Changes.Watch

Security changelog digest

May 11 - May 17, 2026. Useful releases, risky migrations, and noisy updates from the Security channel.

Security updates in 2026-w20

Auth policy examples refreshed for RLS projects

  • Auth docs now include clearer examples for user-owned rows.
  • Teams using custom claims should review policy snippets before copying them.

2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolito

  • Fixed multiple security issues including a crypto null‑pointer dereference, URL parsing crash for malformed UNC hostnames, a zlib use‑after‑free on reset, HTTP keep‑alive socket reuse race, and an HTTP/2 file‑handle leak
  • Resolved numerous core bugs such as module resolution double‑invocation, source‑map URL parsing, stream chunk boundary checks, and sync resolve hook handling
  • Introduced a new ESM feature: separate cache for require('esm') when importing CJS modules, plus upgrades to npm (10.9.8) and OpenSSL (3.5.6)

Workers observability dashboard expands traces

  • Workers requests can be inspected with more trace context.
  • Useful for debugging edge latency without adding custom logging.

Actions cache behavior changes for forked pull requests

  • Cache access is tightened for workflows triggered by forked pull requests.
  • Security posture improves, but CI time may increase for some OSS repos.