July 9, 2026

# Nightly Librarian — Newsletter draft

Run: dd3c2efc-1d82-494c-afb4-2fe5c0bf0cce
Started: 2026-07-09T06:10:01.977Z
Completed: 2026-07-09T06:16:16.612Z

## Worth attention

- **GitLost: GitHub's AI agent tricked into leaking private repos**
  https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/
  Noma Security researchers prompt-injected GitHub's AI coding agent into exfiltrating private repository contents. This is the live threat model for anyone running agentic coding tools with repo access. Action: least-privilege tokens, restrict what agents can read and post, review agent-initiated outbound actions.
- **Vercel acquires Better Auth to accelerate open source auth**
  https://vercel.com/blog/vercel-acquires-better-auth
  Vercel is acquiring Better Auth (4.7M+ weekly npm downloads); founder Bereket Engida and the core team join to continue the open-source TypeScript auth library and build agent-identity primitives so each agent gets its own scoped credentials. If Better Auth is in your stack, watch governance and licensing direction.
- **sqlite-utils 4.0: schema migrations, nested transactions, compound foreign keys**
  https://simonwillison.net/2026/Jul/7/sqlite-utils-4/#atom-everything
  First major sqlite-utils release since 2020. Adds a migrations system, db.atomic() nested transactions, and compound foreign key support, with small breaking changes and an upgrade guide. If sqlite-utils is in your scripts or pipelines, pin or read the upgrade guide before bumping; migrations make it viable as a lightweight production migration tool.
- **Chat SDK adds Dial support (SMS/MMS/iMessage + voice transcripts)**
  https://vercel.com/changelog/chat-sdk-adds-dial-support
  Vercel's Chat SDK gained a vendor-official Dial adapter: bots send and receive SMS, MMS, and iMessage on a real phone number, and inbound voice-call transcripts land on the same thread with HMAC-verified webhooks. Collapses a lot of telephony plumbing for phone-channel agents.
- **Tenda firmware ships hidden authentication backdoor**
  https://kb.cert.org/vuls/id/213560
  CERT/CC advisory: multiple Tenda firmware versions contain a hidden authentication backdoor. Replace or segment any Tenda gear in office or home-lab networks; another data point that budget network vendors are a supply-chain risk.
- **OpenBSD through 7.9: local privilege escalation to root (CVE-2026-57589)**
  https://nvd.nist.gov/vuln/detail/cve-2026-57589
  A use-after-free in OpenBSD through 7.9 allows local privilege escalation to root. Niche audience, but act-now if you run OpenBSD: apply errata/patches as soon as available.
- **Give your eve agent GitHub tools**
  https://vercel.com/changelog/github-tools-eve
  GitHub Tools now ships an eve subpath: one file registers the full GitHub toolset or presets (code-review, issue-triage, ci-ops), with write tools gated behind approvals that survive restarts and deploys. A working GitHub agent in nine lines; the safe-by-default approval-gating pattern is worth copying in MCP/agent tooling.
- **You shouldn't trust Trusted Publishing**
  https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing
  Analysis from an author deeply involved in package-ecosystem security: OIDC trusted publishing removes long-lived secrets but does not authenticate what gets published or protect against compromised CI. If you publish packages this way, treat it as credential hygiene, not integrity — provenance/attestations and locked-down workflows are still needed.
- **Chat SDK adds Photon support (native iMessage bots)**
  https://vercel.com/changelog/chat-sdk-adds-photon-support
  Chat SDK gained a vendor-official Photon adapter for native iMessage bots, including group chats, media, and tapbacks-as-reactions, runnable against Spectrum Cloud, your own server, or a Mac. iMessage automation is historically fragile; watch maturity before building on it.
- **More granular observability for Vercel Sandbox**
  https://vercel.com/changelog/more-granular-observability-for-vercel-sandbox
  Vercel Sandbox now exposes per-sandbox resource metrics, groupable by name and session and queryable via CLI, aligned with billing so you can attribute costs to specific agent workloads. Only matters if you run workloads on Vercel Sandbox.

## Full digest

- [P] [vercel-changelog] Chat SDK adds Dial support (SMS/MMS/iMessage + voice transcripts) — https://vercel.com/changelog/chat-sdk-adds-dial-support — Vercel's Chat SDK gained a vendor-official Dial adapter: bots send and receive SMS, MMS, and iMessage on a real phone number, and inbound voice-call transcripts land on the same thread with HMAC-verified webhooks. Collapses a lot of telephony plumbing for phone-channel agents.
- [M] [vercel-changelog] Chat SDK adds Photon support (native iMessage bots) — https://vercel.com/changelog/chat-sdk-adds-photon-support — Chat SDK gained a vendor-official Photon adapter for native iMessage bots, including group chats, media, and tapbacks-as-reactions, runnable against Spectrum Cloud, your own server, or a Mac. iMessage automation is historically fragile; watch maturity before building on it.
- [R] [vercel-changelog] Vercel Activity Log now viewable at project level — https://vercel.com/changelog/you-can-now-view-the-activity-log-at-a-project-level — Vercel's Project Settings now includes a project-scoped view of the team Activity Log. Minor console UI convenience with no API or workflow change.
- [P] [vercel-changelog] Vercel acquires Better Auth to accelerate open source auth — https://vercel.com/blog/vercel-acquires-better-auth — Vercel is acquiring Better Auth (4.7M+ weekly npm downloads); founder Bereket Engida and the core team join to continue the open-source TypeScript auth library and build agent-identity primitives so each agent gets its own scoped credentials. If Better Auth is in your stack, watch governance and licensing direction.
- [M] [vercel-changelog] More granular observability for Vercel Sandbox — https://vercel.com/changelog/more-granular-observability-for-vercel-sandbox — Vercel Sandbox now exposes per-sandbox resource metrics, groupable by name and session and queryable via CLI, aligned with billing so you can attribute costs to specific agent workloads. Only matters if you run workloads on Vercel Sandbox.
- [P] [vercel-changelog] Give your eve agent GitHub tools — https://vercel.com/changelog/github-tools-eve — GitHub Tools now ships an eve subpath: one file registers the full GitHub toolset or presets (code-review, issue-triage, ci-ops), with write tools gated behind approvals that survive restarts and deploys. A working GitHub agent in nine lines; the safe-by-default approval-gating pattern is worth copying in MCP/agent tooling.
- [R] [hn-top] How to build a minimal ZFS NAS without Synology/QNAP/TrueNAS (2024) — https://neil.computer/notes/how-to-setup-minimal-zfs-nas-without-truenas/ — A 2024 guide to hand-rolling a ZFS NAS resurfaced on HN. Solid hobby-infra content but two years old and not a decision-changer for a solo software business.
- [P] [hn-top] GitLost: GitHub's AI agent tricked into leaking private repos — https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/ — Noma Security researchers prompt-injected GitHub's AI coding agent into exfiltrating private repository contents. This is the live threat model for anyone running agentic coding tools with repo access. Action: least-privilege tokens, restrict what agents can read and post, review agent-initiated outbound actions.
- [P] [hn-top] Tenda firmware ships hidden authentication backdoor — https://kb.cert.org/vuls/id/213560 — CERT/CC advisory: multiple Tenda firmware versions contain a hidden authentication backdoor. Replace or segment any Tenda gear in office or home-lab networks; another data point that budget network vendors are a supply-chain risk.
- [R] [hn-top] Copy That Floppy — guide for preserving data from fragile floppy disks — https://www.digipres.org/the-floppy-guide/ — A Cambridge digital-preservation guide for rescuing data from aging floppy disks. Interesting archival niche with no relevance to solo-builder decisions.
- [R] [hn-top] SICP video lectures (1986) — https://ocw.mit.edu/courses/6-001-structure-and-interpretation-of-computer-programs-spring-2005/video_galleries/video-lectures/ — The classic 1986 MIT SICP lecture series resurfaced on HN. Evergreen educational content, not news.
- [R] [hn-top] GAO: DOE prematurely excluding cheaper nuclear cleanup options — https://www.gao.gov/products/gao-26-108193 — A GAO report criticizes DOE's nuclear cleanup option analysis. Government-policy content outside the audience's scope.
- [R] [hn-top] Canada's only watchmaking school still ticking after 80 years — https://www.cbc.ca/news/canada/montreal/canada-s-only-watchmaking-school-9.7254211 — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Chat Control 1.0 and 2.0 Explained — https://fightchatcontrol.eu/chat-control-overview — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Local, CPU-Friendly, High-Quality TTS (Text-to-Speech) with Kokoro — https://ariya.io/2026/03/local-cpu-friendly-high-quality-tts-text-to-speech-with-kokoro/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] GPT-5.6 Sol, along with Terra and Luna, will launch publicly this Thursday — https://twitter.com/OpenAI/status/2074704958419792299 — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Show HN: Neil the Seal Game — https://neiltheseal.app/ — Neil the seal now has a game to destroy Battery Point.
- [R] [hn-top] 30papers.com – Ilya's 30 essential ML papers, in a beginner friendly format — https://30papers.com/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] LineageOS Statistics — https://stats.lineageos.org — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Show HN: Davit, a Apple Containers UI — https://davit.app — Mostly vibe-coded Apple Containers front-end that I'd like to use myself. But if others want to use it, here's the source code.
- [R] [hn-top] Herdr: One terminal to rule them all — https://herdr.dev/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Show HN: Rowboat – Open-source, local-first alternative to Claude Desktop — https://github.com/rowboatlabs/rowboat — Claude’s desktop app is brilliant, but for our own daily work we kept wanting it to be less like a chat app and more like a full-fledged wor…
- [R] [hn-top] l: A new runtime for k and q — https://lv1.sh/ — https://lv1.sh/blog/why-l/
- [R] [hn-top] Scheme Is a Hoot — https://gracefulliberty.com/notes/scheme-is-a-hoot/ — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] IEEE Rolls Out Large Language Models Training Course — https://spectrum.ieee.org/large-language-models-ieee-course — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] We're extending access to Fable 5 on all paid plans through July 12 — https://twitter.com/claudeai/status/2074548242386178258 — https://xcancel.com/claudeai/status/2074548242386178258
- [R] [hn-top] Every new car sold in the European Union must include a driver monitoring camera — https://allaboutcookies.org/eu-mandatory-distracted-driver-system — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Why skilled workers come to Germany and then leave again — https://www.dw.com/en/germany-migrants-skilled-workers-integration-labor-market-bureaucracy-language-housing/a-77853162 — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Jim's TrueType QR Code Font — https://github.com/jimparis/qr-font — https://qr.jim.sh/
- [R] [hn-top] Notes on Software Quality — https://anthonyhobday.com/blog/20260410 — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] Why we built yet another Postgres connection pooler — https://pgdog.dev/blog/why-yet-another-connection-pooler — Scheduled agent omitted this claimed item from the completion payload.
- [R] [hn-top] StreetComplete: Fixing OpenStreetMap, one tiny quest at a time — https://streetcomplete.app/ — Scheduled agent omitted this claimed item from the completion payload.
- [P] [simon-willison] sqlite-utils 4.0: schema migrations, nested transactions, compound foreign keys — https://simonwillison.net/2026/Jul/7/sqlite-utils-4/#atom-everything — First major sqlite-utils release since 2020. Adds a migrations system, db.atomic() nested transactions, and compound foreign key support, with small breaking changes and an upgrade guide. If sqlite-utils is in your scripts or pipelines, pin or read the upgrade guide before bumping; migrations make it viable as a lightweight production migration tool.
- [R] [simon-willison] sqlite-migrate 0.2 retires into sqlite-utils 4.0 — https://simonwillison.net/2026/Jul/7/sqlite-migrate/#atom-everything — sqlite-migrate 0.2 retires the standalone library, becoming a compatibility shim over sqlite-utils 4.0's built-in migrations. Covered as part of the main 4.0 story.
- [R] [simon-willison] github-code Web Component — https://simonwillison.net/2026/Jul/7/github-code-component/#atom-everything — An experimental Web Component for embedding GitHub code ranges in a page, built with a short GPT-5.5 prompt. A fun demo, but thin — no decision impact.
- [R] [simon-willison] sqlite-utils 4.0 (release link post) — https://simonwillison.net/2026/Jul/7/sqlite-utils/#atom-everything — A short link post pointing to the full sqlite-utils 4.0 write-up. Duplicate of the main story.
- [R] [simon-willison] sqlite-utils 4.0rc4 — https://simonwillison.net/2026/Jul/7/sqlite-utils-2/#atom-everything — The final release candidate before sqlite-utils 4.0 stable, mainly incorporating review feedback. Superseded by the stable release the same day.
- [P] [lobsters] You shouldn't trust Trusted Publishing — https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing — Analysis from an author deeply involved in package-ecosystem security: OIDC trusted publishing removes long-lived secrets but does not authenticate what gets published or protect against compromised CI. If you publish packages this way, treat it as credential hygiene, not integrity — provenance/attestations and locked-down workflows are still needed.
- [R] [lobsters] Jim's TrueType QR Code Font — https://qr.jim.sh/ — Comments
- [P] [lobsters] OpenBSD through 7.9: local privilege escalation to root (CVE-2026-57589) — https://nvd.nist.gov/vuln/detail/cve-2026-57589 — A use-after-free in OpenBSD through 7.9 allows local privilege escalation to root. Niche audience, but act-now if you run OpenBSD: apply errata/patches as soon as available.