This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+5 more
Summary
AI summaryUpdates Patch Changes, Minor Changes, and req across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Dependency | Low |
Updates @hookwarden/engine to 0.11.0. Updates @hookwarden/engine to 0.11.0. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Dependency | Low |
Updates @hookwarden/rules to 0.11.0. Updates @hookwarden/rules to 0.11.0. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Dependency | Low |
Updates @hookwarden/fix to 0.11.0. Updates @hookwarden/fix to 0.11.0. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Detects Next.js Pages Router webhooks under pages/api/** and src/pages/api/**, fixing false negatives. Detects Next.js Pages Router webhooks under pages/api/** and src/pages/api/**, fixing false negatives. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Eliminates two false‑positive classes and one Next.js false negative related to raw body handling. Eliminates two false‑positive classes and one Next.js false negative related to raw body handling. Source: llm_adapter@2026-06-05 Confidence: high |
— |
Full changelog
Minor Changes
-
Next.js Pages Router webhook detection. Handlers under
pages/api/**and
src/pages/api/**are now detected (previously only App Routerapp/**/route.ts
was recognized), closing a false negative where real Stripe apps with a Pages
Router webhook scanned to "0 handlers". Correct Pages Router webhooks that read
the raw body via a stream helper (getRawBody/buffer(req)) with
config.api.bodyParser = falseare recognized as reading raw bytes and do not
surface araw-body-misusefalse positive.Also eliminates two false-positive classes and a Next.js false negative surfaced
by a real-repo scan audit (Stripe JSON-verify hook, Express middleware ordering,
Standard Webhooks hand-rolled signing).
Patch Changes
- @hookwarden/[email protected]
- @hookwarden/[email protected]
- @hookwarden/[email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Hookwarden
All releases →Related context
Beta — feedback welcome: [email protected]