Next.js patches seven security issues, including cross-tenant cache leak, in 16.4.5 and 15.5.29

·4 views

On 3 November 2026, the Next.js team released versions 16.4.5 and 15.5.29 to fix seven security vulnerabilities. The most serious flaw allows data cached for one tenant or locale to be served to another in apps using the use cache directive. Four of the issues involve Cache Components and affect only Next.js 16, a group that is now more relevant because create-next-app enables Cache Components by default since version 16.4. The remaining three also affect Next.js 15. Developers are advised to check their installed version with npm ls next, upgrade and redeploy if affected, and clear caches when using use cache alongside root parameters.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Character Swap 1.5 pairs SAM 3.1 masking with motion transfer for eight-step video edits

Character Swap 1.5 is a single ComfyUI workflow that separates video character replacement into two tasks: masking the subject and transferring the original motion to the new character. SAM 3.1 generates per-frame masks from a text prompt, replacing what was once manual rotoscoping. The motion transfer stage applies the source clip's body shape, limb timing and movement to the replacement. The author notes that most failures trace to the mask, such as occlusion, fast motion and hard edges that create halos, and advises feathering masks. The VDN8 variant uses a distilled sampler with eight steps per frame, which speeds rendering at a small cost to fine texture and facial detail.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MongoDB or PostgreSQL? Choosing based on your data's shape

A developer who uses both databases in their projects says the right choice depends on how the data is structured. They favor PostgreSQL for highly relational data such as users, orders, payments, and invoices. MongoDB suits flexible or frequently changing data like content, logs, and product catalogs. A common mistake is picking MongoDB for its perceived ease, which can cause problems later when relationships between data must be managed. The author argues neither database is inherently better, and that using both in one project can be sensible.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Supabase and Lovable apps may expose data without login, researchers warn

A Hamburg security firm, working with Handelsblatt, examined 159,041 Lovable projects and reported that some exposed personal data such as passport numbers, payment details and private messages to anyone without logging in. Of the projects using Supabase, roughly 24,664 sent database records on page load with no authentication, and about 30% of those responses included email addresses, though researchers stressed this is not a confirmed leak rate. The report documented several serious exposures, including tens of thousands of profiles and chat messages from a lifestyle forum and over 1,000 passport records from a service provider. Supabase's publishable key is intentionally public, so protection depends on row-level security and table grants inside the database. Developers are advised to check whether tables have row-level security enabled and to test them using only the public key.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Freelance Bidding Agent: Decomposing Retrieval Hurt, a Simple Budget Rule Helped

A student built GigBid, a multi-agent system that reads freelance job posts, decides whether to bid, and drafts proposals whose claims must trace to portfolio evidence, with a human approving each one. The author hypothesized that splitting a job post into separate requirements would improve retrieval, but measured results showed it performed markedly worse than a simpler hybrid search with reranking. An ablation traced the problem to merging per-skill rankings, which rewarded projects matching one requirement over those matching all of them. Separately, the bid-or-skip decision was failing on low-budget jobs that the system never compared against the freelancer's rate floor. A short deterministic rule fixing this raised bid-or-skip F1 from 0.89 to 0.98 without changing any model or prompt.

0 comments Read more at DEV Community