Weekly release digest · 2026-W43 · 12 Oct – 19 Oct 2026
Upstream Weekly,week of 19 Oct 2026
3 need action, 2 need review, 14 FYI.
26 repos checked27 releasesLast run 19 Oct 2026, 09:27 (Asia/Kolkata)~4 min read
This week at a glance
Most critically, vercel/next.js v16.4.1 addresses critical RCE vulnerabilities in use cache and Image Optimization, as well as a high DoS vulnerability in App Router. Across 26 repos checked with 0 that could not be checked, there are 27 releases. These include 3 act now items, 2 review items, and 14 FYI items.
- Check whether your pinned version of vercel/next.js is below v16.4.1, and upgrade if it is.
- Check whether your pinned version of vitest-dev/vitest is below v4.1.12, and upgrade if it is.
- Read the migration notes for v8.0.0-rc.18 before upgrading prisma/orm, and keep your current range pinned until call sites are checked.
- Read the migration notes for v1.8.0-beta.0 before upgrading better-auth/better-auth, and keep your current range pinned until call sites are checked.
Written by Gemini Flash using only the items below, and checked for invented versions or IDs.
Tier 1
Act now
Security fixes and urgent upgrades. Check the quoted evidence, then act.
vercel/next.jsv16.4.1
platform · critical priority
Security release addressing critical RCE vulnerabilities in use cache and Image Optimization, plus a high DoS vulnerability in App Router.
Quoted from the release notes: This release contains security fixes for the following advisories:
GitHub advisory: GHSA-p3m5-59mp-jv5r
Why flagged: GitHub advisory GHSA-p3m5-59mp-jv5r matches this release and the notes say “This release contains security fixes for the following advisories”.
Next step: Check whether your pinned version of vercel/next.js is below v16.4.1, and upgrade if it is.
Key changes (3) and source
- Fix unauthenticated Remote Code Execution in `use cache` functions returning typed arrays (GHSA-673q-mjm6-r5xr).
- Fix unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (GHSA-2464-fhr4-w9xw).
- Fix Denial of Service in App Router using Server Actions (GHSA-p3m5-59mp-jv5r).
Also in v15.5.28
Area: caching, Image Optimization API, and App Router · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for vercel/next.js v16.4.1 (opens in a new tab)
vitest-dev/vitestv4.1.12
tooling · low priority
Vitest v4.1.12 backports bug fixes to harden manual and redirect mocks.
GitHub advisory: GHSA-qxg6-89mg-rqv8
GitHub advisory: GHSA-xp26-3454-mjgp
Why flagged: GitHub advisory GHSA-qxg6-89mg-rqv8 matches this release.
Next step: Check whether your pinned version of vitest-dev/vitest is below v4.1.12, and upgrade if it is.
1 more flagged release of vitest-dev/vitest this week
Vitest v5.0.5 delivers bug fixes across test execution, mocks, CLI handling, browser mode, and reporters.
GitHub advisory GHSA-p458-7748-mcp3 matches this release.
Key changes (1) and source
- mocker: Harden manual and redirect mocks [backport to v4]
Area: mocker · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for vitest-dev/vitest v4.1.12 (opens in a new tab)
Tier 2
Review
Breaking changes, major version bumps, and items worth a closer look before your next upgrade.
prisma/ormv8.0.0-rc.18
data · normal priority
Prisma v8.0.0-rc.18 introduces contract SQL literals, activity-based middleware hooks, structured full-text indexes, and stricter ORM/migration rules.
Quoted from the release notes: Raw SQL in a contract is a sql literal. In PSL, @@index(where:), @@index(expression:), @@fullTextIndex(where:), @@check(expression:) and a policy's using and withCheck take a sql literal, and a quote…
Why flagged: The notes say “Raw SQL in a contract is a `sql` literal.”.
Next step: Read the migration notes for v8.0.0-rc.18 before upgrading prisma/orm, and keep your current range pinned until call sites are checked.
Key changes (4) and source
- Raw SQL in contracts now requires a `sql` literal or value instead of a quoted string.
- Middleware hooks are restructured as activity hooks, executing every statement and transaction as an activity.
- Full-text indexes are stored as structured definitions rather than raw SQL expressions, altering generated names.
- The SQL ORM client now strictly enforces field names, throwing `ORM.FIELD_UNKNOWN` on unmatched column names.
Area: ORM contracts, middleware, and migrations · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for prisma/orm v8.0.0-rc.18 (opens in a new tab)
better-auth/better-authv1.8.0-beta.0
evaluation · low priority
Better-auth v1.8.0-beta.0 introduces CIBA support, major breaking updates to device authorization and OAuth provider flows, and token exchange features.
Quoted from the release notes: Changed the custom DeviceAuthorizationGrant interface for device-code approval (#11610)
Why flagged: The notes say “Changed the custom `DeviceAuthorizationGrant` interface for device-co…”.
Next step: Read the migration notes for v1.8.0-beta.0 before upgrading better-auth/better-auth, and keep your current range pinned until call sites are checked.
Key changes (4) and source
- Changed custom DeviceAuthorizationGrant interface and moved OAuth device-code approval into sign-in and consent flow.
- Introduced @better-auth/ciba package supporting user-approved backchannel authentication via polling or ping delivery.
- Added OAuth token exchange, configurable acr/amr claims, and front-channel logout support.
- Updated OAuth endpoints to strictly handle invalid tokens, repeated form parameters, and isolate pairwise sub values.
Area: authentication · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for better-auth/better-auth v1.8.0-beta.0 (opens in a new tab)
Revised
Updated since last digest
Already reported in an earlier digest. Their release notes have changed since.
colinhacks/zodv4.6.6
data · normal priority
Zod v4.6.6 addresses malicious commit history cleanup, release pipeline staging updates, and fixes for types and collection size bounds checks.
Key changes (4) and source
- Reverted and purged six malicious commits pushed to main using a compromised git credential (never published to npm).
- Check array, set and map size bounds before parsing elements.
- Declare record output and input as members, not base type arguments in types.
- Update release workflow to stage npm versions and require approval environment check.
Area: release pipeline and parsing · Confidence: high · Summary: Gemini Flash, checked against the notes
Read the release notes on GitHub for colinhacks/zod v4.6.6 (opens in a new tab)
Tier 3
FYI
Everything else that shipped, grouped by the part of the product it touches.
payments
5 repos checked · 1 releasestripe/stripe-node
v23.1.0-alpha.3Pre-releaseLow confidence, verify before actingRelease v23.1.0-alpha.3 points to external changelog for full release notes. Notes for stripe/stripe-node v23.1.0-alpha.3 (opens in a new tab)
platform
4 repos checked · 14 releasesnodejs/node
v26.12.0Node.js v26.12.0 adds websocketMask/websocketUnmask, enforces WebAssembly/RX support checks, and enables synchronous loading for most ES modules. Notes for nodejs/node v26.12.0 (opens in a new tab)
nodejs/node
v24.22.0Node.js v24.22.0 adds crypto and perf_hooks features, including parsePKCS12(), a generic MAC API, SlidingWindowHistogram, and utility debounce/throttle. Notes for nodejs/node v24.22.0 (opens in a new tab)
vercel/next.js
v16.5.0-canary.17Pre-releaseAdded MADV_WILLNEED prefetching for multi-page SST blocks in turbo-persistence. Notes for vercel/next.js v16.5.0-canary.17 (opens in a new tab)
vercel/next.js
v16.5.0-canary.16Pre-releaseNext.js canary release featuring core refactors, dead code removal, Server Action metadata passing, and an OpenTelemetry middleware revert. Notes for vercel/next.js v16.5.0-canary.16 (opens in a new tab)
vercel/next.js
v16.5.0-canary.15Pre-releaseNext.js canary release featuring updates to partial prefetching, cached navigations, error overlay UI, and Turbopack config inheritance. Notes for vercel/next.js v16.5.0-canary.15 (opens in a new tab)
+7 earlier releases of vercel/next.js
v16.4.2, v16.5.0-canary.14, v16.5.0-canary.13, v16.5.0-canary.12, v16.5.0-canary.11, v16.5.0-canary.10, v16.5.0-canary.9
data
4 repos checked · 2 releasescolinhacks/zod
v4.6.7Low confidence, verify before actingRelease v4.6.7 containing a single version commit. Notes for colinhacks/zod v4.6.7 (opens in a new tab)
tooling
2 repos checked · 3 releasesvitest-dev/vitest
v5.0.4Vitest v5.0.4 brings experimental UI and caching features alongside numerous bug fixes across browser testing, coverage, and mock handling. Notes for vitest-dev/vitest v5.0.4 (opens in a new tab)
evaluation
3 repos checked · 6 releasesbetter-auth/better-auth
v1.7.11Bug fixes across better-auth packages, including Postgres migration diffs, rate limiting headers, ID token validation, and OAuth OpenAPI schemas. Notes for better-auth/better-auth v1.7.11 (opens in a new tab)
better-auth/better-auth
v1.8.0-beta.1Pre-releaseAdded FedCM Google sign-in support, client_credentials scopes for OAuth registration, and a bug fix for drizzle-adapter relation schemas. Notes for better-auth/better-auth v1.8.0-beta.1 (opens in a new tab)
better-auth/better-auth
v1.7.10better-auth Also in v1.7.9. Notes for better-auth/better-auth v1.7.10 (opens in a new tab)
+1 earlier release of better-auth/better-auth
v1.7.8
Coverage
What was checked
Every enabled repository, by the part of the product it belongs to.
- payments1 rel. · 5 repos
- auth0 rel. · 5 repos
- banking0 rel. · 3 repos
- platform14 rel. · 4 repos
- data2 rel. · 4 repos
- tooling3 rel. · 2 repos
- evaluation6 rel. · 3 repos
Checked, no releases this week
- Adyen/adyen-node-api-library
- MikeMcl/decimal.js
- auth0/node-jsonwebtoken
- braintree/braintree_node
- brianc/node-postgres
- checkout/checkout-sdk-node
- drizzle-team/drizzle-orm
- expressjs/express
- helmetjs/helmet
- honojs/hono
- jaredhanson/passport
- microsoft/TypeScript
- moov-io/ach
- nextauthjs/next-auth
- panva/jose
- panva/openid-client
- plaid/plaid-node
- razorpay/razorpay-node
- temporalio/sdk-typescript