Daily Stack Watch: NestJS 12 Ships With ESM Support, Hono Patches a DoS Bug, and Astro, ClickHouse, and Prisma All Release Updates

Executive Summary

• NestJS 12.0.0 lands as a major release: ESM-ready packages, Standard Schema validation/serialization, a rebuilt CLI, and a new @nestjs/observe SDK.
• Hono v4.13.5 fixes an unbounded dot-notation nesting bug in parseBody() that could exhaust memory, plus a query-parser and toSSG() path bug.
• Astro 7.2.9 ships SSR and MDX fixes; separately, its tooling pulls in a fix for CVE-2026-33532, a stack-overflow DoS in the yaml npm package.
• ClickHouse cuts two new LTS patch releases (26.3.25.2 and 26.3.24.4); Prisma Compute reaches General Availability with a 1M-request free tier.
• BullMQ pushes a rapid-fire patch wave across its Node, Python, and Elixir bindings; Cloudflare raises Durable Objects' Dynamic Workers concurrency limit from 4 to 10.
• MUI 9.4.0, shadcn/ui's August changelog, Clerk's configurable reverification window, and Svelte 5.57.0 round out the UI and auth updates.
• AWS Cognito adds an admin MFA-reset API, and Supabase finishes rolling out a PostgREST 14.5 fix for elevated data-API latency.

NestJS 12.0.0 Ships With ESM Support and a Rebuilt CLI

NestJS crossed into version 12 on August 27, its first major bump in a while. The headline changes are ESM-ready core packages, built-in Standard Schema support for validation and serialization (so libraries like Zod, Valibot, and ArkType work without adapter glue), a rebuilt CLI, and a new @nestjs/observe SDK for runtime instrumentation. The release requires Node 20.19+ or 22.12+.

npm install @nestjs/core@12 @nestjs/common@12 @nestjs/platform-express@12
npx @nestjs/cli@latest update

Full changelog and migration notes are on the NestJS GitHub Releases page.

Hono v4.13.5 Patches a parseBody() Memory-Exhaustion Bug

Hono's v4.13.5 patch (Aug 26) closes three issues: the query parser could read parameters that appeared after a URL fragment, an earlier toSSG() path-normalization fix was incomplete, and — the one worth prioritizing — parseBody() allowed unbounded dot-notation key nesting in form data, letting a crafted request build an arbitrarily deep object and exhaust memory.

npm install [email protected]
# or
bun add [email protected]

Anyone accepting untrusted multipart or urlencoded bodies through parseBody() should update now. Details: Hono GitHub Releases.

ElysiaJS Moves 1.4.x to Maintenance-Only Mode

ElysiaJS v1.4.30 (Aug 26) is a security-only patch. The maintainers have confirmed 1.4.x is now maintenance mode — future features land only in the upcoming Elysia 2 line, so teams on 1.4 should plan a migration path rather than waiting for new capabilities to backport. See the release notes for the exact fix list.

Astro 7.2.9 Fixes SSR Bugs — Plus a yaml Dependency DoS to Patch

Astro 7.2.9 (Aug 27) fixes .html import typing outside .astro files, a crash when serving /index.html against a dynamic [slug].astro route, SSR manifest issues, and set:text escaping inside MDX. Separately — and unrelated to that patch — Astro's language-server tooling pulls in the yaml npm package, which carries CVE-2026-33532 (GHSA-48c2-rrv3-qjmp): a stack-overflow denial-of-service triggered by deeply nested YAML documents.

{
  "overrides": {
    "yaml": "^2.7.1"
  }
}

Pin or override the yaml dependency in any project bundling untrusted YAML parsing. Sources: Astro releases and GHSA-48c2-rrv3-qjmp.

ClickHouse Ships Two New LTS Patch Releases

ClickHouse cut v26.3.24.4-lts on Aug 27 and v26.3.25.2-lts on Aug 28, continuing its 26.3 LTS patch line. Full diffs are in the ClickHouse GitHub Releases.

Prisma Compute Reaches General Availability

Prisma Compute — Prisma's managed database-adjacent compute layer — went GA on Aug 28 with published pricing and a free tier covering 1 million monthly requests, making it easier to trial before committing spend.

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}

generator client {
  provider = "prisma-client-js"
}

Pricing and setup details are in the Prisma changelog.

BullMQ's Rapid Patch Wave Across Node, Python, and Elixir

BullMQ cut a cluster of patch releases between Aug 27 and 29: v6.3.1/v6.3.2 and v5.81.4 for the Node core, vpy3.1.0 (adding DelayedError and Job.moveToDelayed) and vpy3.1.1 for the Python port, and vex2.2.1/vex2.2.2 fixing PostgreSQL path resolution on the Elixir binding. See the BullMQ releases page for the full list.

Cloudflare Raises Durable Objects' Dynamic Workers Concurrency Limit

As of Aug 28, a single Durable Object can now run up to 10 concurrent in-flight Dynamic Workers, up from 4 (ordinary Workers remain capped at 4). Details in the Durable Objects changelog.

Vercel Ships Deployment Filters, a Cursor AI SDK Harness, and New CLI Commands

Vercel redesigned its Deployments-page filters with typeahead and natural-language queries (Aug 27), added Cursor to the AI SDK harness layer via @ai-sdk/harness-cursor (Aug 27), and extended the Vercel CLI with new DNS, domain, and project commands (Aug 28). Full entries in the Vercel changelog.

MUI 9.4.0 Improves Keyboard Focus and Tooltip Accessibility

Material UI's v9.4.0 (Aug 28) adds a theme.focusVisible token for a consistent keyboard focus ring across components, and improves Tooltip so it works on disabled button triggers without needing a wrapper element.

import { createTheme } from '@mui/material/styles';

const theme = createTheme({
  focusVisible: {
    outline: '2px solid',
    outlineColor: 'var(--mui-palette-primary-main)',
    outlineOffset: 2,
  },
});

Full release notes: MUI GitHub Releases.

shadcn/ui's August Changelog: a Questionnaire Component and Private Registries

This month's shadcn/ui changelog adds a Questionnaire component for multi-step flows (built on Base UI, React Aria, and Radix), support for installing from private GitHub registries, a Toast component for Base UI, and server-side registry search. See the shadcn/ui changelog.

Clerk Adds a Configurable Reverification Window

Clerk shipped a configurable reverification window on Aug 28: teams can now set how long step-up auth stays valid (1–10 minutes, default 10) before sensitive actions force re-verification, instead of relying on a fixed timeout. Details: Clerk changelog.

Svelte 5.57.0 Adds New Server-Side Exports

Svelte 5.57.0 (Aug 28) exports RenderOutput, Csp, and Sha256Source from svelte/server, adds a has() helper to createContext, and fixes several SSR and transition edge cases. See the Svelte releases page.

Platform Notes: AWS Cognito and Supabase

AWS Cognito added AdminDeleteSoftwareToken (Aug 27), letting admins reset a user's TOTP MFA configuration without deleting and recreating the account — see the AWS What's New post. Separately, Supabase finished rolling out a PostgREST 14.5 update (Aug 28 12:00 UTC through Aug 29 01:25 UTC) that fixed elevated latency and errors on the Data API across all regions; status history is on the Supabase status page.

Also Watched Today — No Notable Changes

Checked and found nothing dated August 27–29 worth flagging: Docker (Engine/Compose/Desktop), Kubernetes (no patch beyond the already-known 1.37.0), Podman, Railway, Render, Keycloak, Authentik, Auth0, Auth.js/NextAuth, Better Auth (only a routine v1.7.2 patch), Next.js stable (only canary builds), React, Nuxt, Vue.js, SvelteKit, Node.js, Fastify, Express, FastAPI, Django, Laravel, Radix UI, Tailwind CSS, Motion, PostgreSQL, PgVector, Redis, MongoDB, DuckDB, Drizzle ORM, Firebase, RabbitMQ, and Apache Kafka. They stay on the watch list for tomorrow's audit.