NestJS 11.2.8 Fixes, Better Auth 1.7.13, Hono 4.13.14

Executive Summary

• NestJS 11.2.8 (Oct 23) is a security-hardening patch: stricter ParseArrayPipe and ValidationPipe input handling, and SSE/StreamableFile error leaks closed. See NestJS releases.
• Better Auth 1.7.13 (Oct 25) follows 1.7.12's action-required ID token checks; 1.8.0-beta.2 changes provider profile types. See Better Auth releases.
• Hono 4.13.14 (Oct 25) restricts serve-static to GET/HEAD and fixes duplicate path-param routing; v5 is in RC. See Hono releases.
• Next.js 16.4.3 is the current stable (v16.4.3), and BullMQ 6.4.2 (Oct 24) pins a patched fast-uri (BullMQ releases).
• Prisma 8 RC 20 and Drizzle 1.0 RC5 continue shipping breaking changes in pre-release; stable Prisma is 7.10.1. See Prisma and Drizzle releases.

NestJS 11.2.8: Input and Error Hardening

The v11 patch line gets the same hardening landed in v12.2.0 (Oct 19): ParseArrayPipe rejects non-numeric and nested-array items, ValidationPipe rejects arrays and primitives sent for validated classes, middleware exclusion matching is tighter, and internal error messages no longer reach clients through StreamableFile errors or SSE error events. Clients that stop reading an SSE stream are now dropped. On v12, new limits are configurable, for example:

app.useGlobalPipes(new ValidationPipe({ maxErrorMessagesLength: 20, whitelist: true }));

Watch for stricter FileTypeValidator matching on v12 (font/woff no longer accepts font/woff2). Upgrade notes: release page.

Better Auth 1.7.13 and the 1.7.12 Action Item

1.7.13 fixes type-only exports so wrong value imports fail at type-check time, adds token endpoint auth options for the Vercel and Cloudflare providers, and supports Stripe SDK v23. More important is 1.7.12 (Oct 20): ID token sign-in now rejects providers with no clientId, the JWT plugin verifies with the stored key's algorithm, OIDC/SSO flows reject ID tokens missing exp or iat, and requireMcpAuth accepts only OAuth access tokens. Make sure every client ID is configured:

socialProviders: { google: { clientId: process.env.GOOGLE_ID!, clientSecret: process.env.GOOGLE_SECRET! } }

Hono 4.13.14

serve-static now handles only GET and HEAD, honors q-values in Accept-Encoding for precompressed files, the trie router keeps the first value for duplicate path params, and bearer-auth's MessageFunction can return a Response. v5.0.0-rc.1 (Oct 10) is accepted in the hono peer range.

Next.js, Nuxt, Astro and Node.js

Next.js 16.4.3 (Oct 23) fixes extensionless Google font URLs in both bundlers and stops loading the app-page runtime in proxy.ts (notes); 16.5.0 canaries continue daily. Nuxt 4.6.2 remains current (releases). Reminder: the Oct 21 Node.js security releases (22.23.4, 24.22.1, 26.12.1) have no workaround; rebuild Docker images on the fixed runtime (advisory). Astro's tooling now requires Node 22.23.4 or later.

Prisma, Drizzle, BullMQ and Keycloak

Prisma 8.0.0-rc.20 requires @prisma/cli-engine 0.9.0 and needs --json for scripts reading piped output; rc.19 changed @default to mean a database default (use @onCreate/@onUpdate for client values). Stay on 7.10.1 for production. Drizzle 1.0.0-rc.5 now throws on undefined in relational where filters (use EmptyFilter) and routes all withReplicas queries to primary unless you use db.$replica. BullMQ 6.4.1 and 6.4.2 are dependency security patches. If you run Keycloak, 26.8.1 (Oct 13) remains the patch to be on, fixing roughly 20 CVEs (releases).