Redis Fixes a Critical RCE, Supabase Defaults to Envoy, and the Queue Layer Ships Security Patches: July 24, 2026 Developer Changelog

Executive Summary

• Critical: Redis 8.6.5 (released yesterday, July 23) patches a crafted-stream RESTORE use-after-free that can lead to remote code execution, plus a second RCE-class bug in RedisBloom/TDigest RESTORE payloads. Upgrade immediately.
• Supabase pushes two breaking changes this week: self-hosted deployments now default to the Envoy API gateway instead of Kong, and explicit extension-version pinning in CREATE/ALTER EXTENSION is being phased out starting August 5.
• BullMQ ships v5.81.1 today (July 24) with a job-retrieval transaction fix that was backported across its Python, Elixir, PHP, and Rust ports in the same release cycle.
• Temporal Server 1.31.2 closes CVE-2026-5724, a gRPC streaming-interceptor gap that let the replication API skip authorization entirely under certain cluster configs.
• RabbitMQ 4.3.4 and Apache Kafka carry fresh hardening: RabbitMQ tightens its management-UI Content-Security-Policy and fixes quorum-queue metrics after upgrades; Kafka's CVE-2026-41115 clarifies a DESCRIBE-vs-READ permission mismatch on consumer-group APIs.
• Identity platforms keep shipping: Clerk now supports one-command MCP server installs and is deprecating legacy CBC TLS ciphers; Auth0 rolled Anonymous Sessions into beta and made third-party app control self-service for org admins.
• A notable AI-agent security story: researchers disclosed a prompt-injection chain in AWS's Kiro IDE where hidden text on a webpage could rewrite Kiro's own MCP config and achieve remote code execution — patched in Kiro v0.11.130.
• UI ecosystem shift: shadcn/ui now defaults new projects to Base UI instead of Radix (Radix remains fully supported via an opt-in flag), alongside a first-class React Aria integration.
• Data layer: ClickHouse shipped five stable builds in the last three days, DuckDB 1.5.5 lands correctness and security fixes, and PostgreSQL 19 Beta 2 freezes its feature set — including native SQL/PGQ graph queries — ahead of a fall GA.
• Still open from earlier this week and worth checking off if you haven't: the Next.js July security release (8 CVEs, several SSRF/auth-bypass class), Keycloak 26.7.0's admin-role privilege-escalation fix, and Django's 6.0.7/5.2.16 security release.

Caching & Data Layer: Redis Ships an Emergency RCE Fix

Redis 8.6.5 landed July 23 marked with the highest urgency level Redis publishes: SECURITY. Two issues stand out. First, a crafted stream RESTORE payload could let two consumers share the same NACK, producing a use-after-free that the release notes say may lead to remote code execution. Second, crafted RESTORE payloads targeting RedisBloom or TDigest data structures could trigger out-of-bounds writes with the same RCE risk. A third, lower-severity fix corrects CF.LOADCHUNK replication so Cuckoo Filter data no longer silently disappears after failover.

No CVE numbers were attached to the 8.6.5 notes themselves, but the pattern mirrors the CVE-2026-23479/25243/23631/25588/25589 cluster of RESTORE-related use-after-free bugs Redis fixed in 8.6.3 back in May — treat this as the same bug class recurring and prioritize the upgrade if you accept untrusted RDB/RESTORE payloads anywhere in your pipeline.

redis-cli INFO server | grep redis_version
# Upgrade to 8.6.5 if you're behind
docker pull redis:8.6.5

Background Jobs & Messaging: BullMQ, Temporal, RabbitMQ, and Kafka

BullMQ v5.81.1 shipped today (July 24) with a fix so job retrieval under getJobs happens inside the same transaction — the same patch was ported to BullMQ's Python, Elixir, PHP, and Rust bindings in lockstep. It follows a busy week of releases: a flow-producer performance improvement (v5.80.9) and a scheduler fix for stale slots on re-upsert (v5.80.8).

Temporal Server 1.31.2 (with 1.30.6, 1.29.6, and 1.28.4 backports) fixes CVE-2026-5724: the frontend gRPC server's streaming interceptor chain omitted the authorization interceptor, so AdminService/StreamWorkflowReplicationMessages accepted unauthenticated requests even with a ClaimMapper/Authorizer configured. There's an escape hatch (system.disableStreamingAuthorizer) for operators whose replication breaks after patching, but leaving it set to true re-opens the gap — treat it as a temporary bridge, not a fix.

RabbitMQ 4.3.4 hardens the management UI's Content-Security-Policy (dropping unsafe-eval/unsafe-inline), fixes quorum queues that stopped emitting metrics after a node restart, and patches AMQP 1.0 parser edge cases. On the Kafka side, CVE-2026-41115 documents a mismatch where the CONSUMER_GROUP_DESCRIBE API checked DESCRIBE permission on the GROUP resource where KIP-848's docs implied READ should apply — Apache's resolution was to update the docs rather than the code, so review your group ACLs against the clarified behavior rather than waiting on a patch.

Identity & Auth: Clerk, Auth0 Ship Fast; Keep an Eye on TLS Cipher Deprecation

Clerk shipped clerk mcp install this week, a one-command way to register Clerk's MCP server across ten AI clients (Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, and others), replacing the old npx mcp-remote workaround. More consequential: Clerk is deprecating 11 CBC-mode TLS cipher suites on Clerk-managed subdomains starting January 18, 2027 — modern AEAD-based clients are unaffected, but if you have legacy clients pinned to specific ciphers, this is a nine-month runway to test against.

Auth0 moved Anonymous Sessions into beta (a new POST /anonymous/token endpoint for stateless unauthenticated sessions that can later link to an authenticated one), made Self-Service Enterprise SSO Configuration available so customer admins — not Auth0 support — control third-party app access during SSO setup, and shipped IPSIE session_expiry claim support for Okta/OIDC enterprise connections, enforcing an upstream session ceiling per the IPSIE SL1 profile.

Backend-as-a-Service: Supabase's Envoy Cutover and a Breaking Extension Change

Two breaking changes landed on Supabase this week. Self-hosted deployments now default their API gateway to Envoy instead of Kong. And starting August 5, explicit version clauses in CREATE EXTENSION ... VERSION / ALTER EXTENSION statements are ignored in favor of the default version — a warning fires now, a hard error lands later. The stated goal is preventing deployments from silently staying pinned to a vulnerable extension build.

-- Before Aug 5, 2026 this pins a version; after, the clause is ignored
CREATE EXTENSION IF NOT EXISTS pgvector WITH VERSION '0.8.4';
-- Audit any migration scripts that rely on explicit VERSION clauses
SELECT extname, extversion FROM pg_extension;

Also worth a calendar note: Supabase's Management API is retiring the logs.all analytics endpoint on September 23 in favor of a new ClickHouse-backed logs endpoint — teams querying logs programmatically will need to convert to ClickHouse SQL and filter by source_name.

AI-Agent Security: A Prompt-Injection RCE in AWS Kiro

Security researchers at Intezer disclosed a chain in AWS's Kiro agentic IDE where hidden or invisible text embedded in a webpage — content the agent reads while browsing on the user's behalf — could instruct Kiro to rewrite its own MCP configuration file, ultimately achieving remote code execution on the developer's machine. A related variant is tracked as CVE-2026-10591 (CVSS 8.8/3.1). AWS shipped a fix in Kiro v0.11.130. Separately, AWS published two unrelated bulletins this month: CVE-2026-15643 (SSRF via unvalidated pagination in the healthlake-mcp-server, before v0.0.14) and CVE-2026-15746 (Strands Agents Tools' elasticsearch_memory tool could be prompted into leaking an operator's API key to an attacker-controlled host).

The common thread across all three: as agentic tools gain the ability to read untrusted content and act on it, the untrusted content itself becomes an attack surface. Treat any MCP server or agent tool that ingests external web content or documents as needing the same input-validation discipline as a public API endpoint.

Edge, Frameworks & UI: Cloudflare, Astro, Elysia, and shadcn/ui

On Cloudflare, the legacy Workers KV namespace routes (/workers/namespaces/) are deprecated in favor of /storage/kv/namespaces/, with removal set for October 15 — migrate now if you're calling the old routes directly. @cloudflare/workers-types v5 also trimmed the package down to only the latest runtime types.

Astro 7.1.3 fixes image optimization spawning too many parallel processes during astro build in CPU-limited containers — a real fix for OOM crashes in Docker/CI builds. The preceding 7.1.0 minor added a deferRender content-loader option and CSP directive support for script-src-elem/style-src-attr.

Elysia published a 2.0.0-exp.47 experimental prerelease today, the clearest signal yet of active work toward a 2.0 stable line — worth watching, not yet adopting.

And in the component-library space, shadcn/ui now defaults new shadcn init projects to Base UI instead of Radix — Radix isn't deprecated and keeps full parity, opt back in with shadcn init -b radix. React Aria also joins as a first-class base alongside the other two. Radix primitives themselves are still shipping: v1.1.21 (July 22) fixed broken ARIA references in Dialog and a Tooltip double-mount bug.

# Keep using Radix explicitly under the new default
npx shadcn@latest init -b radix

Data Layer: ClickHouse's Rapid Cadence, DuckDB 1.5.5, and Postgres 19 Beta 2

ClickHouse cut five stable builds in the last three days alone (26.7.1, 26.5.6, 26.4.5, 26.6.2, 26.3.17-lts) — a reminder that its release cadence rewards pinning a specific stable/LTS line rather than tracking latest blindly. DuckDB 1.5.5 (July 22) fixes a correctness bug in 128-bit DECIMAL min/max stats across row groups, a TemporaryMemoryManager deadlock, and metadata corruption on DROP COLUMN — plus security patches the release notes don't itemize by CVE.

PostgreSQL 19 Beta 2 (July 16) freezes the feature set ahead of a fall GA: native SQL/PGQ graph queries, a unified zero-downtime REPACK command, and temporal tables via FOR PORTION OF syntax. pgvector 0.8.5 trims memory usage during IVFFlat index builds on small tables.

Still Open From Earlier This Week

If any of these haven't made it into your patch cycle yet, they're worth prioritizing over today's news:

• Next.js — the July 20 security release (v16.2.11 / v15.5.21) fixes 8 CVEs, including Server Actions SSRF and a Turbopack middleware-bypass bug. See the official advisory at nextjs.org/blog/july-2026-security-release.
• Keycloak 26.7.0 — patches CVE-2026-9796, an admin role-rename TOCTOU bypass that escalates from manage-clients to realm-wide privilege, plus three other CVEs.
• Django 6.0.7 / 5.2.16 — three low-severity CVEs, including a cache-middleware issue that could leak sensitive cookies through Django's shared response cache.
• Docker Engine 29.6.2 — five BuildKit CVEs, including a git-source checkout bug that enables command injection via a crafted bundle file.
• Node.js has a security release scheduled for July 27 — not yet published as of this digest, but flagged in advance on the official vulnerability blog.