Dev Release Radar — August 15, 2026: Auth0 Reaches GA, Better Auth Patches an SSO Race Condition

Executive summary

• Auth0 shipped General Availability of its Flexible Password Policy on Aug 13, replacing the legacy rule set with NIST-aligned defaults for new Database connections.
• Better Auth closed an SSO domain-verification race condition in v1.6.29 / v1.7.0-rc.6 (Aug 14) that could surface as a spurious `SSO_PROVIDER_CHANGED` 409.
• NestJS, Fastify, and Hono all cut patch releases within a 48-hour window (Aug 13-14), independently closing SSE, header-handling, and CORS-init issues.
• Cloudflare lets Access protection follow a Worker across every domain and preview URL, and added an account-wide "private by default" switch for Workers.
• shadcn/ui reworked registry resolution in its CLI, and Railway shipped beta Access Groups for Enterprise project permissions.
• Smaller but notable: BullMQ v6.1.1, Podman v6.1.0, ElysiaJS 2.0 beta, and a brief Supabase JWT-validation incident, all covered below.

Identity & auth: Auth0 hits GA, Better Auth closes an SSO race

Auth0 — Flexible Password Policy (General Availability, Aug 13, 2026)

Auth0's Flexible Password Policy is now GA and is the default for newly created Database connections. It replaces the legacy character-class policy with a NIST 800-63B-aligned model: a 15-character minimum with no forced mix of uppercase, numbers, or symbols. Existing tenants keep their current policy until they opt in. One migration gotcha: the Management API's `PATCH /api/v2/connections/{id}` now rejects requests that mix old-policy and new-policy fields in the same payload, so update the whole `options.password_policy` object in one call rather than patching individual keys.

Better Auth — v1.6.29 and v1.7.0-rc.6 (Aug 14, 2026)

Both releases landed the same day. The headline fix closes a race condition in SSO domain verification that could throw a spurious `SSO_PROVIDER_CHANGED` 409 when two verification requests overlapped. Alongside it: `deleteSessions` is now parallelized for faster bulk revocation, a duplicate-session bug during React Suspense retries is fixed, and client-plugin TypeScript declarations are restored after a regression. Teams on the SSO plugin should upgrade promptly since the race condition is auth-path-adjacent.

npm install [email protected]
# or, to track the v1.7 pre-release line:
npm install [email protected]

Also this week: Authentik cut 2026.8.0-rc7 (Aug 10) with OAuth2 token-exchange and core-actor work, though stable 2026.8.0 hasn't shipped yet — current stable stays at 2026.5.6. No fresh advisories from Auth.js/NextAuth or Clerk in the last few days; Keycloak's 12-CVE 26.7.1 release (Aug 5) and Django's 6.1 security release were covered in earlier editions of this audit.

Backend frameworks: a synchronized patch wave

Three unrelated frameworks shipped patch releases within 48 hours of each other, a coincidence worth flagging for anyone auditing dependency bumps this sprint.

NestJS v11.2.0 / v11.2.1 (Aug 14, 2026)

v11.2.0 adds first-class support for the HTTP `QUERY` method and Server-Sent Events abort-signal handling, fixes lazy-module provider sharing and Fastify middleware-prefix bugs, and bumps the bundled Fastify adapter to v5.12.0. v11.2.1, shipped the same day, is a follow-up fix for an early-return SSE abort issue found in the first release. A v12 major is in progress on nestjs/nest#16391 but hasn't shipped.

Fastify v5.12.0 (Aug 13, 2026)

v5.12.0 adds `reply.mediaType()` as an explicit content-type setter, and fixes raw-response header handling plus `undefined`-response content-type resolution.

app.get('/report', async (req, reply) => {
  reply.mediaType('application/pdf')
  return pdfBuffer
})

A `v6.0.0-alpha.1` preview also landed the same day, dropping deprecated types/features and moving the minimum Node.js version and bundled `undici` up to v8.

Hono v4.13.2 (Aug 13, 2026)

v4.13.2 fixes the `secureHeaders` middleware so a disabled Permissions-Policy directive emits a standard empty `()` instead of an inconsistent value, patches a JSX async-children rendering bug, stabilizes ETag hashing across streamed chunks, and improves multi-cookie serialization plus CORS middleware init performance.

ElysiaJS 2.0 "DayDream" (beta.4, Aug 11, 2026)

Elysia 2.0 is a ground-up rewrite built around ahead-of-time compilation and a new static-analysis engine the team calls "Sucrose," claiming up to 14x faster cold start and roughly 3.8x faster type inference versus 1.4, with a package more than 50% smaller.

bun add [email protected]

Infrastructure & edge

Cloudflare Workers — Access-everywhere and private-by-default (Aug 14, 2026)

Per the Aug 14 changelog, Cloudflare Access can now be attached directly to a Worker so the same protection follows it across every custom domain and preview URL, instead of being configured per-hostname. Accounts can also flip a new toggle to make all Workers private by default, with per-Worker bypass exemptions for anything that genuinely needs to be public.

Railway — Access Groups and Agent Connectors (Aug 14, 2026)

Railway's changelog introduces beta Access Groups for group-based project permissions on Enterprise plans, staged-change review for template edits with Railway Agent assistance, and beta Agent Connectors for OAuth/MCP integration with Notion, Linear, and Sentry from inside agent chats.

Podman v6.1.0 (Aug 12, 2026)

v6.1.0 adds `podman volume rename`, `podman machine restart`, an `ImageVolume=` Quadlet key, IPv6 rootless port forwarding, and `--retry`/`--retry-delay` flags for `podman manifest push`.

podman volume rename old-name new-name
podman machine restart

A secondary source attributes a Quadlet file-truncation issue (tracked as CVE-2026-19730) to this release, but it isn't listed in Podman's own release notes — treat that attribution as unconfirmed pending an official advisory.

Elsewhere: Kubernetes v1.37.0-rc.0 (Aug 6) is previewing a Recreate strategy for StatefulSets and a stable ClusterTrustBundle ahead of the Aug 26 stable release; Docker Desktop 4.86.0 (Aug 10) patched CVE-2026-17106, a `docker container cp` destination-escape bug; and Vercel's platform added Encrypted Client Hello support for Vercel-DNS domains (Aug 14) alongside AI Gateway additions (GLM 5.2, Gemini 3.7 Flash).

UI, styling & data layer

shadcn/ui v4.18.0 (Aug 13, 2026)

The CLI changelog reworks how `add`, `search`, `view`, and `init` resolve registries — they can now merge registry sources from `package.json` and `components.json` without persisting extra entries — and fixes an `EACCES` crash when the CLI hits an unreadable directory.

npx shadcn@latest add button

Also shipping this week

Motion v13.1.0 (Aug 10) added multidimensional `Reorder` support with automatic axis detection and RTL support. BullMQ v6.1.1 (Aug 14) fixed parent options being dropped from the root parent in flow operations, following v6.1.0's move to make PostgreSQL-backend schema migrations explicit. Drizzle ORM published a `1.0.0-rc.5` build (Aug 12) on its road to a stable v1. On the frontend-framework side, Vue shipped `3.6.0-rc.4` (Aug 14) on its Vapor Mode track, SvelteKit pushed `3.0.0-next.23` (Aug 13) with breaking module-path changes for remote-function types, and Astro 7.2.2 (Aug 13) fixed stale content-collection component styles and intermittent `ImageNotFound` build errors.

Worth a note rather than a deep-dive: Supabase's status page logged a JWT-validation incident starting 02:23 UTC on Aug 14 — newly refreshed tokens were briefly rejected with HTTP 401 — with a fix rolling out by 07:53 UTC the same day; see the status page for the postmortem once published.

Checked, nothing new to report

For completeness: Node.js, Express, FastAPI, Tailwind CSS, Radix UI, Redis, RabbitMQ, Apache Kafka, ClickHouse, DuckDB, pgvector, Firebase, Kubernetes stable, AWS, Render, Clerk, Auth.js/NextAuth, and Temporal had no release, changelog entry, or advisory dated in the last few days as of this writing. PostgreSQL's 28-CVE patch release, the MongoDB security advisory, Next.js 16.3.1, and Django's 6.1 security release were all covered in this audit's earlier editions and aren't repeated here.