Django Patches Six CVEs, Node 26 Goes LTS, Astro 7.4.7 Ships: Dev Stack Release Audit, November 6, 2026

Executive Summary

• Security: Django 6.1.3, 6.0.10 and 5.2.19 landed on November 3 and fix six CVEs, one moderate (GDAL external CRS requests) and five low. Patch today if you run Django. See the 6.1.3 release notes.
• Runtime: Node.js 26.13.0 "Lithium" is now LTS, supported through April 2029, per the official release post.
• Meta-frameworks: Astro 7.4.7 shipped on November 5 (two patch releases that day), and SvelteKit 2.70.4 backported to the 2.x line.
• Backend: Laravel 13.40.0, NestJS 12.3.3 and Elysia 2.0.0-rc.3 are out.
• Edge and data tooling: Wrangler 4.158.0, Prisma 8.0.0-rc.30, BullMQ 6.7.1 and Better Auth 1.7.18.

A note on scope: GitHub release pages were not reachable from my audit environment today. Version numbers and dates below come from the npm, PyPI and Packagist registries. Detailed change descriptions only appear where I read the official release notes. For everything else, read the linked changelog before upgrading.

Django: six CVEs in one security release

Django 6.1.3 (also 6.0.10 and 5.2.19, all published November 3, PyPI) is a security release. Per the release notes:

Two behavior changes matter operationally. First, cache keys now distinguish absent from empty Vary headers, so entries cached for requests that omit those headers will miss and regenerate after the upgrade. Expect a short cache-warming bump. Second, a new gis.W001 system check warns if GDAL is older than 3.9. Run it after upgrading:

pip install --upgrade "Django>=6.1.3,<6.2"
python manage.py check --deploy

If you accept user-supplied geometries or SRS strings, prefer integer SRIDs, as the notes recommend.

Node.js: 26 becomes LTS

Node.js 26.13.0 (October 28) promotes the 26.x line to LTS with support through April 2029. Apart from metadata such as process.release, it has no changes from 26.12.1. One thing to check if you are moving from 22 or 24: official Linux binaries have been linked against libatomic since Node 25, and your distro image may need it installed. In a Dockerfile that is usually one extra package line. A 27.0.0-alpha also appeared on October 31.

Astro: 7.4.6 and 7.4.7 on the same day

Astro 7.4.7 followed 7.4.6 within hours on November 5. I did not read the patch changelog, so check the Astro changelog linked from the upgrade guide. If you are still on 6.x, the v7 guide lists the breaking changes worth planning around: Vite 8, a stricter Rust compiler (unclosed tags now fail the build), compressHTML defaulting to 'jsx', the removal of @astrojs/db, and src/fetch.ts becoming a reserved filename.

npx @astrojs/upgrade

SvelteKit and Svelte

SvelteKit 2.70.4 was published November 5 on the 2.x line, while the latest tag is 3.1.1 (October 29). If you are holding on 2.x, the backports are still flowing. Svelte 5.57.3 is the latest core release.

Vue and Nuxt

Vue 3.5.45 shipped November 5, with 3.6.0-rc.14 still in release-candidate on October 30. Nuxt 4.6.4 followed on November 2.

Backend frameworks

• Laravel: v13.40.0 released November 3, continuing the weekly minor cadence (13.39 on October 27, 13.38 on October 20).
• NestJS: 12.3.3 on November 4.
• Fastify: 5.12.8 on November 2, alongside a 6.0.0-alpha.6 pre-release.
• Hono: 4.13.16 on November 1.
• Elysia: 2.0.0-rc.3 on November 5, with 1.4.31 for the stable line. A 2.0 release candidate is worth testing in a branch now.
• FastAPI: 0.162.0 on October 23, no newer release since.

Edge, auth, database tooling

• Cloudflare: Wrangler 4.158.0 on November 5. Pin it in CI rather than floating latest.
• Vercel CLI: 65.12.1 landed this morning.
• Better Auth: 1.7.18 on November 5, with 1.8.0-beta.6 the same day.
• Clerk: @clerk/nextjs 7.9.25 is the current stable.
• Prisma: 8.0.0-rc.30 on November 3. Still release-candidate, so keep it off production.
• Drizzle: 1.0.0-rc.5 (October 21), with 0.45.4 stable.
• Supabase JS: 2.119.0 on November 4.
• BullMQ: 6.7.0 and 6.7.1 within 24 hours.
• UI and motion: Motion 14.9.1, MUI 9.5.0 (10.0.0-alpha.0 out), and Tailwind CSS 4.3.4.

What I am doing today

1. Upgrade every Django project to 6.1.3, 6.0.10 or 5.2.19, then run check --deploy.
2. Check Docker base images for Node 26 LTS and libatomic.
3. Bump Astro to 7.4.7 on sites already on v7.
4. Leave Prisma 8 RC, Drizzle 1.0 RC and Elysia 2.0 RC on branches.

No new advisories turned up today for Next.js, React, Keycloak, Authentik, PostgreSQL, Redis, MongoDB or Kafka in the sources I could reach, which does not mean none exist.

Sources

• Django 6.1.3 release notes
• Django on PyPI
• Node.js 26.13.0 release post
• Astro v7 upgrade guide
• Astro on npm
• SvelteKit on npm
• Laravel framework on Packagist
• Wrangler on npm
• Elysia on npm
• Prisma on npm
• BullMQ on npm
• Better Auth on npm