574 changes shipped across 30 tracked developer tools this week. 4 were critical. Here is what actually needs your attention.
Directus v12.3.0
Directus fixed a bug where cancelled asset requests or failed transformations leaked storage connections, eventually causing every asset request to return a permission error until the server was restarted. The fix changes storage exists semantics to throw on lookup failure instead of returning false, and S3 setups now need s3:ListBucket permission to keep getting clean 404s for missing objects.
Do this: Before upgrading, grant s3:ListBucket to your S3 credentials if used and check any code relying on exists returning false on error, since it now throws instead.
Clerk @clerk/backend@3.16.8
Clerk backend had a JWKS/JWK caching bug where signing keys could be shared across different Clerk instances in a multi-tenant process, potentially allowing a token from one instance to verify against another's cached key. The fix now scopes the cache per secret key and API URL, and always derives networkless JWKs from the passed-in jwtKey.
Do this: Upgrade to @clerk/backend@3.16.8 if you verify tokens for multiple Clerk instances in the same process e.g. Dynamic Keys / multi-tenant setups.
Better Auth v1.7.0
Better Auth 1.7 is a stable release with multiple breaking changes, most notably a new account-identity model requiring Account.issuer and a backfill migration before deploying, plus OIDC back-channel logout that now invalidates access tokens immediately when a session ends. Several other breaking changes ship too joins config path, MCP package restructuring, captcha wildcard matching.
Do this: Before upgrading, run the reviewed account-identity backfill from the 1.7 upgrade guide and regenerate your schema npx auth generate/migrate; if you rely on access tokens outliving sessions or on with
This is the critical tier of StackTrace Weekly issue 8, a free weekly email that classifies every changelog entry by severity against a public rubric. Subscribe here.
Top comments (0)