Dev Release Radar — August 7, 2026: Django 6.1 Ships While Patching a Critical RCE

Django took the headline this window, shipping the 6.1 major release on the same week its security team patched a High-severity remote-code-execution flaw in GDALRaster spatial lookups. Motion (formerly Framer Motion) crossed into a breaking 13.0.0, dropping its implicit prop-filtering behavior. Keycloak closed five CVEs in 26.7.1, and BullMQ kept up an unusually fast patch cadence — four releases in five days — while its new pluggable Redis/Postgres backend beds in. Docker, Cloudflare, Vercel, Nuxt, Astro, Laravel, Node.js, Hono, Prisma, Clerk, and Auth0 all shipped meaningful updates too. Several corners of the stack were quiet this week — React, Tailwind CSS, Radix UI, RabbitMQ, Kafka, and Temporal had nothing newer than their last verified release, which we note explicitly below rather than padding with old news. Here is everything verified from official sources across the target stack for August 7, 2026.

Executive Summary

• Django 6.1 ships (Aug 5) with model field "fetch modes" and database-level ForeignKey.on_delete options.
• Django security release (Aug 4, 6.0.8 / 5.2.17) patches CVE-2026-15307 — a High-severity GDALRaster bug exploitable for SSRF or, on GeoDjango setups, RCE.
• Motion 13.0.0 (Aug 5) is a breaking release: it removes the bundled @emotion/is-prop-valid dependency.
• Keycloak 26.7.1 (Aug 5) patches five CVEs, including a JWE request-object signature bypass and a hardcoded role-mapper privilege escalation.
• Docker Engine 29.7.2 (Aug 5) fixes two 29.7.0 regressions; 29.7.0 itself (Jul 30) patched CVE-2026-17106 in go-archive.
• BullMQ shipped four patches (v6.0.6 → v6.0.9, Aug 3–7) stabilizing its new pluggable Redis/Postgres queue backend.
• Cloudflare shipped Kitesurf, a stateless browser for AI agents (Aug 6), plus WAF updates for CVE-2026-50522 and CVE-2026-66066 (Aug 4).
• Vercel released Agent Plugins 1.0.0 (Aug 6), a vendor-neutral spec for packaging Agent Skills and MCP servers.
• Nuxt 4.5.2 / 3.21.11, Astro 7.2.0, Laravel 13.24.0, and Node.js 26.7.0 all cut patch/feature releases this window.
• Clerk shipped Client ID Metadata Documents and Google Workspace Directory Sync; Auth0 took Google Workspace Directory Sync to General Availability.
• MongoDB 8.2.12 (Jul 22, flagged for severity despite being outside the strict 5-day window) patches 27 vulnerabilities, including a CVSS 9.2 memory-corruption bug.

Identity & Authentication (IAM)

Keycloak 26.7.1 (release notes) is the standout security release of the window, closing five CVEs alongside routine bug fixes:

• CVE-2026-9793 — a JWE request object can bypass requestObjectSignatureAlg enforcement.
• CVE-2026-4629 — privilege escalation via hardcoded role-mapper injection.
• CVE-2026-14209 — admin UI's brute-force-user extension can disclose user existence.
• CVE-2026-14614 and CVE-2026-14615 — Fine-Grained Admin Permissions (FGAP v2) bypasses in client-scope assignment and the parent-group children endpoint.

Better Auth shipped v1.7.0-rc.4 (Aug 5) and v1.6.26 (Aug 4). Both close an email-enumeration issue in email-OTP verification — the API previously revealed whether an email was registered before OTP verification completed; the code is now checked first. v1.6.26 also moves JWT key minting into a transaction, fixing SQLite deadlocks, and switches Redis lookups from KEYS to SCAN.

Clerk (changelog) added Client ID Metadata Documents — letting MCP/OAuth clients use a URL as an identity without Dynamic Client Registration (Aug 6) — and Google Workspace Directory Sync for users, groups, and custom attributes (Aug 5). The combined sign-in-or-up flow also gained strict user-enumeration protection with no code changes required (Aug 4).

Auth0 (changelog) took Google Workspace Directory Sync for Groups to General Availability (Aug 6) and added advanced multi-filter Organizations Search (Aug 4).

Quiet this window: Authentik's stable channel (latest is 2026.5.6, Jul 22; only a release-candidate, 2026.8.0-rc6, moved on Aug 3) and Auth.js/NextAuth (latest releases are from Jul 20) had nothing newer.

Meta-Frameworks & Core Web Standards

Django 6.1 (release notes) shipped Aug 5 with model field "fetch modes" and database-level delete options for ForeignKey.on_delete, plus dict-based email settings. One day earlier, the Django security release (6.0.8 / 5.2.17) patched four CVEs:

• CVE-2026-15307 (High) — a GDALRaster spatial-lookup bug exploitable for SSRF or file write, and on some GeoDjango setups, RCE. Upgrade immediately if you use GeoDjango or expose the Django admin.
• CVE-2026-15830 (Moderate) — DoS via nested geometry collections.
• CVE-2026-15920 (Moderate) — stored XSS via an unvalidated URLField scheme in the admin.
• CVE-2026-15337 (Low) — DoS via an unbounded language-code cache in check_for_language().

Next.js cut a stable v16.3.0 (Aug 3) folding in the July 2026 security release, plus Turbopack and error-overlay improvements; v15.5.23 followed Aug 6 on the 15.x line. React was quiet — 19.2.8 (Jul 21) is still the latest stable build.

Nuxt shipped parallel patches on both active lines Aug 5: v4.5.2 (island navigation, prefetch, build-cache fixes) and v3.21.11 (island serialization, asyncData, route-rule fixes) — note Nuxt 3 has reached end of mainstream support. Vue.js followed with v3.5.41 (Aug 5).

SvelteKit pushed a SvelteKit-3 preview build, @sveltejs/[email protected] (Aug 4, requires Node 22.17+), while the stable line sits at 2.70.2. Svelte itself was quiet (5.56.8, Jul 24). Astro shipped [email protected] (Aug 6), adding astro preview --background, incremental static builds, and new session config options.

Backend Frameworks & Runtimes

Node.js cut v26.7.0 (Aug 5, Current line) — not a security release — adding crypto STORE-loader key support, Perfetto tracing, and Symbol.dispose for module hooks. Laravel shipped v13.24.0 (Aug 4: Eloquent modelKeys(), HEIC/AVIF support) and v12.65.0 (Aug 5 bug-fix).

Hono shipped v4.13.0 (Aug 3), adding first-class support for the HTTP QUERY method (RFC 10008) — a safe, cacheable way to send a request body with a read — plus a Method-Not-Allowed middleware and up to 1.25x routing throughput:

import { Hono } from "hono"

const app = new Hono()

// RFC 10008 QUERY method — cacheable request bodies for search-style reads
app.on("QUERY", "/search", async (c) => {
  const { filters } = await c.req.json()
  return c.json({ results: await search(filters) })
})

Fastify released v5.11.2 (Aug 3). Quiet this window: NestJS (11.1.28, Jul 8), Express core (4.22.2, May), ElysiaJS (1.4.29, Jun 16), and FastAPI (0.141.1, Jul 29) had nothing newer. Express's July security release (body-parser 1.20.6/2.3.0, CVE-2026-12590, a Low-severity limit-bypass DoS) is worth a check if you haven't upgraded.

Containers, Edge & Infrastructure

Docker Engine shipped v29.7.2 (Aug 5), fixing a panic on duplicate env vars in docker service create/update and two regressions introduced in 29.7.0 around hardlink targets and file permissions during pulls. 29.7.0 itself (Jul 30) patched CVE-2026-17106 in go-archive. Docker Compose v5.4.0 (Aug 3) reworks volume/network reconciliation, and Docker Desktop 4.85.0 (Aug 3) updates the Gordon AI agent to v1.115.0.

Cloudflare (changelog) shipped Kitesurf, a stateless browser for Browser Rendering claiming 3–7x lower CPU/memory for agentic screenshot and extraction tasks (Aug 6), plus WAF signature updates for CVE-2026-50522 and CVE-2026-66066 and a doubled Vectorize capacity to 20 million vectors (Aug 4).

Vercel released Agent Plugins 1.0.0 (Aug 6), an open, vendor-neutral spec for packaging Agent Skills and MCP servers into portable plugins, and gave the AI Gateway per-request OpenTelemetry tracing exportable to Braintrust or Sentry (Aug 5).

Kubernetes v1.37.0-rc.0 landed Aug 5 (release schedule); GA is targeted for Aug 26. Podman pushed v6.1.0-rc1, adding podman volume rename and IPv6 rootless port-forwarding with source-IP preservation. On AWS, AWS Transform continuous modernization reached General Availability across all supported regions (Aug 3). Railway and Render had nothing verified inside the window.

UI Systems, Styling & Motion

Motion (formerly Framer Motion) shipped v13.0.0 (Aug 5) — a breaking release. It removes the bundled @emotion/is-prop-valid dependency; if you were relying on automatic invalid-DOM-prop filtering, you now need to configure it explicitly:

import { MotionConfig, motion } from "motion/react"
import isPropValid from "@emotion/is-prop-valid"

// v13.0.0+: prop filtering is no longer bundled by default
function App() {
  return (
    <MotionConfig isValidProp={isPropValid}>
      <motion.div layout drag animate={{ x: 100 }} />
    </MotionConfig>
  )
}

shadcn/ui shipped v4.16.2 (Aug 6), a small patch making registry item titles searchable. Material UI cut v9.3.1 (Aug 6, fixing stuck exit transitions) and v9.3.0 (Aug 4, roving-tabindex keyboard nav for Toggle Button Group, aria-live announcements for Autocomplete). Quiet this window: Tailwind CSS (4.3.3, Jul 16) and Radix UI (1.6.7, Jul 24) had nothing newer.

Databases, Caching & Vector Search

MongoDB 8.2.12 (release notes, Jul 22 — outside the strict 5-day window but flagged for severity) patches 27 vulnerabilities, including CVE-2026-13072 (CVSS 9.2, memory corruption via Compute Mode processing external BSON), CVE-2026-11933 (CVSS 8.8, use-after-free in the server-side JS engine), and CVE-2026-13059 (CVSS 8.6, RBAC/query-level control bypass). Upgrade to 8.2.12+ if you haven't already.

Redis reached GA on 8.10.0 in late July (compact hashes, new HIMPORT command, TLS peer-cert server-to-server auth). A Jul 23 patch round (8.8.1/8.6.5/8.4.5/8.2.8 and older lines) fixed an out-of-bounds write in the RedisBloom TDigest RDB loader reachable via a crafted RESTORE payload.

ClickHouse cut several point releases in-window (v26.7.3.19-stable, Aug 6; v26.6.2.160-stable, Aug 5), while PostgreSQL 19 Beta 2 (native SQL/PGQ graph queries) and pgvector v0.8.6 (IVFFlat buffer-overflow fix on 32-bit systems) remain the most recent verified releases, both slightly outside the strict window. DuckDB was quiet (1.5.5, Jul 22).

Database Tools, ORMs & BaaS

Prisma shipped its "namespace release," v0.17.0 (Aug 4) — Prisma Next now publishes as 17 packages under the @prisma scope, with structured, dotted-code error handling. Firebase's JS SDK reached v12.17.1 (Aug 4), fixing an npm install error for Admin Node.js SDK users. Quiet this window: Drizzle ORM (latest stable 0.45.2) and Supabase — though Supabase's self-hosted stack is switching its default API gateway from Kong to Envoy the week of Aug 9, a breaking change for anyone with custom Kong config.

Background Jobs, Messaging & Task Queues

BullMQ was the most active project in this category, cutting four patches in five days as its new pluggable Redis/Postgres backend (introduced in v6.0.0, Jul 30) beds in:

• v6.0.9 (Aug 7) — fixed typing of the completed event's returnvalue as deserialized data.
• v6.0.8 (Aug 5) — fixed an ioredis import issue affecting the Postgres backend.
• v6.0.7 (Aug 4) — fixed a worker blocking-read issue persisting after reconnection.
• v6.0.6 (Aug 3) — bumped cron-parser to v5.7.0.

Configuring the new Postgres-backed queue looks like this:

import { Queue } from "bullmq"

// v6.0.0+: Redis is now an optional peer dependency
const queue = new Queue("emails", {
  connection: { url: process.env.DATABASE_URL },
  backend: "postgres",
})

Quiet this window: RabbitMQ (4.3.4, Jul 23), Apache Kafka (4.3.1, Jun 25), and Temporal (v1.31.2/v1.30.6, Jul 8) had no releases in the last five days.

What to Prioritize

• Upgrade Django to 6.0.8, 5.2.17, or 6.1 immediately if you run GeoDjango or expose the admin — CVE-2026-15307 is a High-severity RCE/SSRF path.
• Patch Keycloak to 26.7.1 for the FGAP v2 permission bypasses and the JWE signature-check bypass.
• Audit Motion usage before bumping to 13.0.0 — the removed @emotion/is-prop-valid dependency is a silent breaking change if you rely on automatic prop filtering.
• Confirm MongoDB is on 8.2.12+ given the CVSS 9.2 memory-corruption fix, even though the patch itself predates this window.