Dev Stack Radar: Django & Keycloak Ship Security Fixes

Every day the stack you ship on moves. This is the August 9, 2026 snapshot: what shipped, what broke, and what needs a patch across containers, identity, meta-frameworks, backend runtimes, UI systems, databases, and the messaging layer that glues it all together. Verified against official changelogs, GitHub release tags, and security advisories — no rumors, no unverified CVEs.

Executive Summary

• Django 6.1 ships alongside a same-week security release (Django 6.0.8 / 5.2.17) patching a High-severity file-write/SSRF flaw in spatial lookups (CVE-2026-15307) plus three lower-severity issues, including an admin stored-XSS bug (CVE-2026-15920).
• Keycloak 26.7.1 closes five CVEs in one patch: an OIDC JWE signature-check bypass, a hardcoded-role privilege escalation in the client admin API, and three separate Fine-Grained Admin Permission (FGAP v2) bypasses.
• Prisma v8.0.0-rc.1 opens the v8 pre-release track with breaking changes: aggregate results like count() now return bigint instead of number, and the SQL driver-adapter interface splits into separate query()/execute() methods.
• Motion (Framer Motion) v13.0.0 drops its bundled @emotion/is-prop-valid dependency — DOM prop filtering now needs an explicit MotionConfig opt-in.
• AWS published five new security bulletins between Aug 4–6, covering Bedrock AgentCore, the Kiro IDE/CLI on Windows, and two MCP-server CVEs (AWS Transform, DocumentDB).
• Docker Compose v5.4.0 reworks the resource-reconciliation model for volumes and networks; Docker Engine v29.7.2 and Docker Desktop 4.85.0 shipped in the same week.
• Next.js 15.5.23 hardens Flight-protocol traversal guards; Better Auth 1.6.26 closes an email-OTP user-enumeration leak.
• ClickHouse, shadcn/ui, and Material UI all shipped patch releases in the last 48 hours; BullMQ's v6 line kept up a near-daily cadence across its TypeScript, Rust, Python, PHP, and new .NET bindings.

Containers, Edge & Infrastructure

Docker

Docker Engine v29.7.2 (Aug 6) fixes a regression from 29.7.0 that broke image pulls and docker cp file-permission handling on older Linux kernels, plus nftables compatibility fixes. Docker Compose v5.4.0 (Aug 3) introduces a new reconciliation plan that stops unnecessary volume and network recreation on compose up. Docker Desktop 4.85.0 (Aug 3) fixes a Linux VM kernel panic tied to bind-mount file watchers and tightens Gordon AI Agent plan-mode behavior.

Cloudflare, Vercel & Next.js

Cloudflare enabled R2 SQL and R2 Data Catalog billing for non-enterprise accounts on Aug 3 ($0.0025/GB scanned) — a cost change to budget for, not a bug fix — alongside Python↔JavaScript Workers RPC interop and new local OpenTelemetry tracing for Workers agents. Vercel shipped public-repo support for its Container Registry, Datadog/Splunk/Panther Audit Log Drains, and free domains on new Pro plans this week. Next.js 15.5.23 (Aug 7) ports Flight-protocol traversal guards from the reply server to the client — a hardening fix in the same family as December's Flight-protocol RCE class.

Kubernetes, Podman & Cloud Platforms

Kubernetes v1.37.0-rc.0 landed Aug 6 ahead of the stable v1.37 cut planned for Aug 26; Podman's newest tag remains the Jul 31 v6.1.0-RC1. AWS published five security bulletins this week:

• 2026-073-AWS — CVE-2026-18830, Bedrock AgentCore harness
• 2026-074-AWS — CVE-2026-18656 / CVE-2026-18657, Kiro IDE/CLI on Windows
• 2026-075-AWS — CVE-2026-18953, AWS Transform MCP Server
• 2026-076-AWS — CVE-2026-18954, AWS Labs DocumentDB MCP Server
• 2026-077-AWS — CVE-2026-19111, Strands Agents Tools

Railway shipped Cloud Agents (beta) and automatic Postgres CVE patching; Render cut median build times roughly 40% across all runtimes via faster CPU/disk build nodes.

Identity & Authentication (IAM)

Keycloak 26.7.1 (Aug 5) is a security-only patch closing five CVEs:

• CVE-2026-9793 — JWE request objects bypass requestObjectSignatureAlg enforcement (OIDC)
• CVE-2026-4629 — privilege escalation via hardcoded role-mapper injection in the client admin API
• CVE-2026-14209 — user disclosure via search=id: under Fine-Grained Admin Permissions (FGAP) v2
• CVE-2026-14614 — FGAP v2 bypass in client scope assignment
• CVE-2026-14615 — FGAP v2 parent-group endpoint bypasses per-child view permission filtering

Full details: keycloak.org release notes. Elsewhere in IAM: Authentik is mid-way through six release candidates for 2026.8.0 with no stable cut yet. Clerk added OAuth Client ID Metadata Document support (beta) for MCP/public OAuth clients and Google Workspace directory sync. Auth0 opened early access on Custom Token Exchange "Session Delegation" for support-agent session assumption with dual-identity audit trails, and took Google Workspace directory sync for Groups to GA. Better Auth 1.6.26 (Aug 4) stops email-OTP verification from leaking whether an address is registered, purges secondary-storage sessions on user deletion, and fixes JWT type inference plus SQLite transaction deadlocks. Auth.js/NextAuth had no release in the last week.

Meta-Frameworks & Core Web Standards

Next.js 15.5.23 is the only stable-channel change this week (see hardening note above); React had no new release, with 19.2.8/19.1.9/19.0.8 (the DoS fix for CVE-2026-23869) still the latest. Nuxt v4.5.2 / v3.21.11 (Aug 5) is routine maintenance — faster incremental writes, lazy imports, island-rendering and prefetch-hint fixes. Vue.js 3.5.41 (Aug 5) is a stable patch, while Vapor Mode continues at 3.6.0-rc.2. SvelteKit's 3.0.0-next.16 preview (Aug 7) adds new $app/manifest and $app/service-worker modules and a refreshAll option for goto(); stable Svelte 5 hasn't moved since Jul 24. Astro 7.2.0 (Aug 6) adds an astro preview --background flag, experimental incremental static builds, and a content-collection digest property.

Backend Frameworks & Runtimes

Node.js v26.7.0 (Aug 5, Current) adds crypto STORE loaders for private keys, Perfetto tracing support, and Symbol.dispose in ModuleHooks. Fastify v5.11.3 (Aug 8) is a patch fixing trailer-state clearing and Content-Type RegExp lastIndex reset; Express and NestJS had no release this week. Elysia's 2.0 "Kiana" remains in beta; Hono v4.13.1 (Aug 7) fixes trie-router slash counting and stream writer-lock re-acquisition. FastAPI's latest stays at 0.141.1 (Jul 29).

Django 6.1 (Aug 5) is the headline backend release, adding model field fetch modes and expanded ForeignKey.on_delete database-level options. It's paired with security releases 6.0.8 and 5.2.17 (Aug 4) fixing four CVEs — most notably CVE-2026-15307 (High): GDALRaster interprets attacker-controlled strings/dicts as raster files, which can trigger unwanted disk writes or outbound requests. The release also closes an admin stored-XSS bug in unvalidated URLField link rendering (CVE-2026-15920) and two DoS issues (CVE-2026-15830, CVE-2026-15337). Anyone running Django main, 6.1, 6.0, or 5.2 should upgrade immediately.

Laravel v13.24.0 (Aug 4) adds Eloquent's modelKeys(), an array-keys validation rule, dominant-color image detection, and HEIC/AVIF support, alongside PHP 8.5 compatibility fixes.

UI Systems, Styling & Motion

shadcn/ui shipped [email protected] (Aug 6, registry search fuzzy-matching) and @shadcn/[email protected] (Aug 5, a new Questionnaire primitive for multi-step forms). Radix UI and Tailwind CSS were both quiet this week — their latest releases are Jul 25 ([email protected]) and Jul 16 (Tailwind v4.3.3) respectively. Material UI shipped v9.3.1 (Aug 6, transition and codemod fixes) and v9.3.0 (Aug 5, roving-tabindex keyboard nav for ToggleButtonGroup and Autocomplete live-region announcements).

Motion (Framer Motion) v13.0.0 (Aug 5) is a breaking major release: the optional @emotion/is-prop-valid dependency used for DOM-prop filtering is gone, so any project relying on automatic filtering needs to opt in explicitly:

import { MotionConfig } from "motion/react"
import { isValidProp } from "@emotion/is-prop-valid"

export function App({ children }) {
  return (
    <MotionConfig isValidProp={isValidProp}>
      {children}
    </MotionConfig>
  )
}

Databases, Caching & Vector Search

PostgreSQL core and pgvector were both quiet this week — Postgres's last security release (18.4/17.10/16.14/15.18/14.23) was May 14, and pgvector's latest tag is v0.8.3 (Jun 18). Redis's most recent releases are also outside this week's window: 8.10.0 GA (Jul 29) and the 8.8.1/8.6.5 security patches for CVE-2026-25589 (Jul 23) remain the latest word. MongoDB shipped no new release, but its most recent security advisories (Jul 22) are worth checking against if unpatched — six CVEs including CVE-2026-13072 (CVSS 9.2, memory corruption in Compute Mode) and CVE-2026-13059 (RBAC bypass), fixed in Server 7.0.39/8.0.28/8.2.12/8.3.7. ClickHouse shipped four stable/LTS point releases Aug 5–6 (26.7.3.19, 26.6.2.160, 26.3.17.110-lts, 25.8.29.51-lts); a third-party-reported SQL-injection CVE (CVE-2026-51992) is circulating in scanner feeds but has no official ClickHouse advisory or patch yet, so treat it as unconfirmed. DuckDB's latest remains v1.5.5 (Jul 22).

Database Tools, ORMs & BaaS

Prisma v8.0.0-rc.1 (Aug 7) opens the v8 pre-release track and carries real breaking changes for anyone testing it: aggregate results switch from number to bigint, and the driver-adapter interface splits into separate query and execute methods.

// Prisma 7.x
const total = await prisma.order.count() // number

// Prisma 8.0.0-rc.1
const total = await prisma.order.count() // bigint — update comparisons,
                                          // serialization, and .d.ts consumers

Drizzle ORM had no release this week — v1.0.0-rc.4 (Jun 27) is still the latest. Supabase's August Developer Update (Aug 7) introduces Supabase Pipelines (managed Postgres→BigQuery CDC), a "Sign in with ChatGPT" beta, an open beta for Unified Logs, Grafana Cloud observability integration, and field-level encryption via a CipherStash partnership; self-hosted deployments also picked up update.sh reliability fixes (v0.7.1/v0.7.2). Firebase shipped routine SDK point releases across JS (12.17.1), C++ (13.11.0), Unity (13.15.0), and Flutter (4.18.0) between Aug 3–6.

Background Jobs, Messaging & Task Queues

BullMQ kept a near-daily release cadence: core v6.0.9 (Aug 7) typed the completed event's deserialized return value, while the Rust, Python, PHP, and brand-new .NET bindings all shipped patches Aug 4–7. The PHP binding's upgrade of predis to v3 is a major dependency bump worth checking for downstream breakage before updating.

RabbitMQ and Apache Kafka were both quiet this week — RabbitMQ's latest is 4.3.4 (Jul 24) and Kafka's is 4.3.1 (Jun 23). If you haven't patched RabbitMQ recently, a batch of advisories from Jul 23 is worth a look, including a High-severity OAuth2 client-secret exposure (CVE-2026-57219) fixed in 4.3.0+/4.2.6+/4.1.11+/4.0.20+/3.13.15+. Temporal's stable "Latest" tag remains v1.31.2 (Jul 8, contains the CVE-2026-5724 gRPC-auth fix); the granular build tags appearing daily in its repo are automated pre-release artifacts, not announced releases.