Weekly release digest · 2026-W42 · 5 Oct – 12 Oct 2026
Upstream Weekly,week of 12 Oct 2026
1 need action, 4 need review, 18 FYI.
27 repos checked36 releasesLast run 12 Oct 2026, 17:07 (Asia/Kolkata)~4 min read
This week at a glance
Express v5.3.0 requires immediate action because it fixes CVE-2026-2391 and resolves Content-Length/Transfer-Encoding conflicts. Across 27 checked repositories and 36 releases, 1 item requires immediate action, 4 require review, and 18 are FYI. Zero repositories could not be checked.
- Check whether your pinned version of expressjs/express is below v5.3.0, and upgrade if it is.
- Read the migration notes for v8.0.0-rc.17 before upgrading prisma/orm, and keep your current range pinned until call sites are checked.
- Treat v5.0.0-rc.0 as a major upgrade: review the release notes before widening your version range.
Written by Gemini Flash using only the items below, and checked for invented versions or IDs.
Tier 1
Act now
Security fixes and urgent upgrades. Check the quoted evidence, then act.
expressjs/expressv5.3.0
platform · normal priority
Express v5.3.0 fixes security vulnerabilities in dependencies, resolves Content-Length/Transfer-Encoding conflicts, and adds QUERY request revalidation.
Quoted from the release notes: Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denia…
Why flagged: The notes say “fixes CVE-2026-2391” (affects HTTP handling and dependencies).
Next step: Check whether your pinned version of expressjs/express is below v5.3.0, and upgrade if it is.
Key changes (4) and source
- Upgrade qs, proxy-addr, and body-parser dependencies to fix multiple security vulnerabilities (CVEs)
- Prevent Content-Length and Transfer-Encoding header conflicts in res.send()
- Allow conditional freshness revalidation for QUERY requests in req.fresh
- Upgrade content-type, content-disposition, and enhance default error handler logging
Area: HTTP handling and dependencies · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for expressjs/express v5.3.0 (opens in a new tab)
Tier 2
Review
Breaking changes, major version bumps, and items worth a closer look before your next upgrade.
prisma/ormv8.0.0-rc.17
data · normal priority
Prisma v8.0.0-rc.17 introduces stricter migration data loss consent, row locking in the ORM client, query fragments, and updated enum value handling.
Quoted from the release notes: --confirm no longer consents to data loss. prisma migration plan and prisma db update ask one question for each model, field or table a plan would lose data from, before they write or apply anything.…
Why flagged: The notes say “--confirm no longer consents to data loss.”.
Next step: Read the migration notes for v8.0.0-rc.17 before upgrading prisma/orm, and keep your current range pinned until call sites are checked.
2 more flagged releases of prisma/orm this week
Prisma v8.0.0-rc.16 updates @prisma/cli-engine to 0.6.3 to resolve ArkType conflicts, improves @default diagnostics, and updates extension internal APIs.
The notes say “The toolchain requires `@prisma/cli-engine` 0.6.3.”.
Prisma v8.0.0-rc.15 updates SQL contracts to use data type IDs, enhances codec validation, refines collection writes, and updates cache middleware.
The notes say “Each breaking change below names the change id to look for in them.”.
Key changes (4) and source
- --confirm no longer consents to data loss; explicit --delete or --rename flags are required during migrations and db updates.
- Added ORM collection row locking with forUpdate(), forNoKeyUpdate(), forShare(), and forKeyShare().
- Renamed collection methods apply to with, and scope to fragment in the SQL ORM client.
- db.enums now holds each member as read from the database, matching returned query values.
Area: migrations & ORM client · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for prisma/orm v8.0.0-rc.17 (opens in a new tab)
honojs/honov5.0.0-rc.0
evaluation · low priority
No release notes published.
Why flagged: The version moves from v4 to v5, a major version bump.
Next step: Treat v5.0.0-rc.0 as a major upgrade: review the release notes before widening your version range.
Key changes and source
No release notes published.
Area: not stated · Confidence: high · Summary: first lines of the notes
Read the release notes on GitHub for honojs/hono v5.0.0-rc.0 (opens in a new tab)
Tier 3
FYI
Everything else that shipped, grouped by the part of the product it touches.
payments
5 repos checked · 4 releasescheckout/checkout-sdk-node
5.7.0Added Cash App Pay and enhanced customer information support to the Payment Setups API, including JSDoc documentation updates and integration tests. Notes for checkout/checkout-sdk-node 5.7.0 (opens in a new tab)
checkout/checkout-sdk-node
5.6.0Release 5.6.0 improves documentation and test coverage for the Platforms API integration, focusing on sub-entities and identity document uploads. Notes for checkout/checkout-sdk-node 5.6.0 (opens in a new tab)
checkout/checkout-sdk-node
5.5.0Updated documentation and test cases to align airline and accommodation sub-tree models across payment API endpoints. Notes for checkout/checkout-sdk-node 5.5.0 (opens in a new tab)
stripe/stripe-node
v23.1.0-alpha.2Pre-releaseLow confidence, verify before actingv23.1.0-alpha.2 release notes refer to an external changelog without details. Notes for stripe/stripe-node v23.1.0-alpha.2 (opens in a new tab)
banking
4 repos checked · 1 releasemoov-io/ach
v1.64.0Added original control totals validation to achcli, updated CTX/ATX/TRX reply addenda checks, and enforced FileCreationTime hour ranges. Notes for moov-io/ach v1.64.0 (opens in a new tab)
platform
4 repos checked · 16 releasesnodejs/node
v26.11.1Node.js v26.11.1 reverts three recent commits concerning build tooling, doc-kit, and doc redesign. Notes for nodejs/node v26.11.1 (opens in a new tab)
nodejs/node
v26.11.0Node.js v26.11.0 introduces new buffer and HTTP validation APIs, perf_hooks updates, and sqlite class renames. Notes for nodejs/node v26.11.0 (opens in a new tab)
vercel/next.js
v16.5.0-canary.8Pre-releaseFixes server error inspector stack parsing, enables webp and canary GC by default, and fixes Turbopack GC paths. Notes for vercel/next.js v16.5.0-canary.8 (opens in a new tab)
vercel/next.js
v16.5.0-canary.7Pre-releaseRelands experimental custom webpack support alongside Turbopack improvements and dependency upgrades. Notes for vercel/next.js v16.5.0-canary.7 (opens in a new tab)
vercel/next.js
v16.5.0-canary.6Pre-releaseNext.js canary release featuring Turbopack improvements, build optimizations, route classification fixes, and a React upgrade. Notes for vercel/next.js v16.5.0-canary.6 (opens in a new tab)
+10 earlier releases of vercel/next.js
v16.5.0-canary.5, v16.5.0-canary.4, v16.5.0-canary.3, v16.5.0-canary.2, v16.5.0-canary.1, v16.4.0-canary.63, v16.4.0-canary.62, v16.4.0-canary.61, v16.4.0, v16.5.0-canary.0
data
4 repos checked · 5 releasescolinhacks/zod
v4.6.6Zod v4.6.6 includes bug fixes, performance improvements, type declarations for records, and size bounds checks prior to parsing elements. Notes for colinhacks/zod v4.6.6 (opens in a new tab)
drizzle-team/drizzle-orm
0.45.4Fixed postgres-js not using prepared queries when explicitly calling .prepare(name). Notes for drizzle-team/drizzle-orm 0.45.4 (opens in a new tab)
evaluation
3 repos checked · 10 releaseshonojs/hono
v5.0.0-rc.1Pre-releaseNo release notes published. Notes for honojs/hono v5.0.0-rc.1 (opens in a new tab)
honojs/hono
@hono/vercel@1.0.1Updated peer dependencies to accept Hono v5 prereleases and kept internal types private in bundled d.ts. Notes for honojs/hono @hono/vercel@1.0.1 (opens in a new tab)
honojs/hono
@hono/service-worker@1.0.1Accept Hono v5 prereleases in the hono peer range, so npm install with hono@next no longer fails with ERESOLVE by @yusukebe in https://github.com/honojs/hono/p… Also in @hono/netlify@1.0.2, @hono/lambda-edge@1.0.1, @hono/deno@1.0.3, @hono/cloudflare-workers@1.0.1, @hono/bun@1.0.1, @hono/aws-lambda@1.0.1. Notes for honojs/hono @hono/service-worker@1.0.1 (opens in a new tab)
Coverage
What was checked
Every enabled repository, by the part of the product it belongs to.
- payments4 rel. · 5 repos
- auth0 rel. · 5 repos
- banking1 rel. · 4 repos
- platform16 rel. · 4 repos
- data5 rel. · 4 repos
- tooling0 rel. · 2 repos
- evaluation10 rel. · 3 repos
Checked, no releases this week
- Adyen/adyen-node-api-library
- MikeMcl/decimal.js
- auth0/node-jsonwebtoken
- better-auth/better-auth
- braintree/braintree_node
- brianc/node-postgres
- dinerojs/dinero.js
- helmetjs/helmet
- jaredhanson/passport
- microsoft/TypeScript
- nextauthjs/next-auth
- panva/jose
- panva/openid-client
- plaid/plaid-node
- razorpay/razorpay-node
- temporalio/sdk-typescript
- vitest-dev/vitest