an fsverity crash-reporting bug. It carries forward the fix for the docker cp destination-escape flaw already covered in this series.

Cloudflare shipped three changes this week: Wrangler and the Cloudflare API MCP server now support selectable OAuth scopes instead of all-or-nothing consent (Aug 22); the dashboard added self-serve Virtual Appliance downloads for VMware ESXi, Proxmox, and libvirt/KVM (Aug 24); and the Workers Vitest integration graduated to @cloudflare/vitest-plugin v1 (Aug 19).

Vercel expanded Sandbox to four regions (iad1, sfo1, cle1, cdg1) with per-project failover and raised Bun runtime limits to 5GB packages and 30-minute max duration (Aug 24); added vercel vcr commands for a new Container Registry interoperable with Docker, Podman, and Buildah (Aug 20); and opened a two-week, up-to-$1,000,000 HackerOne bounty specifically for escaping a Vercel Sandbox (Aug 18).

Kubernetes cut routine patch releases v1.36.4, v1.35.8, and v1.34.11 on August 20 across its three supported minor branches, with v1.37.0-rc.1 cut the same day ahead of the next minor GA.

AWS released Amazon Corretto critical security patch updates (Aug 18) across every supported OpenJDK LTS line — 26.0.2.11.1 down to 8u504 — and brought its new Las Vegas Local Zone to general availability with EC2 and EBS support (Aug 20).

Railway's changelog #0304 (Aug 20) adds Cloud Agents expansion, Edge Rules, and Redis HA — but the item to act on is that Config as Code is being phased out for a new IaC SDK, and new projects stop supporting it after August 28, 2026.

Backend Frameworks & Runtimes

NestJS v11.2.1 (Aug 14) patches an early-return SSE abort bug introduced in v11.2.0, which itself added RFC 10008 Query HTTP method support and fixed singleton provider sharing with lazy-loaded modules.

Laravel shipped security hardening in v12.67.0 (Aug 18): temporary upload URLs are now restricted to fetch-only from the request query string, the in validation rule was fixed against a loose-comparison bypass, and the maintenance-mode bypass secret now uses a timing-safe comparison. v13.26.0/13.26.1 shipped the same day on the 13.x line.

Django's 6.0.8 / 5.2.17 security release remains the one to be running: it closed four CVEs, including a High-severity server-side file-write/SSRF via spatial lookups accepting malicious geometry input (CVE-2026-15307) and an admin-panel XSS via unvalidated URLField rendering (CVE-2026-15920).

UI Systems, Styling & Motion

shadcn/ui's August changelog adds private GitHub registry support — installing components from private repos via GitHub CLI auth or a GH_TOKEN/GITHUB_TOKEN — plus a new multi-step Questionnaire component available across all eight supported styles.

Motion (Framer Motion) v13.1.1 (Aug 18) guards animation window access in non-browser runtimes and improves compatibility with React 19 strict mode in AnimatePresence. The prior v13.1.0 (Aug 10) added multidimensional Reorder with automatic axis detection and RTL support.

Databases, Caching & Background Jobs

BullMQ is the item most worth pausing on: v6.1.0 (Aug 12) introduced a pluggable IQueueBackend abstraction with Redis and Postgres backends, but removed the legacy Queue#client, Queue#redisVersion, Worker#blockingClient, and FlowProducer#client accessors along with the old repeatable-jobs API. v6.1.2 (Aug 16) followed with dependency security patches, and the release cadence continued through Python (v3.0.5) and Rust (v1.2.6) client updates on Aug 23 and 25.

// Before (BullMQ <= 6.0.x)
const redisClient = await queue.client;
const repeatable = await queue.getRepeatableJobs();

// After (BullMQ >= 6.1.0) — use the queue backend abstraction
// and the new repeatable-jobs scheduler API instead of the
// removed Queue#client / getRepeatableJobs() accessors.
const backend = queue.backend; // IQueueBackend (redis | postgres)
const schedulers = await queue.getJobSchedulers();

ClickHouse cut routine LTS/stable patch builds — 26.3.21.7-lts (Aug 22) and 26.7.5.10-stable / 25.8.32.4-lts (Aug 21) — with no breaking changes called out.

Supabase relocated read replica management in the dashboard (Aug 21): it now lives under Project Settings → Infrastructure, while Database → Replication is reserved for Pipelines destinations only.

RabbitMQ v4.3.5 (Aug 17) is a maintenance release across the core server, CLI tools, and the management, stream, OAuth2, shovel, and federation plugins — it now requires Erlang 27.0 or newer. It's also a good moment to confirm you're past the earlier CVE-2026-57219 (unauthenticated OAuth secret exposure, CVSS 8.7) if you're still running a pre-4.3 line.

PostgreSQL 18.6 / 17.11 / 16.15 / 15.19 / 14.24 (and 19 Beta 3) remain the versions to be on: the Aug 13 release closed 28 CVEs and requires a REINDEX on affected btree_gist and ltree indexes. PostgreSQL 14 reaches end-of-life on November 12, 2026.