Dev Release Radar — August 4, 2026: Redis Patches an Actively-Exploited RCE Chain

Redis dominates this cycle. A coordinated set of emergency releases closed five CVEs — three of them remote-code-execution bugs with public proof-of-concept exploits already circulating — across every supported Redis line back to 6.2. Alongside that, Next.js 16.3.0 patched a lodash prototype-pollution flaw, Nuxt 4.5.1 shipped fixes for a critical unauthenticated RCE in DevTools plus four more advisories, and Docker Engine 29.7.1 closed a path-traversal issue in image pulling. Outside security, BullMQ shipped a breaking v6.0.0 with pluggable queue backends, Better Auth's 1.7 release candidate changes how Microsoft accounts are identified, and Cloudflare, Vercel, and Auth0 all pushed meaningful platform features. Here is everything that shipped across the stack between roughly July 27 and August 4, 2026.

Executive Summary

• Redis 8.10.0 plus emergency point releases (8.8.1, 8.6.5, 8.4.5, 8.2.8, 7.4.10, 7.2.15, 6.2.23) patch CVE-2026-25243, CVE-2026-25589, and CVE-2026-23479 — all RCE-capable — after public exploit PoCs surfaced. Patch immediately if you run any Redis 6.2–8.8 build.
• Next.js 16.3.0 fixes CVE-2025-13465, a lodash prototype-pollution bug reachable through _.unset/_.omit that could delete Object.prototype methods.
• Nuxt 4.5.1 (with a 3.21.10 backport) closes five advisories including a critical unauthenticated RCE via server-island props — teams on cache/swr/isr route rules must purge CDN caches after upgrading.
• Docker Engine 29.7.1 fixes daemon panics on network cleanup and swarm ingress-port removal, plus an image-pulling path-traversal bug; Docker Compose v5.4.0 reworks how volumes and networks are reconciled.
• BullMQ v6.0.0 is a breaking release built around a new pluggable IQueueBackend abstraction (Redis and Postgres backends), removing Queue#client and the legacy repeatable-jobs API.
• Better Auth 1.7.0-rc.3 changes how Microsoft accounts are identified (sub → oid) and adds new database indexes — plan for a required migration before GA.
• Cloudflare opened a preview of an open-source agent runtime (@cloudflare/computer) that dynamically orchestrates between V8 isolates and full Linux containers; Vercel shipped WAF for Blob (GA) and 100-team Container Registry sharing.

Security-Critical Patches

Redis — emergency fixes for an actively-exploited RCE chain

Redis shipped its most severe security round of the year on July 23, cutting emergency releases across every supported line — 8.8.1, 8.6.5, 8.4.5, 8.2.8, 7.4.10, 7.2.15, and even 6.2.23 — after public proof-of-concept exploits began circulating. The headline bugs are CVE-2026-25243 and CVE-2026-25589 (invalid memory access via RESTORE, including RedisBloom/TDigest payloads, both leading to RCE), and CVE-2026-23479 (a use-after-free in the unblock-client flow, also RCE). Two more — CVE-2026-25588 and CVE-2026-23631 (a Lua use-after-free, CVSS 6.1) — round out the batch. Redis 8.10.0 landed six days later as the next general-availability release, adding compact hash encoding, new commands (LMOVEM, BLMOVEM, SUNIONCARD), and roughly 60 additional bug fixes, including ACL bypasses in SORT and XREAD.

# Check your running version, then upgrade in place
redis-server --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade redis-server

# Docker
docker pull redis:8.10.0
docker compose up -d redis

Full advisory: Redis Security Advisory — CVE-2026-23479, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589, CVE-2026-23631 · Release history: redis/redis releases.

Next.js 16.3.0 — lodash prototype-pollution fix

Next.js v16.3.0 bumps its vendored lodash to first 4.17.23 and then 4.18.1, closing CVE-2025-13465 — a prototype-pollution bug in _.unset and _.omit that could be abused to delete methods off Object.prototype. The same release ships Turbopack HMR and build-cache improvements, continues stabilizing Cache Components, and fixes several RSC route-handling edge cases.

Nuxt 4.5.1 — critical DevTools RCE plus four more advisories

Nuxt's 4.5.1 release (backported to 3.21.10) closes five security advisories at once, the worst being an unauthenticated remote-code-execution and unauthorized-component-instantiation pair reachable through server-island props (GHSA-9473-5f9j-94wq, GHSA-48hr-524c-v5w3). It also fixes a route-rule authorization-bypass regression, a server-component denial-of-service bug, and cross-user disclosure of cached payloads. If you use cache, swr, or isr route rules, purge your CDN cache after upgrading — cached responses from before the patch may leak between users.

npx nuxt upgrade --dedupe

Advisories: nuxt/nuxt security advisories.

Docker Engine 29.7.1 and Prisma 7.9.1 — smaller but worth a patch cycle

Docker Engine 29.7.1 fixes a daemon panic on network-interface cleanup failure during container disconnect, a panic when removing swarm ingress ports after a failed proxy-listener bind, unhonored daemon-wide concurrent pull/push limits on the containerd image store, and a path-traversal issue during image pulling. Separately, Prisma 7.9.1 patched a security advisory in a transitive dependency of @prisma/dev — Prisma says it doesn't actually affect the dev package or CLI, but recommends upgrading anyway so security scanners stop flagging it.

Containers, Edge & Infrastructure

Docker Compose v5.4.0 reworks resource reconciliation

Docker Compose v5.4.0 introduces a new reconciliation model for resources like volumes and networks, replacing the old apply-then-diff approach with cleaner recreation logic and more predictable network lifecycle handling.

Cloudflare — agent runtime preview, Access cross-domain cookies, RPC interop

Cloudflare's changelog logged three notable entries on August 3: Access now lets admins control whether self-hosted, multi-hostname apps set authorization cookies across domains (on by default for new apps); an open-source @cloudflare/computer agent runtime entered preview, dynamically orchestrating between V8 isolates and full Linux containers with a SQLite-backed filesystem; and Python and JavaScript Workers gained RPC interoperability through Service bindings without extra serialization code.

Vercel — WAF for Blob GA, shared Container Registry, AI Gateway

Vercel's changelog shows Vercel WAF for Blob reaching general availability (custom WAF rules on Blob stores, all plans), the Vercel Container Registry gaining support for sharing a single repository across up to 100 teams, AI Gateway adding Qwen 3.8 Max access, and the "eve" agent gaining browser-navigation capability.

Podman 6.1.0-RC1

The first release candidate for Podman 6.1 (v6.1.0-RC1) adds podman volume rename, podman machine restart, and retry options for podman manifest push. It's a release candidate, not GA — the current stable line remains v6.0.2.

Identity & Authentication

Authentik races through 2026.8.0 release candidates

Authentik cut five release candidates for the upcoming 2026.8.0 line within hours of each other on August 3 (rc2 through rc6). rc6 fixes intermittently failing throttling tests and a Sentry-release access issue; earlier candidates addressed documentation, metadata parsing, and SCIM provider bugs. Not yet GA.

Better Auth 1.7.0-rc.3 — a breaking migration is coming

Better Auth's v1.7.0-rc.3 adds new database indexes for the device-authorization flow and changes how Microsoft accounts are identified, migrating from sub to oid as the stable identifier. Anyone tracking the 1.7.0 release candidates should plan for a required data migration before GA lands.

Clerk and Auth0 ship enterprise identity features

Clerk shipped self-serve SSO configuration for OIDC — IT admins can now set up their own OpenID Connect connections directly from the Security tab of <OrganizationProfile /> without needing Clerk Dashboard access (changelog). Auth0's changelog logged a busy two days: Global Search in the Cmd+K command palette entered beta (cross-resource search across apps, APIs, orgs, and users), Enterprise Connect entered beta for federating existing SAML/OIDC servers into B2B SSO, Curated Blocklists in Tenant Access Control Lists reached general availability (automated blocking of low-reputation IPs, Tor nodes, and VPN/proxy traffic), and both "Agents as Principal" and a Token Vault Privileged Worker entered early access for AI-agent identity and token handling.

Meta-Frameworks, Runtimes & Backend

Node.js v26.6.0

Node.js v26.6.0 (Current) adds a getCurrentEventLoop API and test-runner enhancements (context.log(), a new test:log event, entryFile reporting in TestStream), RSA-PSS key-handling and OpenSSL/BoringSSL backend fixes in crypto, stream backpressure and ring-buffer performance work, and an npm bump to 11.18.0.

Astro 7.1.6, Hono v4.13.0, ElysiaJS 2.0.0-beta.1

Astro 7.1.6 fixes concurrent static builds that failed to generate i18n rewrite fallbacks for dynamic routes and stale dev CSS after editing component styles, and adds configurable chunk sizing for experimental collection storage, with companion @astrojs/cloudflare and @astrojs/vercel patches the same day. Hono v4.13.0 adds first-class HTTP QUERY method support via app.query(), a Method-Not-Allowed middleware returning proper 405/Allow headers, and RegExpRouter improvements worth roughly 20% faster route registration. ElysiaJS 2.0.0-beta.1 is a major rewrite in beta: a bundle over 50% smaller, fully tree-shakeable TypeBox (bumped 0.34 → 1.3), OpenAPI 2.x → 3.0.3, and breaking renames (inject → derive, context.store[SYMBOL] moved to meta[SYMBOL]).

SvelteKit, FastAPI, Laravel

SvelteKit 2.70.2 patches quadratic-backtracking regex behavior in Accept-header content negotiation, while the 3.0.0-next.13 preview replaces goto's noScroll/keepFocus options with a unified reset option and deprecates the old error(status, {...}) signature. FastAPI 0.141.1 continues a rapid patch cadence on PyPI. Laravel v13.23.0 is the latest tag on Packagist, following v13.22.0 and the v13.21.x line.

UI, Databases & Analytics

shadcn/ui 4.16.1 and the 4.14.1 CLI security patch

shadcn 4.16.1 fixes build failures when registry item names contain path segments and adds server-side dynamic search via forwarded search params. It's worth flagging the 4.14.1 release from earlier in the week: it patched credential-leakage, path-traversal, and CLI flag-injection risks in the shadcn CLI itself, alongside new Base UI Toast and React Aria support. Releases are now cryptographically signed by the maintainer.

pgvector 0.8.6 and ClickHouse v26.7.2.59

pgvector 0.8.6 fixes a buffer overflow in IVFFlat index builds on 32-bit systems, plus sparsevec casting issues and elevated memory use during indexing. ClickHouse v26.7.2.59 is the latest stable patch build on the 26.7 branch, following the v26.7.1.1315 feature release from late July.

ORMs, BaaS & Background Jobs

BullMQ v6.0.0 — breaking pluggable queue backends

BullMQ's v6.0.0 is a major, breaking release built around a new IQueueBackend abstraction with Redis and PostgreSQL backends, unified across the Node.js, Python, PHP, and Elixir clients. Queue#client, redisVersion, databaseType, Worker#blockingClient, and FlowProducer#client are all removed in favor of getBackend(); the legacy repeatable-jobs API is replaced by Job Schedulers; ioredis becomes an optional peer dependency; and Worker#resume() is now async. A quick v6.0.6 patch followed on August 3, bumping the cron-parser dependency to v5.7.0.

Firebase and Supabase CLI updates

Firebase CLI v15.25.1 follows v15.25.0's non-interactive login flow (firebase login --non-interactive) and a new crashlytics:onboard:web command. The Firebase JS SDK's v12.17.0 adds text-to-speech support for non-Live Gemini models, quadruples the Firestore Node.js HTTP/2 flow-control window to 256KB, and removes the ability to call initializeAppCheck without a provider — a breaking change. Separately, Supabase CLI v2.111.0 makes function deployments fault-tolerant (bulk deploys now continue past individual failures), improves db pull status output, and bundles PostgreSQL 17.6.1.156.

What to Patch Today

• Redis (any 6.2–8.8 build) — upgrade immediately given public RCE proof-of-concept exploits.
• Nuxt 3.x/4.x — update to 4.5.1 or the 3.21.10 backport and purge CDN caches if you use cache/swr/isr route rules.
• Next.js — move to 16.3.0 for the lodash prototype-pollution fix.
• Docker Engine — 29.7.1 closes an image-pulling path-traversal issue.
• BullMQ, Better Auth, ElysiaJS, and SvelteKit 3 — review breaking-change notes before upgrading; none of these are drop-in patch releases.