StackDiff: Week of April 21, 2026
TL;DR
- 1 breaking change:
next@15.4.0tightens Server Action origin validation. - 1 security advisory: Prisma 6.x SSRF via connection-string templating (patched).
- 7 releases worth a 30-second glance.
Breaking / needs migration
next 15.4.0
- What changed: Server Actions now reject requests whose
Originheader is missing or doesn't matchallowedOrigins. Previously warned, now rejects. - Impact: Apps using Server Actions behind a proxy that strips
Origin(some corporate gateways) will break. - Migration: Add your proxy's public host to
experimental.serverActions.allowedOriginsinnext.config.js, or configure the proxy to preserveOrigin. "We're tightening this by default to close a CSRF vector reported last quarter." - Source: nextjs.org/blog/next-15-4 (fictional link for sample)
Security
CVE-2026-30815 · @prisma/client
- Severity: High (7.4). Fixed in 6.7.2.
- Action: Bump to
@prisma/client@^6.7.2andprisma@^6.7.2. Low-risk patch, no schema migration needed.
Worth knowing (30s each)
react@19.2.0: newuseEffectEventstabilized. "For reading the latest value of a prop without re-subscribing."postgres@17.4: planner fix for large partitioned joins; users of range-partitioned time-series tables likely see 10 to 30% improvement on analytics queries.stripe-node@18.1.0: default API version bumped to2026-03-31. Idempotency-key behavior changed for split refunds, read the migration note before upgrading.tailwindcss@4.1.1:@containerquery variants now stable. No action; pure capability add.shadcn/ui: newDataTableprimitive with built-in virtualization. Drop-in replacement if you're still on the old example.playwright@1.51.0: Chromium 126 baseline;test.describe.configureretries can now be a function of the test title.vercel cli 40.0: newvercel inspect --deployment-retention. Useful for audit logs if you're on Enterprise.
RFCs worth watching
- React RFC #516: Activity API. Formal proposal for unmount-preservation (rebranded from the old
Offscreenexperiment). Likely lands in 19.3 behind a flag. "Preserve DOM state while hiding trees from the tree." - Postgres RFC: native incremental materialized views. Still early, but this is the one to watch if you've been patching around with triggers.
Your move this week
30 minutes total. (1) Bump @prisma/client to 6.7.2 and redeploy, CVE is the only real urgency. (2) If you're on Next 15.x, run a local request through your staging proxy and confirm Origin is preserved, or add it to allowedOrigins before your next prod deploy. The rest can wait.