v0.3.1
Released: May 9, 2026
Security: Next.js 16.2.6 + axios 1.15.2
Two upstream security advisories landed against versions tsdevstack ships in templates and generated clients. Both bumps are drop-in — no behavior changes for your app code.
Next.js → 16.2.6
The Vercel May 2026 security release covers 13 advisories spanning denial of service, auth bypass via App Router segment prefetch, server-side request forgery in WebSocket upgrades, cache poisoning in React Server Component responses, and XSS in App Router applications using CSP nonces. CVE-2026-23870 is the upstream React Server Components DoS. Next.js 16.x ≤ 16.2.5 is affected; 16.2.6 is the minimum patched version.
axios → 1.15.2
Bumped to address axios advisories.
Generated HTTP clients
The handlebars template that produces every *-service-client package's package.json (npx tsdevstack generate-client) was bumped to ^1.15.2 so newly-generated clients ship with the patched range.
Action
If your project depends on tsdevstack-shipped templates or generated clients:
Caret ranges resolve to the latest 16.x / 1.x patches automatically. Regenerate clients with npx tsdevstack generate-client <service> if you want the new peer-deps shape on disk; existing dist outputs still resolve correctly against the bumped peer ranges.