NestJS 12.4.0, Hono 4.13.17 and Tailwind 4.3.5: Dev Stack Release Audit, November 7, 2026

A quieter Saturday across the stack, but with three releases worth reading: NestJS 12.4.0, Hono 4.13.17 and Tailwind CSS 4.3.5. I checked release notes where I could open them and the npm registry for everything else. Where I only have a version and a timestamp, I say so.

Executive Summary

• NestJS 12.4.0 lets handlers return a web Response or a stream, adds per-view locals on the Node adapter, and fixes a batch of MQTT, gRPC and routing bugs. No breaking changes are listed in the release notes.
• Hono 4.13.17 is bug-fix only, with no advisory IDs attached. Several fixes touch escaping, cookie prefixes and CSP nonces, so I'm treating it as a patch to take soon. See the release notes.
• Tailwind CSS 4.3.5 fixes a color-mix() crash, a hanging WASI build and CSS comment parsing. Notes are on the release page.
• BullMQ 6.7.1 bumps semver to 7.8.6 and is tagged as a security update (release).
• Also published, notes not reviewed: Vue 3.5.45, SvelteKit 2.70.4, Wrangler 4.158.0, Motion 14.10.1, Prisma 8.0.0-rc.33 and Elysia 2.0.0-rc.3.

NestJS 12.4.0

Published November 6. The headline change is that a handler can now return a web Response or a stream and Nest will send it. I haven't verified the exact adapter behavior beyond the release notes, so test streaming routes on your platform before relying on it.

import { Controller, Get } from '@nestjs/common';

@Controller('reports')
export class ReportsController {
  @Get('health')
  health() {
    // Per the 12.4.0 notes, handlers can return a web Response
    return new Response(JSON.stringify({ ok: true }), {
      headers: { 'content-type': 'application/json' },
    });
  }
}

Other items from the notes:

• The Node platform adapter can set locals for every view (#18396).
• MQTT servers ignore their own replies under wildcard subscriptions (#18418), and the MQTT client awaits close and resets state (#18393).
• gRPC call options are forwarded on request streams (#18392).
• Routes sharing a path shape get their own params (#18415), and middleware runs on subpaths next to an all-methods route (#18407).
• On Fastify, a path refused by the static plugin now returns 403 (#18414), and @fastify/cors moves to 11.4.1 (#18422).
• express, node and fastify platform packages now declare rxjs as a peer dependency (#18400). Check your lockfile if you use strict peer resolution.

npm install @nestjs/[email protected] @nestjs/[email protected] @nestjs/[email protected]

Hono 4.13.17

Bug fixes only, and the release page lists no CVE or GHSA IDs. The fixes I'd care about on a production edge app:

• __Secure- and __Host- cookie prefixes are matched case-insensitively, including in CookieConstraint (#5608, #5611).
• JSX escapes element and object attribute values (#5512), and the CSP nonce is added to all scripts generated by ErrorBoundary (#5430).
• Server-Timing descriptions escape double quotes and backslashes (#5478).
• Query key matching no longer spans across separators (#5607).
• ETag keeps commas inside quoted entity tags (#5353), and discarded bodies are canceled in ETag and pretty-json (#5606).
• AWS Lambda adapter sanitizes non-ASCII header values on API Gateway v2 events (#5483).

npm install [email protected]

The notes don't call these security fixes, so I won't either, but escaping and cookie-prefix handling are the kind of changes you don't want to lag on. Hono shipped a security batch earlier this week as well.

Tailwind CSS 4.3.5

A fixes-only release, per the release notes:

• Faster canonicalization in projects with many functional variant values, such as a matchVariant plugin with thousands of values.
• color-mix() without an interpolation method no longer crashes or emits a fallback with the wrong color.
• @tailwindcss/oxide-wasm32-wasi loads instead of hanging, including in WebContainers, and detects new and changed files after the first scan.
• HTML-style comment markers (<!--, -->) between top-level rules are ignored.
• @tailwindcss/node types no longer error with skipLibCheck: false.
• The @tailwindcss/turbopack README no longer recommends as: '*.css', which broke CSS modules.

BullMQ 6.7.1

One change: semver goes to 7.8.6 (PR #5077), tagged as a security update on the release page. It's a transitive dependency bump, so the practical exposure depends on how you use it. Updating is cheap.

npm install [email protected]

Published today, notes not reviewed

I could confirm these versions on npm but did not read their changelogs, so I'm not making claims about contents:

• Vue 3.5.45 (Nov 5)
• SvelteKit 2.70.4 (Nov 5)
• Wrangler 4.158.0 (Nov 5)
• Motion 14.10.0 and 14.10.1 (Nov 6)
• Prisma 8.0.0-rc.33 (Nov 6, release candidate)
• Elysia 2.0.0-rc.3 (Nov 5, release candidate)
• Better Auth 1.7.18 (Nov 5)

Not covered today

I couldn't read GitHub release data for Docker, Kubernetes, Keycloak, Authentik, Postgres, Redis, MongoDB, ClickHouse, DuckDB, Kafka, RabbitMQ, Temporal, Django, Laravel and others in this run, so no claims here about them. For the Next.js security release of November 3, see the Next.js advisory post, and for yesterday's Django and Astro coverage see the November 6 audit.

Sources

• NestJS v12.4.0 release
• Hono v4.13.17 release
• Tailwind CSS v4.3.5 release
• BullMQ v6.7.1 release
• Next.js security release notice
• npm registry for version and timestamp checks