Security patches led the week across every language Scout tracks: a CRLF command injection fix in Predis, a CVE patch in Express, and a security-relevant OAuth fix in Doorkeeper that immediately needed a follow-up fix of its own. Alongside that, Anthropic and OpenAI both shipped SDK updates for agent-building features, and MongoDB’s Python driver started rolling out real OpenTelemetry tracing.
Highlights
Ruby
Doorkeeper 5.9.7 tightens OAuth token handling: a request that presents an access token by more than one method (say, both a header and a query param) now fails closed instead of silently authorizing with the first match. Doorkeeper 6.0.0.rc1 follows with real breaking changes, Ruby 3.2+ is now required, and a client_secret_basic fix closes a gap where mismatched Basic and body credentials could authenticate as the wrong client.
Python
Anthropic’s Python SDK shipped two releases this week (1.5.0, 1.6.0), both adding auto mode tool permissions and async credential support for Managed Agents. OpenAI’s Python SDK kept pace with three releases adding a Live API and an Agents API.
PHP
Symfony patched three release lines at once (6.4.46, 7.4.19, 8.1.7), clarifying why a remember-me login counts as interactive for security purposes, alongside routine HttpFoundation and Messenger fixes. Laravel’s v13.32.0 was a normal grab-bag release, notably adding a Mercure broadcast driver.
Node.js
NestJS 12.0.2 fixed several microservices edge cases, including Kafka message streams staying alive when a handler throws. OpenAI’s Node SDK added a Live API and Agents API, mirroring the Python releases.
Also Noteworthy
Resque 3.0.3, SQLAlchemy 2.0.53, Phoenix 1.8.14, and a handful of patch releases across the Anthropic/OpenAI TypeScript and Node SDKs rounded out the week without anything requiring action.
Recently Merged
Predis merged a real security fix: CVE GHSA-w6f5-v2h6-g786, a CRLF command injection in AbstractAggregateConnection::write() that could let an attacker-controlled string (like a cache key built from a URL slug) get interpreted as a second Redis command. The vulnerable parser is now removed entirely, not just avoided.
Express landed 4.22.3, patching CVE-2026-4867 via a path-to-regexp update, worth updating for if you’re running Express.
MongoDB’s Python driver merged the first of five PRs adding OpenTelemetry operation spans, so retried operations will show up as sibling spans instead of collapsing into one, real progress toward proper distributed tracing for MongoDB calls. Doorkeeper also merged a quick follow-up (#1938) fixing a 500 error that its own 5.9.7 security fix had introduced for malformed request bodies, worth knowing if you upgraded and started seeing ParseError in your logs.
In Development
An open Doorkeeper PR would warn at boot when an app still has the RFC 9700-deprecated implicit or password grant flows enabled, notice only, no behavior change yet. OpenTelemetry Ruby has a pending 5-item release PR that includes a breaking change to LoggerProvider#logger’s signature. And a Puma issue proposes storing the client connection as a thread-local so handler code can cheaply check if a socket’s already closed before doing wasted work.
What We’re Watching
The Predis and Express fixes are a reminder that connection/parsing-layer bugs keep surfacing across languages, worth a second look at anything in your stack that hand-parses network input. MongoDB’s OpenTelemetry rollout is also worth tracking if you’re on that driver, tracing coverage is about to get meaningfully better over the next few PRs in that series.
Try Scout APM
If you’re running any of the frameworks above in production, Scout gives you the performance and error visibility to catch regressions before your users do, across Ruby, Python, Node.js, PHP, and Elixir. Start a free trial.
For application monitoring with errors, logs, and traces, Scout Monitoring provides the fastest insights without the bloat.