Weekend Release Audit: Next.js 16.4.2, Docker 29.9.1

Executive Summary

• Next.js 16.4.2 is the current stable patch, and the 16.5.0 canary line is still moving (canary.17 shipped Oct 17). See the 16.4.2 release.
• Docker Engine 29.9.1 moves containerd to 2.4.2 to fix three vulnerabilities: release notes.
• Node.js 26.12.0 and 24.22.0 LTS landed Oct 14 with new crypto and HTTP WebSocket helpers: v26.12.0.
• React 19.3.1, 19.2.9, 19.1.10 and 19.0.9 improve the Server Components transport protocol across all supported lines: 19.3.1.
• Keycloak 26.8.1 shipped Oct 13: 26.8.1 release.
• Nothing new broke in the last 24 hours. Sunday was quiet, so this audit covers the last few days of releases that are still worth acting on.

Next.js and React

The out-of-band October 14 security update fixed two critical RCEs (SVG image processing, CVE-2026-96889, and a use cache typed-array issue) plus a Server Actions DoS in 15.5.28 and 16.4.1; see also Netlify's summary. Next.js 16.4.2 follows with Turbopack and turbo-tasks consistency fixes and Pages Router dev graph fixes, with no new advisories. Pin to at least 16.4.2 (or 15.5.28 on the 15 line) and check the releases page for 16.5.0 canaries before adopting them; canary.17 only touches Turbopack persistence prefetching.

Because the RSC fixes are in the transport protocol, update React together with Next.js and rebuild your lockfile:

npm install [email protected] [email protected] [email protected]

Docker, containerd and Kubernetes

Docker Engine 29.9.1 is a security update that bumps containerd to 2.4.2 (three vulnerabilities) and adds networking and rootless fixes. It builds on 29.9.0, which updated the Go runtime for HTTP/2 and Windows junction vulnerabilities. Upgrade hosts and CI runners, then verify with docker version. Kubernetes has no new stable tag since 1.37.1 (Sept 23); 1.38.0-alpha.2 is the latest pre-release (see releases).

Node.js, Keycloak, SvelteKit and Astro

• Node.js: 24.22.0 'Krypton' LTS adds crypto.parsePKCS12(), a generic MAC API, util.throttle and util.debounce (notes).
• SvelteKit 3.1.0: adds CSP report-sha256/384/512 hash-reporting keywords and a tracing span for +server handlers; adapter-cloudflare 8.0.1 and adapter-vercel 7.0.1 ship fixes (releases).
• Astro: the Vue, Svelte and React integrations now require Node.js 22.22.0 or newer (releases). Check CI images before upgrading.
• Keycloak 26.8.1: patch release on Oct 13, following 26.8.0 (Oct 1); read the release page for details before rolling out.

Data, ORMs and Still-Relevant Security Fixes

Redis 8.10.2, 8.8.3 and 8.6.7 (Sept 17) fixed ACL bypass in queued transactions and unauthenticated cluster bus traffic, adding cluster-bus-port-protected-mode; if you have not patched, do it now (releases). Drizzle ORM 0.45.4 fixes explicit prepared queries on postgres-js (releases). Prisma 8.0.0 is still in release-candidate dev builds (releases), and Hono v5.0.0-rc.1 is out for testing (releases).

Action Checklist

1. Upgrade Next.js to 16.4.2 (or 15.5.28) with matching React patches.
2. Roll Docker Engine 29.9.1 to hosts and CI runners.
3. Confirm Redis is on a patched 8.x line and Astro CI uses Node 22.22.0 or newer.

Scope note: this audit used release feeds for the headline projects. Tools not mentioned had no release confirmed in this window.