July 23, 2026
Report summary
12 stories cleared the bar, led by v16.2.11, v15.5.21, and Gemini last models: temperature, top_p, and top_k are deprecated and ignored.
Worth attention
Next.js 16.2.11 ships fixes for two High-severity advisories: a Denial of Service in the App Router via Server Actions and a Middleware/Proxy bypass. If you run Next.js 16.x, upgrade now.
Same two High-severity Next.js advisories (App Router DoS via Server Actions, Middleware/Proxy bypass) backported to the 15.x line as 15.5.21. Upgrade if you're still on Next.js 15.
Google says the latest Gemini models now deprecate and ignore temperature, top_p, and top_k. If your code sets these sampling params against current Gemini models, they no longer do anything — review and adjust expectations.
OpenAI and Hugging Face disclosed a security incident that occurred during a model evaluation. Notable for anyone running or evaluating agentic models against live services — a reminder to sandbox eval harnesses. Details still thin from the vendors.
Simon Willison covers Nativ, a macOS desktop app wrapping Apple's MLX to run vision-LLMs and other models locally on a Mac. Directly useful if you run local models on Mac hardware — a friendlier front-end than raw MLX/Ollama scripting.
Vercel Connect adds 90+ preset connectors (Shopify, Okta, Workday, Jira, Sanity) that pre-populate integration setup. Reduces boilerplate if you build on Vercel's integration layer.
Vercel MCP can now complete purchases: it quotes price, states one-time vs recurring, and only charges after explicit confirmation. An early example of agents transacting through MCP — relevant if you build MCP servers or agent tooling.
Poolside's Laguna S 2.1, an open-weight MoE coding model with up to 1M-token context and thinking/no-thinking modes, is now on Vercel AI Gateway. Worth a look if you want an open-weight coding model with large context.
Gemini 3.6 Flash and 3.5 Flash-Lite are now on Vercel AI Gateway. 3.6 Flash claims better coding/agentic quality while using fewer tokens and calls. Consider for cost-sensitive agentic workloads.
AI Gateway adds service tiers letting you trade latency, throughput, and cost per request. Pick a faster tier for interactive work or a cheaper tier for batch. A cost lever if you route models through the gateway.
OpenAI launched an ads offering for ChatGPT (ads.openai.com). A meaningful shift in the assistant-distribution landscape — relevant if you think about discovery, marketing, or building on top of ChatGPT.
Simon Willison's writeup of a fireside chat with Anthropic's Claude Code team covering Claude Code, coding-agent security, evals, and tool design. Useful context if you build with or on top of Claude Code and agent tooling.
Full digest
Vercel case study claiming a customer shipped features 5x faster using AI Gateway. Pure vendor marketing with no reproducible detail.
Vercel now precompiles Python functions to bytecode at build time, cutting median cold starts from 2.8s to 1.3s. Automatic for Python functions on Vercel; nothing to do unless you run Python serverless there.
Vercel Connect adds 90+ preset connectors (Shopify, Okta, Workday, Jira, Sanity) that pre-populate integration setup. Reduces boilerplate if you build on Vercel's integration layer.
Vercel MCP can now complete purchases: it quotes price, states one-time vs recurring, and only charges after explicit confirmation. An early example of agents transacting through MCP — relevant if you build MCP servers or agent tooling.
Poolside's Laguna S 2.1, an open-weight MoE coding model with up to 1M-token context and thinking/no-thinking modes, is now on Vercel AI Gateway. Worth a look if you want an open-weight coding model with large context.
Gemini 3.6 Flash and 3.5 Flash-Lite are now on Vercel AI Gateway. 3.6 Flash claims better coding/agentic quality while using fewer tokens and calls. Consider for cost-sensitive agentic workloads.
AI Gateway adds service tiers letting you trade latency, throughput, and cost per request. Pick a faster tier for interactive work or a cheaper tier for batch. A cost lever if you route models through the gateway.
Next.js preview build changelog — example fixes and dependency bumps only.
Next.js canary changelog — internal Turbopack/docs tweaks and dependency bumps.
Next.js canary changelog — example fixes and dependency bumps.
P
v16.2.11
Next.js 16.2.11 ships fixes for two High-severity advisories: a Denial of Service in the App Router via Server Actions and a Middleware/Proxy bypass. If you run Next.js 16.x, upgrade now.
P
v15.5.21
Same two High-severity Next.js advisories (App Router DoS via Server Actions, Middleware/Proxy bypass) backported to the 15.x line as 15.5.21. Upgrade if you're still on Next.js 15.
OpenAI and Hugging Face disclosed a security incident that occurred during a model evaluation. Notable for anyone running or evaluating agentic models against live services — a reminder to sandbox eval harnesses. Details still thin from the vendors.
Fireworks/Moonshot claim Kimi K3 is competitive with Fable and near-SoTA on agentic benchmarks (second only to Fable 5 on AA-Briefcase). Benchmark-only for now; worth tracking as an open model option.
A command-line social/chat toy. Novelty, no builder leverage.
Open ecosystem project for e-readers. Niche hardware, not dev-relevant.
OpenAI launched an ads offering for ChatGPT (ads.openai.com). A meaningful shift in the assistant-distribution landscape — relevant if you think about discovery, marketing, or building on top of ChatGPT.
A judge approved the $1.5B Anthropic settlement over pirated books used to train Claude. Context worth knowing for anyone building on Claude or watching AI copyright precedent; no direct action.
Google's own announcement of Gemini 3.6 Flash / 3.5 Flash-Lite / Flash Cyber — same story already covered via the AI Gateway item.
Terence Tao's math post on a Jacobian conjecture counterexample. Fascinating but not relevant to a software shop.
LG plans to ban residential-proxy apps from its smart-TV app store. Part of a broader squeeze on residential proxy supply — worth tracking if you rely on proxies for scraping.
A 2015 reflective essay on happiness. Not actionable dev content.
Science story about a coral reef discovered off West Africa. Off-topic.
Jack Dorsey's Block launched Buzz, combining team chat, AI agents, and Git hosting. Early and unproven, but an interesting bundled-workspace play worth watching.
Fun experiment having LLMs 'draw' the Mona Lisa. Entertainment, no signal.
Legal analysis of Apple defeating CSAM-scanning liability. Sensitive, off-topic for a solo dev shop.
Personal essay on the decline of radio. Off-topic.
An interactive map of castles and fortresses. Entertainment.
Poolside's own announcement of Laguna S 2.1 — same model already covered via the AI Gateway item.
Google says the latest Gemini models now deprecate and ignore temperature, top_p, and top_k. If your code sets these sampling params against current Gemini models, they no longer do anything — review and adjust expectations.
EU court ruling that VPNs are lawful technical tools. Interesting but not dev-actionable.
A 1996 history of the Prolog language. Interesting, not actionable.
A hobbyist build log for a USB drive with a hidden encrypted vault. Niche.
Justif is a drop-in JS library that adds TeX-quality (Knuth-Plass) justification and microtypography to web pages via a single script tag, degrading gracefully without JS. Nice low-effort polish for content-heavy sites.
Roblox now supports GrapheneOS via Android remote attestation. Niche.
Simon Willison covers Nativ, a macOS desktop app wrapping Apple's MLX to run vision-LLMs and other models locally on a Mac. Directly useful if you run local models on Mac hardware — a friendlier front-end than raw MLX/Ollama scripting.
Simon Willison's writeup of a fireside chat with Anthropic's Claude Code team covering Claude Code, coding-agent security, evals, and tool design. Useful context if you build with or on top of Claude Code and agent tooling.
A debugging anecdote about a rejected GitHub SSH key. Low signal.
Sensationalized retelling of the OpenAI/Hugging Face eval incident ('model breaks out of sandbox, hacks HF'). Covered better via the official disclosure.
A reminder about git's `--end-of-options` separator to stop attacker- or agent-supplied refs/paths from being parsed as flags. Small but real hardening for scripts and agents that shell out to git.
Original markdown
# Nightly Librarian — Newsletter draft
Run: 4b7626cf-c01b-4153-bebf-9d0d1d7c5d14
Started: 2026-07-23T06:10:10.690Z
Completed: 2026-07-23T06:16:33.286Z
## Worth attention
- **v16.2.11**
https://github.com/vercel/next.js/releases/tag/v16.2.11
Next.js 16.2.11 ships fixes for two High-severity advisories: a Denial of Service in the App Router via Server Actions and a Middleware/Proxy bypass. If you run Next.js 16.x, upgrade now.
- **v15.5.21**
https://github.com/vercel/next.js/releases/tag/v15.5.21
Same two High-severity Next.js advisories (App Router DoS via Server Actions, Middleware/Proxy bypass) backported to the 15.x line as 15.5.21. Upgrade if you're still on Next.js 15.
- **Gemini last models: temperature, top_p, and top_k are deprecated and ignored**
https://ai.google.dev/gemini-api/docs/latest-model
Google says the latest Gemini models now deprecate and ignore temperature, top_p, and top_k. If your code sets these sampling params against current Gemini models, they no longer do anything — review and adjust expectations.
- **OpenAI and Hugging Face address security incident during model evaluation**
https://openai.com/index/hugging-face-model-evaluation-security-incident/
OpenAI and Hugging Face disclosed a security incident that occurred during a model evaluation. Notable for anyone running or evaluating agentic models against live services — a reminder to sandbox eval harnesses. Details still thin from the vendors.
- **Nativ: Run AI models locally on your Mac**
https://simonwillison.net/2026/Jul/21/nativ/#atom-everything
Simon Willison covers Nativ, a macOS desktop app wrapping Apple's MLX to run vision-LLMs and other models locally on a Mac. Directly useful if you run local models on Mac hardware — a friendlier front-end than raw MLX/Ollama scripting.
- **Vercel Connect adds 90+ preset connectors**
https://vercel.com/changelog/vercel-connect-preset-connectors
Vercel Connect adds 90+ preset connectors (Shopify, Okta, Workday, Jira, Sanity) that pre-populate integration setup. Reduces boilerplate if you build on Vercel's integration layer.
- **Vercel MCP now supports purchases**
https://vercel.com/changelog/vercel-mcp-now-supports-purchases
Vercel MCP can now complete purchases: it quotes price, states one-time vs recurring, and only charges after explicit confirmation. An early example of agents transacting through MCP — relevant if you build MCP servers or agent tooling.
- **Laguna S 2.1 is now available on AI Gateway**
https://vercel.com/changelog/laguna-s-2-1-is-now-available-on-ai-gateway
Poolside's Laguna S 2.1, an open-weight MoE coding model with up to 1M-token context and thinking/no-thinking modes, is now on Vercel AI Gateway. Worth a look if you want an open-weight coding model with large context.
- **Gemini 3.6 Flash and Gemini 3.5 Flash-Lite are now available on AI Gateway**
https://vercel.com/changelog/gemini-3-6-flash-3-5-flash-lite-on-ai-gateway
Gemini 3.6 Flash and 3.5 Flash-Lite are now on Vercel AI Gateway. 3.6 Flash claims better coding/agentic quality while using fewer tokens and calls. Consider for cost-sensitive agentic workloads.
- **Service tiers now available on AI Gateway**
https://vercel.com/changelog/service-tiers-now-available-on-ai-gateway
AI Gateway adds service tiers letting you trade latency, throughput, and cost per request. Pick a faster tier for interactive work or a cheaper tier for batch. A cost lever if you route models through the gateway.
- **Advertise in ChatGPT**
https://ads.openai.com/
OpenAI launched an ads offering for ChatGPT (ads.openai.com). A meaningful shift in the assistant-distribution landscape — relevant if you think about discovery, marketing, or building on top of ChatGPT.
- **A Fireside Chat with Cat and Thariq from the Claude Code team**
https://simonwillison.net/2026/Jul/21/cat-and-thariq/#atom-everything
Simon Willison's writeup of a fireside chat with Anthropic's Claude Code team covering Claude Code, coding-agent security, evals, and tool design. Useful context if you build with or on top of Claude Code and agent tooling.
## Full digest
- [R] [vercel-changelog] How Searchable ships customer-requested features in 30 minutes on Vercel — https://vercel.com/blog/how-searchable-ships-customer-requested-features-in-30-minutes-on-vercel — Vercel case study claiming a customer shipped features 5x faster using AI Gateway. Pure vendor marketing with no reproducible detail.
- [M] [vercel-changelog] Python function bundles now include precompiled bytecode — https://vercel.com/changelog/python-function-bundles-now-include-precompiled-bytecode — Vercel now precompiles Python functions to bytecode at build time, cutting median cold starts from 2.8s to 1.3s. Automatic for Python functions on Vercel; nothing to do unless you run Python serverless there.
- [P] [vercel-changelog] Vercel Connect adds 90+ preset connectors — https://vercel.com/changelog/vercel-connect-preset-connectors — Vercel Connect adds 90+ preset connectors (Shopify, Okta, Workday, Jira, Sanity) that pre-populate integration setup. Reduces boilerplate if you build on Vercel's integration layer.
- [P] [vercel-changelog] Vercel MCP now supports purchases — https://vercel.com/changelog/vercel-mcp-now-supports-purchases — Vercel MCP can now complete purchases: it quotes price, states one-time vs recurring, and only charges after explicit confirmation. An early example of agents transacting through MCP — relevant if you build MCP servers or agent tooling.
- [P] [vercel-changelog] Laguna S 2.1 is now available on AI Gateway — https://vercel.com/changelog/laguna-s-2-1-is-now-available-on-ai-gateway — Poolside's Laguna S 2.1, an open-weight MoE coding model with up to 1M-token context and thinking/no-thinking modes, is now on Vercel AI Gateway. Worth a look if you want an open-weight coding model with large context.
- [P] [vercel-changelog] Gemini 3.6 Flash and Gemini 3.5 Flash-Lite are now available on AI Gateway — https://vercel.com/changelog/gemini-3-6-flash-3-5-flash-lite-on-ai-gateway — Gemini 3.6 Flash and 3.5 Flash-Lite are now on Vercel AI Gateway. 3.6 Flash claims better coding/agentic quality while using fewer tokens and calls. Consider for cost-sensitive agentic workloads.
- [P] [vercel-changelog] Service tiers now available on AI Gateway — https://vercel.com/changelog/service-tiers-now-available-on-ai-gateway — AI Gateway adds service tiers letting you trade latency, throughput, and cost per request. Pick a faster tier for interactive work or a cheaper tier for batch. A cost lever if you route models through the gateway.
- [R] [gh-nextjs] v16.3.0-preview.7 — https://github.com/vercel/next.js/releases/tag/v16.3.0-preview.7 — Next.js preview build changelog — example fixes and dependency bumps only.
- [R] [gh-nextjs] v16.3.0-canary.93 — https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.93 — Next.js canary changelog — internal Turbopack/docs tweaks and dependency bumps.
- [R] [gh-nextjs] v16.3.0-canary.92 — https://github.com/vercel/next.js/releases/tag/v16.3.0-canary.92 — Next.js canary changelog — example fixes and dependency bumps.
- [P] [gh-nextjs] v16.2.11 — https://github.com/vercel/next.js/releases/tag/v16.2.11 — Next.js 16.2.11 ships fixes for two High-severity advisories: a Denial of Service in the App Router via Server Actions and a Middleware/Proxy bypass. If you run Next.js 16.x, upgrade now.
- [P] [gh-nextjs] v15.5.21 — https://github.com/vercel/next.js/releases/tag/v15.5.21 — Same two High-severity Next.js advisories (App Router DoS via Server Actions, Middleware/Proxy bypass) backported to the 15.x line as 15.5.21. Upgrade if you're still on Next.js 15.
- [P] [hn-top] OpenAI and Hugging Face address security incident during model evaluation — https://openai.com/index/hugging-face-model-evaluation-security-incident/ — OpenAI and Hugging Face disclosed a security incident that occurred during a model evaluation. Notable for anyone running or evaluating agentic models against live services — a reminder to sandbox eval harnesses. Details still thin from the vendors.
- [M] [hn-top] Kimi K3 Is Competitive with Fable; Kimi K3 and Fable Is SoTA — https://fireworks.ai/blog/kimik3-fable — Fireworks/Moonshot claim Kimi K3 is competitive with Fable and near-SoTA on agentic benchmarks (second only to Fable 5 on AA-Briefcase). Benchmark-only for now; worth tracking as an open model option.
- [R] [hn-top] Late.sh – a command-line Clubhouse for computer people — https://late.sh/ — A command-line social/chat toy. Novelty, no builder leverage.
- [R] [hn-top] FreeInk: Open ecosystem for e-readers — https://freeink.org/ — Open ecosystem project for e-readers. Niche hardware, not dev-relevant.
- [P] [hn-top] Advertise in ChatGPT — https://ads.openai.com/ — OpenAI launched an ads offering for ChatGPT (ads.openai.com). A meaningful shift in the assistant-distribution landscape — relevant if you think about discovery, marketing, or building on top of ChatGPT.
- [P] [hn-top] Judge approves $1.5B Anthropic settlement for pirated books used to train Claude — https://apnews.com/article/ai-anthropic-copyright-settlement-claude-books-bartz-74b140444023898aeba8579b6e9f0d63 — A judge approved the $1.5B Anthropic settlement over pirated books used to train Claude. Context worth knowing for anyone building on Claude or watching AI copyright precedent; no direct action.
- [R] [hn-top] Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber — https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-6-flash-3-5-flash-lite-3-5-flash-cyber/ — Google's own announcement of Gemini 3.6 Flash / 3.5 Flash-Lite / Flash Cyber — same story already covered via the AI Gateway item.
- [R] [hn-top] A digestion of the Jacobian conjecture counterexample — https://terrytao.wordpress.com/2026/07/21/a-digestion-of-the-jacobian-conjecture-counterexample/ — Terence Tao's math post on a Jacobian conjecture counterexample. Fascinating but not relevant to a software shop.
- [M] [hn-top] LG to ban residential proxies from smart TV apps — https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/ — LG plans to ban residential-proxy apps from its smart-TV app store. Part of a broader squeeze on residential proxy supply — worth tracking if you rely on proxies for scraping.
- [R] [hn-top] Ten Steps Towards Happiness (2015) — http://hintjens.com/blog:99 — A 2015 reflective essay on happiness. Not actionable dev content.
- [R] [hn-top] Long presumed dead, a thriving coral reef is discovered in West Africa — https://e360.yale.edu/digest/benin-coral-reef — Science story about a coral reef discovered off West Africa. Off-topic.
- [M] [hn-top] Jack Dorsey launches Buzz to combine team chat, AI agents and Git hosting — https://runtimewire.com/article/jack-dorsey-block-buzz-team-chat-ai-agents-git — Jack Dorsey's Block launched Buzz, combining team chat, AI agents, and Git hosting. Early and unproven, but an interesting bundled-workspace play worth watching.
- [R] [hn-top] "Drawing" the Mona Lisa with GPT-5.6, Claude, Gemini, and Grok — https://www.tryai.dev/blog/ai-drawing-arena-colored-pencils-claude-gpt-grok — Fun experiment having LLMs 'draw' the Mona Lisa. Entertainment, no signal.
- [R] [hn-top] Apple defeats liability for not scanning iCloud for CSAM — https://blog.ericgoldman.org/archives/2026/07/apple-defeats-liability-for-not-scanning-icloud-for-csam-but-the-judge-was-not-pleased-amy-v-apple.htm — Legal analysis of Apple defeating CSAM-scanning liability. Sensitive, off-topic for a solo dev shop.
- [R] [hn-top] It's a shame what's happened to radio — https://blog.jimgrey.net/2026/07/21/its-a-shame-whats-happened-to-radio-3/ — Personal essay on the decline of radio. Off-topic.
- [R] [hn-top] Map of the world's great castles and fortresses — https://thecastlemap.com/ — An interactive map of castles and fortresses. Entertainment.
- [R] [hn-top] Laguna S 2.1 — https://poolside.ai/blog/introducing-laguna-s-2-1 — Poolside's own announcement of Laguna S 2.1 — same model already covered via the AI Gateway item.
- [P] [hn-top] Gemini last models: temperature, top_p, and top_k are deprecated and ignored — https://ai.google.dev/gemini-api/docs/latest-model — Google says the latest Gemini models now deprecate and ignore temperature, top_p, and top_k. If your code sets these sampling params against current Gemini models, they no longer do anything — review and adjust expectations.
- [R] [hn-top] 'VPNs are lawful technical tools,' says EU Court in landmark copyright ruling — https://www.techradar.com/vpn/vpn-privacy-security/vpns-are-lawful-technical-tools-says-eu-court-in-landmark-anne-frank-copyright-ruling — EU court ruling that VPNs are lawful technical tools. Interesting but not dev-actionable.
- [R] [hn-top] The Birth of Prolog (1996) — https://dl.acm.org/doi/10.1145/234286.1057820 — A 1996 history of the Prolog language. Interesting, not actionable.
- [R] [hn-top] My USB Drive Has a Hidden Encrypted Vault — https://rootkitlabs.com/2026/06/22/I%27m-Building-a-Secure-USB-Drive/ — A hobbyist build log for a USB drive with a hidden encrypted vault. Niche.
- [P] [hn-top] Show HN: Justif – Knuth-Plass justification and microtypography for the web — https://justif.lyall.co/ — Justif is a drop-in JS library that adds TeX-quality (Knuth-Plass) justification and microtypography to web pages via a single script tag, degrading gracefully without JS. Nice low-effort polish for content-heavy sites.
- [R] [hn-top] Roblox Officially Supports GrapheneOS — https://en.help.roblox.com/hc/en-us/articles/49648939984916-Android-Remote-Attestation — Roblox now supports GrapheneOS via Android remote attestation. Niche.
- [P] [simon-willison] Nativ: Run AI models locally on your Mac — https://simonwillison.net/2026/Jul/21/nativ/#atom-everything — Simon Willison covers Nativ, a macOS desktop app wrapping Apple's MLX to run vision-LLMs and other models locally on a Mac. Directly useful if you run local models on Mac hardware — a friendlier front-end than raw MLX/Ollama scripting.
- [P] [simon-willison] A Fireside Chat with Cat and Thariq from the Claude Code team — https://simonwillison.net/2026/Jul/21/cat-and-thariq/#atom-everything — Simon Willison's writeup of a fireside chat with Anthropic's Claude Code team covering Claude Code, coding-agent security, evals, and tool design. Useful context if you build with or on top of Claude Code and agent tooling.
- [R] [lobsters] GitHub suddenly rejected my SSH key (the fix was a .pub file?!) — https://thorsell.io/2026/07/21/github-ssh-keys.html — A debugging anecdote about a rejected GitHub SSH key. Low signal.
- [R] [lobsters] OpenAI model breaks out of security sandbox, hacks Hugging Face for data to pass test — https://openai.com/index/hugging-face-model-evaluation-security-incident/ — Sensationalized retelling of the OpenAI/Hugging Face eval incident ('model breaks out of sandbox, hacks HF'). Covered better via the official disclosure.
- [P] [lobsters] git --end-of-options — https://nesbitt.io/2026/07/21/end-of-options.html — A reminder about git's `--end-of-options` separator to stop attacker- or agent-supplied refs/paths from being parsed as flags. Small but real hardening for scripts and agents that shell out to git.