Dev Release Radar — August 6, 2026: Keycloak Closes Five CVEs, Next.js Ships Instant Navigations

Keycloak shipped the standout security release of the last 48 hours, closing five CVEs in 26.7.1 — including a JWE request-object bypass and a hardcoded role-mapper privilege escalation. On the framework side, Next.js 16.3 landed with an SPA-style navigation model it calls Instant Navigations, and Motion (formerly Framer Motion) crossed into a breaking 13.0.0 that drops its implicit prop-filtering behavior. Node.js published two release lines in the same window, Laravel and Fastify both cut patch releases, and Material UI quietly fixed a prototype-pollution bug in its CSS variable parser. Databases were the quiet corner of the stack this week — the most recent hardening in Postgres, Redis, and DuckDB predates this window, so we've flagged those as background context rather than new-today. Here is everything verified from official sources across the target stack for August 6, 2026.

Executive Summary

• Keycloak 26.7.1 (Aug 5) patches five CVEs, including a JWE request-object signature-check bypass (CVE-2026-9793) and a hardcoded role-mapper privilege escalation.
• Next.js 16.3 (Aug 3) ships "Instant Navigations" — a 'use cache'-based client cache, up to 90% lower dev-server memory, and up to 5.5x faster repeat builds.
• Motion 13.0.0 (Aug 5) is a breaking release: it drops the bundled @emotion/is-prop-valid dependency in favor of an explicit isValidProp prop on MotionConfig.
• Material UI 9.3.0 (Aug 4) fixes a prototype-pollution bug in @mui/system's cssVarsParser, alongside roving-tabindex and aria-live accessibility upgrades.
• Node.js shipped two lines in-window: v26.7.0 (Current, Aug 5) and v24.19.0 (LTS "Krypton", Aug 3).
• Laravel v13.24.0/v12.65.0 (Aug 4-5) and Fastify v5.11.1/v5.11.2 (Aug 3) both cut routine patch releases.
• Cloudflare pushed a WAF signature update targeting a Microsoft SharePoint RCE chain and a Rails SSRF pattern, doubled Vectorize's per-index vector cap to 20M, and shipped Wrangler 4.119.0.
• Quiet corners: React, Svelte (core), Astro, Radix UI, Tailwind CSS, Podman, Kubernetes, Drizzle ORM, RabbitMQ, Kafka, and Temporal show no release inside this window.

Identity & Authentication

Keycloak 26.7.1: Five CVEs Closed

Keycloak's 26.7.1 release (Aug 5) is this window's most consequential security fix. It patches CVE-2026-9793 (a JWE-encrypted request object could bypass requestObjectSignatureAlg enforcement), CVE-2026-4629 (privilege escalation via a hardcoded role-mapper injection in client management), plus three fine-grained-admin-permission (FGAP) filter bypasses — CVE-2026-14209, CVE-2026-14614, and CVE-2026-14615 — that could leak user data or client-scope assignments to admins who shouldn't have visibility into them. A WebAuthn attachment-policy bypass and a password-reset bug round out the release.

# Keycloak 26.7.1 upgrade (containerized deployments)
docker pull quay.io/keycloak/keycloak:26.7.1
docker run quay.io/keycloak/keycloak:26.7.1 start --optimized

Clerk, Auth0, and Better Auth

Clerk shipped Google Workspace Directory Sync (Aug 5), which pulls users, groups, and attributes from a Workspace directory without requiring a sign-in event, plus a combined sign-in-or-up flow for <SignIn/> with strict user-enumeration protection (Aug 4). Auth0 expanded Organizations Search with up to five combined filters on name, metadata, and entitlement status (Aug 4). Better Auth published 1.6.26 stable (Aug 4) and 1.7.0-rc.4 (Aug 5), the latter splitting MCP support into its own OAuth-provider-backed package, tightening OAuth/SAML/SIWE/2FA checks, and adding refresh-token-reuse controls.

Auth.js/NextAuth published nothing in this window — the latest tags ([email protected], @auth/[email protected]) are from July 20. Authentik's 2026.8 is still cycling release candidates; stable remains 2026.5.6.

Meta-Frameworks & Core Web Standards

Next.js 16.3: Instant Navigations

Next.js 16.3.0 (Aug 3) is the headline framework release of the week. It introduces "Instant Navigations," an SPA-like client-side navigation cache built on 'use cache', cuts dev-server memory by up to 90% via Turbopack disk caching and eviction, and claims up to 5.5x faster repeat builds. The App Router's SSR path also moved from web streams to native Node.js streams, handling roughly 22% more requests under load. TypeScript 7 is now supported for type checking, and a new catchError API adds custom error boundaries.

export function catchError(error: unknown) {
  // Next.js 16.3 custom error boundary hook
  return { digest: 'custom', message: String(error) }
}

Nuxt, Vue, and SvelteKit

Nuxt 4.5.2 (Aug 5) is a routine patch — build-cache timing and prerendering fixes — but it lands on top of the more important 4.5.1/3.21.10 security release from July 27, which closed a server-island RCE chain (CVE-2026-71320, GHSA-9473-5f9j-94wq) reachable when vue.runtimeCompiler: true is set, plus an unauthenticated OOM crash and a route-rule auth bypass. Anyone still on pre-4.5.1/3.21.10 should treat this as the priority upgrade. Vue core shipped a routine 3.5.41 patch (Aug 5); Vue 3.6's Vapor Mode remains in RC. SvelteKit's 3.0 preview line advanced to 3.0.0-next.14 (Aug 4) with breaking changes to preloadCode and a bumped Node.js minimum of 22.17. React, Svelte core, and Astro had no release activity in this window.

Backend Frameworks & Runtimes

Node.js publishes two release lines this week: v26.7.0 (Current, Aug 5) adds Perfetto tracing support and an NSS 3.125 root-certificate update, while v24.19.0 (LTS "Krypton," Aug 3) stabilizes stream.compose and adds TLS certificate compression. Neither is a security release — Node's most recent security patches landed July 28-29, just outside this window.

Laravel cut v13.24.0 (Aug 4) and v12.65.0 (Aug 5) with 60+ changes, including a new modelKeys() method on the Eloquent query builder and PHP 8.5 compatibility fixes. Fastify shipped v5.11.1 and v5.11.2 (Aug 3), both routine patches.

Django and Hono already closed their CVEs earlier this week — Django's 6.0.8/5.2.17 (Aug 4) patched a GeoDjango GDALRaster SSRF/RCE chain, and Hono's 4.12.34 (Aug 3) closed four advisories including a JSX memo() cross-request data leak — both are still the most current release for their projects, so they're not repeated as new here. NestJS, Express, ElysiaJS, and FastAPI show no release inside this window.

Containers, Edge & Infrastructure

Docker Desktop 4.85.0 (Aug 3) fixes a Linux VM kernel panic triggered by file-watcher events on bind mounts and switches Microsoft Store installs to per-user by default. Docker Engine's most recent security release, 29.7.1, predates this window (July 31) but is worth flagging: it patches four CVEs, including a git bundle-file checkout that could lead to command injection.

Cloudflare pushed a WAF signature update (Aug 4) covering a Microsoft SharePoint RCE pattern and a Ruby on Rails SSRF pattern, doubled Vectorize's per-index cap to 20M vectors (Aug 4), and added AI Gateway "User Insights" plus Access identity-aware controls (Aug 5). Wrangler 4.119.0 published the same week on its regular cadence. Vercel shipped AI Gateway OpenTelemetry trace export via Vercel Drains and raised Sandbox capacity to 10,000 concurrent sandboxes on Pro/Enterprise (Aug 5). Podman, Kubernetes, Railway, Render, and AWS show no notable release in this window.

UI Systems, Styling & Motion

Motion 13.0.0: A Breaking Prop-Filtering Change

Motion 13.0.0 (Aug 5) removes the bundled @emotion/is-prop-valid dependency that used to filter invalid DOM props automatically. Anyone relying on that implicit behavior needs to opt back in explicitly:

import { MotionConfig } from 'motion/react'
import { isValidProp } from '@emotion/is-prop-valid'

export function App({ children }) {
  return (
    <MotionConfig isValidProp={isValidProp}>
      {children}
    </MotionConfig>
  )
}

Material UI, shadcn/ui, Radix, Tailwind

Material UI 9.3.0 (Aug 4) fixes a prototype-pollution issue in @mui/system's cssVarsParser and adds roving-tabindex keyboard navigation to Toggle Button Group. shadcn/ui shipped a new headless "Questionnaire" primitive (Aug 5, @shadcn/react v0.3.0) for multi-step question flows — onboarding, intake forms, agent clarification prompts — styled across Base UI, React Aria, and Radix variants. Radix UI's latest stable is still 1.6.7 (July 24), with 1.7.0 only in release candidates; Tailwind CSS's latest stable remains 4.3.3 (July 16), with only nightly insiders builds publishing this week.

Databases, Caching & Vector Search

This was the quiet corner of the stack — nothing landed squarely inside the Aug 4-6 window except routine ClickHouse patch builds (26.6.2.160, 26.3.17.110, 25.8.29.51 on Aug 5). The most recent hardening elsewhere predates this window but remains the current guidance: Redis 8.10.0 GA (July 29) added compact-hash memory savings and a new BACKUP command; pgvector 0.8.6 (July 29) fixed a 32-bit IVFFlat build-time buffer overflow; DuckDB 1.5.5 (July 22) closed several out-of-bounds read issues in JSON path handling and dictionary-string decompression.

MongoDB's security bulletin from July 22 is still the most current advisory and worth a reminder if you haven't patched: 27 vulnerabilities disclosed, most severely CVE-2026-13072 (CVSS 9.2, memory corruption via Compute Mode BSON processing) and CVE-2026-13059 (CVSS 8.6, RBAC bypass via client-supplied command parameters), fixed in Server 7.0.39/8.0.28/8.2.12/8.3.7 and Compass 1.49.7. PostgreSQL's next core release remains at Beta 2 with no minor/security release yet this window.

Database Tools, ORMs, BaaS & Task Queues

BullMQ v6.0.8 (Aug 5) fixes an ioredis import path so the new pluggable Postgres backend works without ioredis internals. Firebase's JS SDK reached v12.17.1 (Aug 4), fixing an Admin Node.js SDK install bug. Supabase deprecated explicit version clauses in CREATE/ALTER EXTENSION (Aug 5, now ignored with a warning) and is switching self-hosted deployments' default API gateway from Kong to Envoy the week of Aug 9 — hosted Supabase Cloud is unaffected.

Prisma's most recent changelog entry (Aug 2) — just outside this window — added support for expression, partial, and unique indexes in Prisma Schema Language. Drizzle ORM, RabbitMQ, Apache Kafka, and Temporal show no release activity in this window.

Nothing here should be read as a coincidental "everything shipped this week" narrative — several entries above (Redis, pgvector, DuckDB, MongoDB, Prisma, Docker Engine) are each project's most current guidance rather than new-today releases, and are flagged as such. All version numbers and dates were cross-checked against official GitHub release tags, npm/PyPI registry timestamps, or vendor changelogs before publication.