500 changes shipped across 30 tracked developer tools this week. 2 were critical. Here is what actually needs your attention.
Prisma v0.17.0
Prisma Next 0.17.0 is a stable release that renames the entire package scope, replaces legacy error classes with a structured error-code system, strips the sha256: prefix from content hashes, changes the migration snapshot storage layout, moves PostgreSQL native types out of @db. attributes, and changes aggregate/relation result types bigint counts, string decimals. Any app on 0.16 must update dep
Do this: Follow the 0.16-to-0.17 upgrade recipe: switch to the single @prisma/orm- facade package, replace instanceof error checks with isStructuredError, remove @db. attributes in favor of native types in typ
Next.js v16.3.0
Next.js 16.3.0 updates the vendored lodash dependency to patch CVE-2025-13465, a published security vulnerability. This is a stable release, so the fix is live for all production users on update.
Do this: Upgrade to Next.js 16.3.0 to pick up the CVE-2025-13465 fix.
This is the critical tier of StackTrace Weekly issue 6, a free weekly email that classifies every changelog entry by severity against a public rubric. Subscribe here.
Top comments (0)