472 changes shipped across 30 tracked developer tools this week. 3 were critical. Here is what actually needs your attention.
Clerk @clerk/astro@4.0.0
Clerk's Astro SDK v4 drops support for Astro 4 and removes createRouteMatcher from @clerk/astro/server, a stable public API. Apps using it for middleware-based route protection must migrate auth checks into each page/route handler or protected resources become unreachable via the old pattern.
Do this: Before upgrading, drop Astro 4 support requirement and replace all createRouteMatcher middleware checks with per-route locals.auth checks in each page/API handler.
Clerk @clerk/backend@3.12.0
A referrer-check bypass in isKnownClerkReferrer let attacker-controlled hosts like accounts.attacker.com masquerade as Clerk's accounts portal, skipping the cross-origin handshake and session-freshness check. This is fixed in this release by scoping trust to the instance's actual frontend API domain.
Do this: Upgrade @clerk/backend to 3.12.0 or later now to close the cross-origin handshake bypass.
Trigger.dev v4.5.6
This self-hosted release fixes a long list of authorization and injection vulnerabilities, including cross-org data leaks, replayable OAuth callbacks, and prototype pollution. It also removes shared default credentials from fresh installs, requiring self-hosters to set unique secrets or an explicit opt-out flag.
Do this: Upgrade self-hosted deployments immediately and set unique credential values or ALLOWINSECUREDEFAULTSECRETS=true only as a temporary bridge before restarting.
This is the critical tier of StackTrace Weekly issue 4, a free weekly email that classifies every changelog entry by severity against a public rubric. Subscribe here.
Top comments (0)