Kubernetes 1.37.2, Next.js 16.5 Canary, Docker 29.9.2

Executive Summary

• Kubernetes published v1.37.2 plus patch releases v1.36.6, v1.35.10 and v1.34.13 on October 28. The GitHub release pages point to the changelog and do not summarise the contents.
• Next.js v16.5.0-canary.30 (October 28) replaces jsonwebtoken with fast-jwt, adds experimental.hydrationChangeEvent, and fixes a server reference transform bug. Stable 16.4.3 is the current backport line.
• Docker Engine 29.9.2 (October 20) updates Go to 1.26.10 and now rejects certificate chains containing eight revoked eMudhra intermediates (CVE-2026-111943).
• Keycloak 26.8.1 (October 13) is a security patch release covering forged backchannel logout tokens, a SAML redirect signature issue and more.
• React 19.3.1 and its backports (October 14) harden the Server Components transport protocol.
• Hono 4.13.14 (October 25) is still the latest stable, with Hono 5 in release candidate.

A note on scope: today's primary-source activity was concentrated in Kubernetes and Next.js canary. The other items below are recent releases that are still the current stable versions, so check your pins against them. I found no verifiable October 28-29 releases for the other tools on the audit list, and I have not listed any.

Kubernetes v1.37.2 and three backports

All four supported minor lines received patch releases on October 28: v1.37.2, v1.36.6, v1.35.10 and v1.34.13. A v1.38.0-alpha.3 pre-release shipped the same day. The release page defers to the v1.37 changelog for details, so read it before rolling out.

# Check what your clusters run, then compare with the new patch versions
kubectl version
kubectl get nodes -o custom-columns=NAME:.metadata.name,KUBELET:.status.nodeInfo.kubeletVersion

Patch releases within a minor line are the safe upgrade path. Upgrade the control plane first, then nodes, one minor line at a time.

Next.js 16.5.0-canary.30 and 16.4.3

The v16.5.0-canary.30 canary includes:

• jsonwebtoken replaced by fast-jwt (#100818).
• A new experimental flag, experimental.hydrationChangeEvent (#99610).
• A fix for the server reference transform on export const foo = function bar(){} (#100830).
• Agent Feedback now includes model metadata and ships a CLI for reviewing it.

// next.config.ts
import type { NextConfig } from 'next'

const config: NextConfig = {
  experimental: {
    hydrationChangeEvent: true, // canary only
  },
}

export default config

On the stable line, v16.4.3 (October 23) fixes extensionless Google font URLs in both bundlers, keeps OpenTelemetry request traces together, and stops proxy.ts loading the app-page runtime. Earlier, v16.4.0 (October 7) was the stable release; see the Next.js 16.4 announcement. Canary builds are not for production.

Docker Engine 29.9.x

Docker 29.9.2 (October 20) updates the Go runtime to 1.26.10. That rejects certificate chains that include eight revoked eMudhra intermediate certificates (CVE-2026-111943). If a private registry's chain relies on them, pulls and pushes can fail TLS verification and the registry needs a new chain.

Docker 29.9.1 (October 14) updated containerd to v2.4.2 for three containerd vulnerabilities and fixed a docker save layer leak. Docker 29.9.0 (October 8) added a lazy-pull daemon feature for remote snapshotters.

docker version --format '{{.Server.Version}}'
docker pull your-registry.example.com/app:latest  # confirm TLS still verifies after upgrading

Keycloak 26.8.1

Keycloak 26.8.1 (October 13) is security-focused. Fixes include:

• CVE-2026-18569: the OIDC broker backchannel logout accepted forged logout tokens when signature validation was disabled.
• CVE-2026-97846: Standard Token Exchange issued an active bearer token without the required mTLS certificate binding.
• CVE-2026-94001: admin credential deletion bypassed the denied reset-password permission.
• CVE-2026-95503: potential KDC spoofing with Kerberos password authentication.
• A SAML broker HTTP-Redirect signature issue that could allow unauthenticated login as an arbitrary user.

Keycloak 26.8.0 (October 1) promoted OID4VCI to preview and added token exchange delegation for clients such as AI agents. If you are on 26.7.x or earlier, move to 26.8.1.

React 19.3.1

React's October 14 patch releases (19.3.1, 19.2.9, 19.1.10, 19.0.9) improve the Server Components transport protocol. React 19.3.0 (September 9) added <ViewTransition /> and Fragment refs. Upgrade within your minor line.

Hono 4.13.14

Hono 4.13.14 (October 25) restricts serve-static to GET and HEAD, makes precompressed file selection respect Accept-Encoding q-values, and keeps the first value for duplicate path params in the trie router. Hono 5.0.0-rc.1 is out for early testing.

Action checklist

• Plan Kubernetes patch upgrades for your minor line.
• Test registry TLS after upgrading to Docker 29.9.2.
• Move Keycloak 26.7.x or older deployments to 26.8.1.
• Keep Next.js canary builds out of production; use 16.4.3.

Version details come from the official GitHub release pages and the Releasebot index linked above. Confirm against the linked release notes before pinning.