September 2026 Stack Release Audit: Keycloak, Docker, Next.js and More

Today's cross-stack release audit pulled changelogs, GitHub release tags, security advisories, and package registries across more than 30 tools spanning infrastructure, identity, frameworks, databases, and messaging. Three items need attention first: a six-CVE Keycloak security release, a Docker Desktop kernel-panic fix, and Cloudflare's new 64 MiB Worker size ceiling. The full breakdown follows below, category by category.

Executive Summary

• Keycloak 26.7.4 patches six CVEs, including an unauthenticated denial-of-service via unbounded locale caching and a native-memory-exhaustion bug in SAML redirect DEFLATE handling — self-managed deployments should upgrade immediately.
• Docker Desktop fixed CVE-2026-8936, a VM panic caused by unbounded recursion in the grpcfuse kernel module, alongside Compose v5.1.4 and Docker Scout CLI v1.21.0 bumps.
• Cloudflare Workers now allow 64 MiB uncompressed bundles on every plan, and Cloudflare shipped four granular per-Worker permission roles for teams, CI/CD, and agents.
• PostgreSQL is heading into its version 19 GA window this month; 18.6, 17.11, 16.15, 15.19, and 14.24 already shipped as maintenance releases, and PostgreSQL 14 exits support once 19 lands.
• Redis Software for Kubernetes 7.22.2-45 closes a high-severity Active-Active bug that let mTLS-configured databases accept unauthenticated connections.
• Django 6.1.1 and Django REST Framework 3.18.1 both shipped maintenance patches this month, and Laravel added queue-lifecycle events and Eloquent write-path improvements.
• Prisma 8 is now in release-candidate status while Drizzle ORM continues shipping 0.45.x with a 1.0 beta in progress.
• ClickHouse 26.8 LTS landed with a new pipe (|>) query operator, custom HTTP handlers, and CJK-aware text tokenizers.

Containers, Edge & Infrastructure

Docker (Engine, Compose, Desktop)

This cycle's Docker Desktop release notes describe a stability-focused update. The security-relevant fix is CVE-2026-8936, a VM panic triggered by unbounded recursion in the grpcfuse kernel module — patch to the current build if you're running an older Desktop release. Component versions also moved forward: Docker Desktop Build v0.35.0, Docker Agent v1.62.0, NVIDIA Container Toolkit v1.19.1, Docker Compose v5.1.4 (see the Compose release notes), Docker Scout CLI v1.21.0, and docker pass v0.0.29.

Notable bug fixes worth knowing about if you've hit them:

• A five-minute delay in reporting the engine as stopped when the underlying VM stopped unexpectedly.
• A missing CNI loopback interface name in Kubernetes (kubeadm) setups.
• Inaccurate "Last modified" timestamps (e.g. "57 years ago") in the Volumes and container filesystem browsers.
• Invalid `export PATH` syntax written into csh/tcsh profiles when adding ~/.docker/bin to PATH.

services:
  app:
    image: myorg/app:latest
    # pin the Compose file schema explicitly once you're on Compose v5.1.4+

Cloudflare (Workers, Pages, KV, R2)

Cloudflare made two developer-facing platform changes this month. Workers can now deploy up to 64 MiB of uncompressed bundle on both free and paid plans — Cloudflare now checks only the uncompressed size, which unblocks heavier frameworks and dependency trees that previously tripped the old compressed-size cap. Separately, Cloudflare rolled out granular per-Worker permissions with four roles — Metadata Read-Only, Content Read-Only, Editor, and Admin — for scoping access to teammates, CI/CD pipelines, and agents. On the Workflows side, instances created on or after September 10, 2026 on the Workers Paid plan now retain completed/errored state for 7 days by default instead of 30, which will affect anyone polling old instance IDs for debugging.

Vercel (Next.js hosting, Serverless, Edge Functions)

Vercel's changelog shows AI Gateway gaining Claude Fable 5.1 access behind a single API key, with automatic fallbacks, spend tracking, and request tracing. AWS PrivateLink also went generally available, letting Vercel deployments reach AWS-hosted databases and services over a private network path instead of the public internet.

Kubernetes, Podman & Cloud Platforms (AWS, Railway, Render)

No dated September security advisories or major version bumps surfaced for Kubernetes, Podman, AWS, Railway, or Render in today's sweep. That's a gap in aggregator coverage rather than a confirmed all-clear — teams on these platforms should check Kubernetes' own release feed and Podman's GitHub releases directly before the next audit cycle.

Identity & Authentication (IAM)

Keycloak

Keycloak 26.7.4, published September 16, is the headline security item in today's audit — six CVEs, two of them independently exploitable without authentication:

• CVE-2026-90997 — default MySQL/MariaDB row counts let stateless replay gates accept reused artifacts.
• CVE-2026-79651 — unauthenticated denial of service via unbounded locale caching.
• CVE-2026-74909 — an incomplete prior fix still lets percent-encoded semicolons bypass matrix-parameter stripping.
• CVE-2026-19607 — username takeover leading to account lockout.
• CVE-2026-17526 — privilege escalation via the impersonation role.
• CVE-2026-18212 — SAML redirect DEFLATE helpers leak native zlib state, enabling unauthenticated native memory exhaustion from malformed SAML redirect requests.

Backports covering five of the six fixes also shipped for the 26.6.7 and 26.4.16 lines on September 16. Full details are in the official Keycloak 26.7.4 release announcement.

# bump a self-managed Keycloak container to the patched line
docker pull quay.io/keycloak/keycloak:26.7.4
docker service update --image quay.io/keycloak/keycloak:26.7.4 keycloak_keycloak

Authentik, Clerk & Auth0, Better Auth / Auth.js (NextAuth)

No dated September advisory surfaced for Authentik in today's sweep; check its GitHub releases directly if you self-host it alongside Keycloak. On the managed side, Clerk's Core 3 architecture keeps rolling out — ClerkProvider now mounts inside <body>, improving compatibility with Next.js caching and streaming — and its free tier now covers 50,000 monthly retained users; see the Clerk changelog. Better Auth remains the maintainer of Auth.js (formerly NextAuth), which stays in security-patch-only maintenance mode with no new feature development — track fixes via authjs.dev and better-auth.com.

Meta-Frameworks & Core Web Standards

Next.js & React

Next.js backported a cluster of bug fixes this cycle: skipping 0-byte entries when initializing the disk LRU cache, rejecting empty images on disk-cache read/write, emitting whole-app server NFTs when `output: 'standalone'` is combined with an adapter, adding a CSP nonce to script tags in loading/template files, and fixing `use cache` prerender-signal retention. On the experimental side, Turbopack shipped chunking controls aimed at faster navigations and shared code across pages, plus per-family compression that shrinks the Turbopack cache. Details land in the Next.js blog.

// next.config.js — opting into the experimental Turbopack chunking controls
module.exports = {
  experimental: {
    turbopackPersistentCaching: true,
  },
}

Nuxt & Vue.js

Nuxt quietly shipped a security-driven 4.5.2 patch on August 5, the same week Nuxt 3 hit end-of-life (July 31). The preceding 4.5 minor brought Vite 8, Rspack 2 via Rsbuild, experimental SSR streaming, a stable error-code system, and a new `useLayout` composable. See the Nuxt blog for the full 4.5 notes if you haven't upgraded off Nuxt 3 yet.

SvelteKit & Svelte

Per the official "What's new in Svelte" September 2026 post, Svelte 5.57 added `SvelteMap.getOrInsert`/`getOrInsertComputed` for the common read-or-initialize pattern, gave `createContext` a third `has()` function to check context presence without triggering the get error, and added `defaultValue` support to `<select>`. SvelteKit 3 is closing in on its release candidate, the `sv` CLI replaced its old `mcp` add-on with `ai-tools`, and `sv@next` now ships a task-based SvelteKit 3 migration path. The stable 2.x line also took three patch releases (2.70.1–2.70.3).

Astro

Astro 7.3.0 released September 3 as the latest patch on the Astro 7 line, which debuted in June on a Vite 8-based build pipeline with a new Rust compiler for faster builds. See the Astro site for the current release notes.

Backend Frameworks & Runtimes

NestJS & Node.js

NestJS 12 is oriented around ESM-ready packages, first-class Standard Schema support for validation and serialization, a rebuilt CLI, and native observability through a new `@nestjs/observe` SDK. Track progress via nestjs.com.

Fastify & Express

Fastify's stable line remains at 5.8.5; no September-dated Express changelog entry surfaced in today's sweep. Confirm directly against Fastify's GitHub releases and Express's changelog before assuming either is unchanged.

ElysiaJS & Hono (Bun/Edge runtimes)

Bun 1.4.2 shipped September 5 — the runtime both ElysiaJS and Hono lean on most heavily for edge/Bun deployments. No independently dated Elysia or Hono release turned up in today's sweep; see bun.sh for the Bun 1.4.2 notes.

Python Stack: FastAPI & Django

Django 6.1.1 landed September 2 as a maintenance patch two weeks after the 6.1 branch debuted (August 5), which itself pushed Django 6.0 out of mainstream support. Django REST Framework followed with 3.18.1 on September 7, fixing validation-error messaging and `FloatField` handling — see the DRF release notes. If you haven't already applied February's Django security releases (6.0.2, 5.2.11, 4.2.28 — a timing attack in authentication and a duplicate-header DoS in ASGIRequest), treat that as a standing gap, not just historical context. FastAPI's current stable is 0.141.1, shipping multiple minor releases per month through the summer.

PHP Stack: Laravel

Laravel added a `WorkerStopping` event for connections and queues, `Eloquent::insertOrIgnoreReturning`, the ability to drop vector indexes, and a SQL Server fix in early September. Two changes are security-relevant: HTML is now disabled in exception-page tooltips, and Laravel verifies that a password hash matches the stored cookie value before authenticating a "remember me" session. See Laravel's documentation for the current upgrade guide.

// Eloquent::insertOrIgnoreReturning — insert and get back the rows that were actually written
$inserted = User::insertOrIgnoreReturning([
    ['email' => '[email protected]', 'name' => 'A'],
    ['email' => '[email protected]', 'name' => 'B'],
]);

UI Systems, Styling & Motion

shadcn/ui, Radix UI & Tailwind CSS

shadcn/ui's public changelog has no dated September 2026 entry as of this audit; its most recent documented shift was February's move to the unified `radix-ui` package (replacing per-component `@radix-ui/react-*` packages) and full block parity between the Radix and Base UI variants. No new dated Tailwind CSS engine release surfaced either — track tailwindcss.com directly for the next cut rather than assuming this cadence holds.

Material UI (MUI) & Motion (Framer Motion)

No September-dated MUI changelog entry surfaced in today's sweep. Motion (the project formerly known as Framer Motion) continues shipping under its unified `motion` package — import from `motion/react`, not `framer-motion` — and its newest `AnimateView` entry point requires React and ReactDOM 19.3 or later. See the Motion changelog for the version history.

// Motion (formerly Framer Motion) — updated import path
import { motion } from 'motion/react'

Databases, Caching & Vector Search

PostgreSQL & PgVector

PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 shipped as maintenance releases on August 13, alongside 19 Beta 3. PostgreSQL 19 is scheduled for general availability this month — once it lands, PostgreSQL 14 moves to end-of-life per the project's versioning policy. Check the security page before deferring any of the point releases.

Redis

Redis Software for Kubernetes 7.22.2-45 fixes a high-severity bug with real security impact: Active-Active databases could simultaneously accept connections with no credentials at all, and the mTLS variant could accept clients presenting no certificate — meaning a database could run fully exposed without anyone noticing. Full notes are in the Redis Kubernetes release notes.

MongoDB

No new MongoDB patch surfaced dated this month in today's sweep. If you haven't already, confirm you're on a build that fixes MongoBleed (CVE-2025-14847), an unauthenticated out-of-bounds read disclosed in December 2025 and fixed in 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, and 4.4.30 — check your version against endoflife.date/mongodb.

ClickHouse & DuckDB (Analytics/OLAP)

ClickHouse 26.8 LTS is the biggest OLAP release this cycle: custom HTTP handlers with dynamic query filtering (useful for exposing ClickHouse as a streaming HTTP API), a new pipe operator (`|>`) for writing queries as a sequence of transformations, a `system.user_query_log` table scoped to the current user, a URL database engine, and Japanese/Chinese text-index tokenizers. A new `disable_insertion_and_mutation` setting also blocks background consumption from Kafka, RabbitMQ, and NATS table engines while still allowing direct writes to external storage. Full notes: ClickHouse 2026 changelog. DuckDB has no September-dated release in today's sweep; its most recent LTS remains 1.4.0 ("Andium").

-- ClickHouse 26.8's new pipe operator, chaining transformations left to right
SELECT * FROM events
|> WHERE event_date >= today() - 7
|> AGGREGATE COUNT(*) AS cnt BY user_id
|> ORDER BY cnt DESC
|> LIMIT 10;

Database Tools, ORMs & BaaS

Prisma ORM

Prisma 7.10 remains the current stable line while Prisma 8 sits at release-candidate status (8.0.0-rc.11 published to npm). The RC brings renamed CLI environment variables, new Prisma 8 schema headers, and updated upgrade guidance — worth reading closely before migrating a production schema. See Prisma's documentation.

Drizzle ORM

Drizzle 0.45.2 is the current stable release with 1.0 in beta; the Drizzle team now works at PlanetScale. Recent changes add a `.if()` helper to all WHERE expressions and fix internal session mapping for `.all()`/`.values()`/`.execute()` on the AWS Data API driver. Full history: Drizzle's latest releases.

// Drizzle's new .if() helper on WHERE expressions
const rows = await db
  .select()
  .from(users)
  .where(eq(users.active, true).if(includeInactive === false))

Supabase & Firebase

Supabase raised Edge Function limits this month — Pro moved from 500 to 1,000 functions and Team from 1,000 to 2,000 — and relocated read-replica management to Project Settings → Infrastructure, which now handles listing, topology, and adding replicas in one place. Supabase also shipped new AI-facing monitoring tools, including a `query_logs` tool, to help agents check health, security, performance, and capacity. See the Supabase changelog for details. No September-dated Firebase changelog entry surfaced in today's sweep.

Background Jobs, Messaging & Task Queues

BullMQ, RabbitMQ, Kafka, and Temporal had no September 2026-dated release notes surface in today's sweep — their last verified stable tags predate this month (RabbitMQ 4.3.2, for instance, shipped in June). Treat this category as unchanged since the prior audit rather than confirmed stable, and check the primary sources directly before the next cycle: RabbitMQ release information, BullMQ, and Temporal's blog.

What to Patch Today

• Upgrade Keycloak to 26.7.4 (or the 26.6.7 / 26.4.16 backports) — two of the six fixed CVEs are unauthenticated.
• Update Docker Desktop to pick up the CVE-2026-8936 grpcfuse fix and the Compose v5.1.4 / Scout CLI v1.21.0 bumps.
• If you run Redis Software for Kubernetes with Active-Active databases, move to 7.22.2-45 to close the unauthenticated-connection bug.
• Confirm MongoDB is on a MongoBleed-fixed build (8.2.3 / 8.0.17 / 7.0.28 / 6.0.27 / 5.0.32 / 4.4.30) if that upgrade is still pending.
• Budget time for the PostgreSQL 19 GA and Postgres 14 end-of-life this month.