aug 21, 2026
8 links from the engineering internet.
workerd v1.20260821.1 preserves in-flight websocket auto-responses
the august 21 workers runtime cut stops in-flight websocket auto-responses being dropped, lets ctx.abort() disable alarm retries, fixes a jsg::weakref segfault case, and makes workflows_bindings_rpc obsolete.
next.js 16.3.2 backports turbopack wasm and catch-all routing fixes
the patch stops the catch-all index page being served for every other slug, scopes app-entry export validation to files inside the app directory, and fixes turbopack worker chunk loading with an asset prefix. no canary features ride along.
rspack v2.2.0-rc.0 moves module code generation onto the new cache
the release candidate wires module code generation into rspack's new cache, adds fine-grained cache options, interns arcpath as a single-allocation prehashed path, and schedules the new cache db in parallel with rayon.
llama.cpp b10534 tunes the cuda mvq to mmq decode crossover per gpu
the build adds hardware and quant-type specific switch points for the mul_mat_vec_q to mmq batch crossover, plus a runtime override, measuring up to 41 percent faster quantized decode at small batch sizes on blackwell, ada and dgx spark.
cve-2026-59279: spring ai mcp http transport caps neither sessions nor auth
the mcp streamable http server transport, webflux and webmvc variants alike, defaults to no session limit and no authentication, so an unauthenticated caller can open unbounded sessions until the server exhausts memory. cvss 7.5, cwe-770.
posthog-cli 0.14.0 adopts bundler-emitted ecma-426 debug ids
under --release-mode=event the cli now takes the debug id the bundler already emitted instead of minting its own, and keeps that field on save. hermes sourcemap uploads carrying no chunk or debug id now fail instead of silently uploading nothing.
n8n 2.36.4 validates chat and mcp trigger auth for end-user credentials
three fixes in the patch: chat and mcp trigger auth modes are validated against end-user credentials, env values are normalized before schema-based parsing, and a trigger's closefunction is wrapped in an expression isolate at creation time.
clickhouse cuts 26.7.5.10-stable and 25.8.32.4-lts on the same day
two patch tags landed about ninety minutes apart, the fifth on the 26.7 stable line and the thirty-second on the long-term 25.8 line, so clusters pinned to either branch have a fresh build to move to.