Daily Dev Stack Release Audit — September 3, 2026: Keycloak and Podman Patch Critical CVEs as Kubernetes 1.37 Ships HPA Scale-to-Zero

Executive Summary

• Security patches lead the day. Keycloak 26.7.3 closes roughly 20 CVEs including an LDAP hostname-verification bypass and a signed-JWT assertion policy bypass; Podman 6.1.1 fixes a tar-extraction path traversal (CVE-2026-17106); Hono 4.13.5 patches three advisories including a request-body DoS; and August's PostgreSQL rollup closed 28 CVEs, two of them high severity.
• Kubernetes 1.37 brings HPA scale-to-zero to Beta, letting object- and external-metric-based autoscalers drop `minReplicas` to 0.
• Authentik 2026.8 rewrites its server entrypoint and proxy outpost from Go to Rust and achieves official OpenID Foundation certification for both OP and RP conformance.
• Breaking changes to watch: Authentik's `hash_password` CLI no longer accepts a password argument; Django 6.1.1 fixes regressions from 6.1's template double-dot lookup deprecation; Next.js 16.3.4 and 15.5.25 both re-enable AVIF image optimization after it broke on newer `sharp` builds.
• Platform and ecosystem moves: NestJS 12 goes ESM-first with Rspack replacing Webpack as the default monorepo bundler; Prisma Compute reaches general availability; Firebase Remote Config shifts to usage-based pricing; Cloudflare now enforces daily D1 query caps on the Workers Free plan.

Containers, Edge & Infrastructure

Docker

Docker Desktop 4.89.0 bundles Compose v5.5.0, the NVIDIA Container Toolkit v1.20.0, and Docker Agent v1.127.0, while fixing background container polling that was waking the engine during Resource Saver mode. Separately, Moby/Docker Engine v25.0.17 is a security release addressing a symlink escape in mount-destination creation (CVE-2026-41568), an archive decompression ordering flaw (CVE-2026-41567), a `docker cp` bind-mount redirection issue (CVE-2026-42306), and a containerd 1.7.33 bump for CVE-2024-40635.

Podman

Podman 6.1.1 fixes CVE-2026-17106, where a crafted tar archive could write files outside the intended extraction directory via malicious links. It also restores rootless dual-stack port binding:

podman run -d -p 0.0.0.0:8080:80 -p [::]:8080:80 nginx

Kubernetes

The Kubernetes 1.37 blog post confirms HorizontalPodAutoscaler scale-to-zero is now Beta and enabled by default for object- and external-metric autoscaling (it does not work with CPU/memory metrics):

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: queue-worker
spec:
  minReplicas: 0
  maxReplicas: 10
  metrics:
    - type: External
      external:
        metric:
          name: queue_messages_ready
        target:
          type: AverageValue
          averageValue: "30"

A new `ScaledToZero` status condition reports when the controller has parked a workload at zero replicas.

Cloudflare

The Cloudflare changelog shows the Workers Free plan now enforces daily D1 row read/write limits, failing queries via both the Binding API and REST API until the midnight UTC reset. AI Gateway invoices were also consolidated to one line item per model, and the Images binding gained text rasterization plus new header-setting methods.

Vercel

Vercel's changelog notes CLI output for multi-service builds now prefixes each log line with a service tag, and AWS PrivateLink support for reaching AWS-hosted databases over a private network path has reached general availability.

Render & Railway

Render introduced a default usage-billed "flex" compute plan for Workflows, auto-migrating existing tasks off the old starter/standard tiers. Railway's most recent changelog entry remains its August 20 "Railway for Everyone" update; nothing new was found for this window.

Identity & Authentication

Keycloak

Keycloak 26.7.3 is a security release fixing close to 20 CVEs concentrated in Fine-Grained Admin Permissions v2 and OIDC edge cases, including CVE-2026-35563 (LDAP server certificate hostname not verified), CVE-2026-16093 (signed-JWT assertion policy bypass via unsigned header), and CVE-2026-16089 (authorization code retargeting to another client). Upgrading is recommended for any deployment using LDAP federation or JWT client assertions.

Authentik

Authentik 2026.8 is a major release: the server entrypoint and proxy outpost move from Go to Rust, the project earns OpenID Foundation certification for OP and RP conformance, and Enterprise tiers gain Agent Accounts for AI/automation service identities plus scheduled user offboarding. Breaking changes include the removal of `hash_password <password>` as a CLI argument and the removal of the WebAuthn "prevent duplicate device" option.

Auth0

Auth0 shipped two changes this week per its changelog: Advanced MFA Configurations reached general availability, adding configurable device-memory windows and OTP length/lifetime controls, and a redesigned dashboard navigation entered early access.

Better Auth

Better Auth v1.7.2 fixes permanent bans that were leaving stale expiration dates behind, following v1.7.0's addition of DPoP (RFC 9449) and the OAuth Device Authorization Grant (RFC 8628). Auth.js/NextAuth shows no release activity in this window — its own ecosystem increasingly points new projects toward Better Auth.

Meta-Frameworks & Core Web

Next.js

Next.js shipped v16.3.4 and v15.5.25, both re-enabling AVIF image optimization after it broke against newer `sharp` releases, plus a TypeScript aliasing build-error fix. The canary channel (v16.4.0-canary.15) continues Turbopack cache-size work via per-family compression.

Astro

Astro 7.2.10 fixes an SSR manifest placeholder bug that could crash a server at boot with an "Invalid URL" error, alongside a markdown image `srcset` fix. Starlight 0.42 also landed this week with a lighter JavaScript footprint for static pages.

Svelte & Vue

Svelte 5.57.0 adds `SvelteMap.getOrInsert`/`getOrInsertComputed` and new `svelte/server` type exports. Vue's core 3.6 release-candidate series continues (rc.6), carrying the Vapor Mode reactivity rewrite toward stable. SvelteKit, Nuxt, and React had no new releases in this window; the most recent Nuxt security releases (server island RCE and unauthorized component instantiation, fixed in 4.5.1/3.21.10) remain the ones to be on if you haven't upgraded.

Backend Frameworks & Runtimes

NestJS

NestJS 12.0.0 is ESM-first, adds native Standard Schema validation in decorators, and switches the CLI's default monorepo bundler from Webpack to Rspack:

nest upgrade
nest deploy

Hono

Hono 4.13.5 fixes three advisories: a query parser that didn't stop at the URL fragment (affecting cache middleware and proxies), an incomplete fix for a prior static-site-generation path traversal, and a denial-of-service via unbounded object-graph expansion in `parseBody({ dot: true })`.

Laravel

Laravel shipped v13.30.1 and v12.69.1 on the same day, adding connection and queue info to the `WorkerStopping` event, an `insertOrIgnoreReturning()` query builder method, and a `dropVectorIndex()` schema helper, while fixing orphaned Redis tagged-cache entries.

Django

Django 6.1.1 is a bugfix release correcting regressions introduced by 6.1, including a template double-dot lookup deprecation that was misapplied to literals and a `ModelAdmin.list_display` crash on multi-relation fields. It is not a security release; the last Django security releases remain 6.0.7/5.2.16 from July.

Fastify

Fastify's most recent releases (v5.12.1 and a v6.0.0-alpha.2) patch two security advisories, GHSA-w2qp-rph6-63g4 and GHSA-3m5p-2c4r-xxw2. No new release landed inside this specific window.

Databases, Caching & Vector Search

PostgreSQL & pgvector

The August PostgreSQL rollup (18.6, 17.11, 16.15, 15.19, 14.24, plus 19 Beta 3) fixed 28 vulnerabilities, including CVE-2026-6475 (a symlink-following issue in `pg_basebackup`/`pg_rewind` letting an origin superuser overwrite local files) and CVE-2026-6637 (a stack buffer overflow in `refint` allowing low-privilege code execution). pgvector's latest tag remains v0.8.6.

Redis

A Redis security advisory covers CVE-2026-23479 (a use-after-free in the unblock-client flow, CVSS 7.7, with potential for remote code execution) along with related RESTORE-command memory-safety issues affecting RedisTimeSeries and RedisBloom. Fixes landed across the 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, and 7.2.16 lines; Redis says it has no evidence of active exploitation.

MongoDB

A MongoDB advisory flags driver versions below 5.9.2 and server versions below 7.0.40/8.0.29/8.2.13/8.3.8, covering a missing intra-cluster SASL allow-list that could allow a PLAIN-mechanism downgrade and cleartext keyfile disclosure.

ClickHouse

ClickHouse has been unusually active, shipping LTS and stable patch builds almost daily this week — v26.3.29.7-lts, v26.8.2.7-lts, v26.7.6.57-stable, and v26.3.28.5-lts among them — via its GitHub releases. Teams tracking an LTS line should diff their current build against the latest patch in that series.

ORMs, BaaS & Background Jobs

Prisma & Supabase

Prisma Compute reached general availability, giving every branch its own environment with a free tier of 1M requests/month. Supabase moved read replica management from Database → Replication to Project Settings → Infrastructure, and fixed daily backups that were occasionally skipped due to a scheduling timeout.

Firebase

Firebase Remote Config switched to usage-based pricing: a no-cost tier of 100,000 daily fetch requests per project, then $0.06 per 10,000 requests on the Blaze plan, with A/B Testing now natively integrated into Remote Config.

BullMQ & RabbitMQ

BullMQ 6.2 introduced pluggable queue backends, so a queue can now run on Postgres instead of Redis:

import { Queue } from 'bullmq';

const queue = new Queue('emails', {
  connection: { url: process.env.POSTGRES_URL },
  backend: 'postgres',
});

RabbitMQ shipped 4.2.10 and 4.3.5 maintenance releases in the same window; both are recommended upgrades for production brokers.

What To Do Today

• If you run Keycloak with LDAP federation or JWT client assertions, prioritize the 26.7.3 upgrade.
• Podman users extracting untrusted tar archives (CI runners, container builds from third-party sources) should move to 6.1.1.
• Redis and MongoDB operators should check their exact version against the CVE ranges above before assuming they're covered by "latest."
• Next.js projects using AVIF images that broke recently should update to 16.3.4 or 15.5.25.
• Kubernetes platform teams evaluating cost-driven autoscaling can start piloting HPA scale-to-zero on non-CPU/memory metrics now that it's Beta.