This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryFixed crash in auth coverage parsing for Clerk/Next.js apps
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes crash in auth coverage for Clerk/Next.js apps caused by malformed matcher parsing Fixes crash in auth coverage for Clerk/Next.js apps caused by malformed matcher parsing Source: llm_adapter@2026-06-07 Confidence: low |
— |
Full changelog
- Fix a crash in auth coverage on Clerk/Next.js apps: the catch-all middleware matcher (which contains
]inside character classes) truncated the parser and threw 'Unterminated character class' — matcher parsing is now string-aware and matcher-to-regex never throws - Understands Clerk createRouteMatcher protect-lists for precise coverage, and no longer counts non-auth (i18n/analytics) middleware as protection
- Verified on real middleware files (0 crashes); no rule or tool changes (441 / 37); gate green (PASS/A/0)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Related tools
Beta — feedback welcome: [email protected]