This Week in Open Source: August 28, 2026

NestJS shipped v12 with native observability baked in, Oban unified its configuration model, Phoenix is switching to Elixir’s built-in JSON library, and node-mysql2 kept squeezing out per-query overhead. A busy week across all six ecosystems we track.

Highlights

Node.js

NestJS v12.0.0 ships ESM packages, Standard Schema, and native observability. The release is the biggest NestJS major in a while. All core packages now ship as ESM (existing CommonJS apps keep working via require(esm)). Route parameter decorators accept Standard Schema libraries like Zod, Valibot, and ArkType directly. The headline for monitoring folks: @nestjs/observe is a new first-party observability SDK that hooks into Nest’s request lifecycle for HTTP, GraphQL, gRPC, microservices, queue consumers, and cron runs. It covers the same ground third-party APM tools do. Scout instruments NestJS, so we are watching how @nestjs/observe fits alongside external monitoring. Node.js v20.19+ is now required.

node-mysql2 v3.24.0 and v3.24.1 continue the performance push. v3.24.0 removes per-query and per-row allocation hotspots and serializes COM_STMT_EXECUTE in a single exact-size pass. v3.24.1 follows up with single-pass UTF-8 string encoding for outgoing packets. The performance work that started with the 3-6x speedup PR a few weeks ago is still producing gains.

MongoDB Node.js driver v7.6.0 drops MongoDB 4.2 support. The release now throws when connecting to MongoDB 4.2 or lower. Other additions: HTTP proxy support for KMS requests in client-side field-level encryption, improved retry logic for MongoDB 9.0’s Intelligent Workload Management, an ESM bundling fix, and bulk writes that serialize each document only once.

Elixir

Oban v2.24.0 unifies configuration and backports Pro features. The release flattens the configuration model. Services like pruning, lifeline rescue, and cron are now top-level config keys instead of nested plugin options. Oban.Plugins.Cron becomes Oban.Cron, Oban.Plugins.Pruner becomes Oban.Pruner, and so on. Timing values swap opaque integers for readable durations. Per-entry cron timezones and attempt-preserving snoozes, previously Pro-only, are now in the open source release. Scout instruments Oban through the Elixir agent, and the config changes do not affect instrumentation hooks.

Phoenix switches default JSON library to Elixir’s built-in JSON module. PR #6481 changes the default from Jason to the JSON module that ships with OTP 28+. If JSON is loaded, Phoenix uses it. Otherwise it falls back to Jason. Projects that explicitly set config :phoenix, :json_library, Jason are unaffected. This mirrors the earlier ecosystem-wide move from Poison to Jason.

PHP

Laravel v13.27.0 adds a Cloud facade, refreshForUpdate(), and query builder features. The release introduces the Cloud facade via Illuminate\Support\Facades\Cloud, adds whereBinary() to the query builder, brings MariaDB support for vector distance queries, and adds refreshForUpdate() on Eloquent models. There are also security hardening fixes for in_array and contains validation rules. Scout’s PHP agent instruments Laravel database queries, so the query builder additions are relevant.

Symfony patches across three branches. v6.4.44, v7.4.17, and v8.1.5 all dropped on August 22 with overlapping bug fixes across Serializer, Security, Messenger, Form, HttpKernel, and Scheduler components. No security advisories. Routine maintenance across the LTS (6.4), stable (7.4), and current (8.1) lines.

Ruby

Karafka v2.6.1 adds envelope encryption for messages at rest. The release introduces an opt-in envelope encryption mode that wraps each message with a one-time RSA-wrapped AES-256-GCM key, removing the RSA payload size ceiling of the default direct mode. Both formats are recognized on decryption, so existing data stays readable. The release also includes several bug fixes for scheduled messages and shutdown handling.

Python

Anthropic Python SDK reaches v1.1.0 and v1.2.0. Following last week’s v1.0.0 milestone (the httpx2 upgrade), the SDK shipped two minor releases. v1.1.0 adds an updates thinking display mode, Organization API endpoints, and missing anthropic-beta values. v1.2.0 promotes beta files/skills namespaces to GA shapes and fixes Bedrock binary file uploads.

Also Noteworthy

phoenixframework/phoenix shipped v1.8.13, a patch release.
nestjs/nest released v11.2.2 and v11.2.3, patch releases on the v11 line.
node-mysql2 hit v3.24.2 with another patch.
MCP Python SDK released v2.0.1 and v2.1.0, adding direct StdioServerParameters support and extending the 4 MiB body limit to SSE transport.

Recently Merged

redis-rb fixes double-execution of write commands on RESP3. PR #1376 restricts the automatic RESP3-to-RESP2 protocol fallback so it only triggers on actual HELLO responses. Previously, any command error containing “NOPROTO” could trigger a retry, causing commands like INCR to execute twice.

redis-rb optimizes hash ring node removal by up to 70x. PR #1378 replaces per-replica rescanning (160 passes by default) with a single filter pass. Benchmarks show removal dropping from 50ms to under 1ms on 100-node rings.

Starlette hardens Host header handling. PR #3472 validates bracketed IPv6 addresses, prevents out-of-range ports from raising during URL parsing, and returns 400 from HTTPSRedirectMiddleware when no usable authority is available. Defensive hardening, not a security patch.

NestJS fixes HTTP/2 SSE timeout leak. PR #17606 stops SseStream from disabling the idle timeout on the shared HTTP/2 session socket, which previously affected all streams on that connection.

In Development

Solid Queue proposes dynamic concurrency limits. PR #794 adds per-key concurrency controls that accept a callable for the limit, letting multi-tenant apps set caps per tenant without creating a queue per tenant. Limits can be changed at runtime with SolidQueue::Concurrency.refresh.

Dramatiq proposes SkipEnqueue middleware. PR #890 adds a SkipEnqueue exception that middleware can raise from before_enqueue to prevent a message from being published, useful for deduplication without overriding enqueue directly.

Starlette has a BackgroundTask timing bug with BaseHTTPMiddleware. Issue #3458 reports that background tasks start running before the response body has been fully sent when BaseHTTPMiddleware is in the stack. PR #3476 proposes a fix.

SQLAlchemy has a connection leak when connect events raise. Issue #13548, filed by zzzeek, describes how every async dialect shipped by SQLAlchemy can strand a DBAPI connection when a connect event handler raises. The pool slot is returned, but the connection is never closed. This matters for oracledb (unbounded server-side session leak) and other async drivers.

What We’re Watching

NestJS v12’s @nestjs/observe is the most significant signal this week. When a major framework ships its own observability SDK, it changes the conversation for third-party APM tools. The question shifts from “how do we instrument this framework” to “how do we add value on top of what the framework already provides.” Meanwhile, the SQLAlchemy connection leak is worth tracking for anyone running async Python apps with database-heavy workloads.