October 2, 2026

# Nightly Librarian — Newsletter draft

Run: 02f16f22-3d92-4195-be6e-43113c839cd6
Started: 2026-10-02T06:03:51.028Z
Completed: 2026-10-02T06:05:18.004Z

## Worth attention

- **v16.3.8**
  https://github.com/vercel/next.js/releases/tag/v16.3.8
  Next.js 16.3.8 fixes one high-severity SSRF in image optimization plus several medium advisories: cache poisoning of SSG/ISR pages in self-hosted apps, Draft Mode leaking through 'use cache', and a metadata image route dynamicParams bypass. Upgrade any Next.js app, especially self-hosted ones or those using next/image or 'use cache'. A 15.5.27 backport also appeared.
- **Vercel CDN no longer caches responses with Vary: Cookie**
  https://vercel.com/changelog/vary-cookie-responses-no-longer-cached
  Vercel CDN no longer caches origin responses whose Vary header includes Cookie; they are served normally but marked MISS with cache reason vary_key_denied. If you rely on cached routes that send Vary: Cookie, expect more origin hits and cost. Check Runtime Logs and fix the origin header.
- **Ling 3.1 Flash is now available on AI Gateway**
  https://vercel.com/changelog/ling-3-1-flash-is-now-available-on-ai-gateway
  Ling 3.1 Flash (InclusionAI, 560B total/25B active, 262K context) is free on AI Gateway through Oct 13, 2026. The standard ID starts billing afterwards while the -free ID stops serving, so don't leave it wired into anything.
- **AI Gateway adds Browserbase Search and Fetch tools**
  https://vercel.com/changelog/ai-gateway-adds-browserbase-search-and-fetch-tools
  AI Gateway now exposes Browserbase Search and Fetch as tools usable across providers with one API key (AI SDK 7.0.116+). Useful for adding web search and retrieval to agents without a separate integration. Check pricing in the docs before adopting.
- **v3.3.0-rc1**
  https://github.com/deepset-ai/haystack/releases/tag/v3.3.0-rc1
  Haystack v3.3.0-rc1 speeds up SentenceWindowRetriever (one Document Store query per run) and changes InMemory BM25L/BM25Plus to return only documents containing a query term, so top_k can return fewer results and score thresholds need re-checking. Only matters if you run Haystack; watch for the final 3.3.0.
- **How we systematically improved our reliability**
  https://neon.com/blog/how-we-systematically-improved-our-reliability
  Neon published a post on reliability work after two incidents in one week. Only the intro was captured, so substance is unknown. Worth a read if you depend on Neon Postgres.

## Full digest

- [R] [gh-langchain] langchain-openai==1.6.7 — https://github.com/langchain-ai/langchain/releases/tag/langchain-openai%3D%3D1.6.7 — Patch release of langchain-openai (1.6.7) containing only model-profile data refreshes and test cleanup. No user-facing change.
- [R] [gh-composio] CLI Beta @composio/[email protected] — https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.4.3-beta.409 — Beta CLI build for Composio, mostly docs updates plus a few SDK fixes (Gemini AFC arguments, json-schema-to-zod, file name handling). Nothing decision-changing.
- [M] [gh-haystack] v3.3.0-rc1 — https://github.com/deepset-ai/haystack/releases/tag/v3.3.0-rc1 — Haystack v3.3.0-rc1 speeds up SentenceWindowRetriever (one Document Store query per run) and changes InMemory BM25L/BM25Plus to return only documents containing a query term, so top_k can return fewer results and score thresholds need re-checking. Only matters if you run Haystack; watch for the final 3.3.0.
- [R] [hn-show] Show HN: Ledge.sh – Runnable Markdown Notes — https://ledge.sh — Show HN launch of Ledge.sh, runnable Markdown notes. Early-stage product with no evidence of leverage or adoption.
- [R] [hn-show] Show HN: JBR-001 – An open-source 3D printable desktop robot — https://projecthub.arduino.cc/syntheticaidata/jbr-001-a-desktop-companion-robot-powered-by-arduino-uno-q-b11c96 — Show HN of an open-source 3D-printable Arduino desktop robot. Hardware hobby project, unrelated to software shop decisions.
- [R] [hn-show] Show HN: Dental Scope – Interactive 3D dental anatomy — https://dental-scope.com/ — Show HN of an interactive 3D dental anatomy viewer. No content fetched and not relevant to solo software decisions.
- [R] [hn-show] Show HN: Using 2D DFT, dithering, etc. to maximize eInk manga image quality — https://github.com/ciromattia/kcc — Show HN about image processing (2D DFT, dithering) to improve e-ink manga rendering in KCC. Niche and unrelated to current projects.
- [M] [neon-blog] How we systematically improved our reliability — https://neon.com/blog/how-we-systematically-improved-our-reliability — Neon published a post on reliability work after two incidents in one week. Only the intro was captured, so substance is unknown. Worth a read if you depend on Neon Postgres.
- [R] [reddit-saas] I solved my biggest marketing pain with Opus 5.5 — https://www.reddit.com/r/SaaS/comments/1wurdap/i_solved_my_biggest_marketing_pain_with_opus_55/ — Reddit post claiming Opus 5.5 makes product demo videos easy. Anecdotal, video-only, no method shown.
- [R] [reddit-saas] I made my first $7.99 😭 and immediately became a detective. — https://www.reddit.com/r/SaaS/comments/1wuocsq/i_made_my_first_799_and_immediately_became_a/ — First-$7.99 revenue anecdote. Entertainment and engagement, not actionable.
- [R] [reddit-saas] Not every interested user is your customer — https://www.reddit.com/r/SaaS/comments/1wupne6/not_every_interested_user_is_your_customer/ — Generic advice thread that not every interested user is a customer. Commonplace.
- [R] [reddit-saas] I got my first paying tenant today... R$79 MRR. It’s not much, but damn, — https://www.reddit.com/r/SaaS/comments/1wueckc/i_got_my_first_paying_tenant_today_r79_mrr_its/ — First paying tenant at R$79 MRR. Milestone post without transferable lesson.
- [R] [reddit-saas] Do customers cancelling their Autopay mandate hurt subscription business? — https://www.reddit.com/r/SaaS/comments/1wuq16p/do_customers_cancelling_their_autopay_mandate/ — Discussion question on whether Autopay mandate cancellations hurt subscription businesses. No answers or data captured.
- [R] [reddit-saas] I turned a random idea into a working tool in just 10 hours. — https://www.reddit.com/r/SaaS/comments/1wuqqyn/i_turned_a_random_idea_into_a_working_tool_in/ — Post about turning an idea into a working tool in 10 hours. Anecdotal vibe-building story.
- [R] [reddit-saas] 'One way' partnerships in Saas - how do you address them. — https://www.reddit.com/r/SaaS/comments/1wury8o/one_way_partnerships_in_saas_how_do_you_address/ — We are an AI video solution and are trying to partner with LMS companies. We approached a few LMS companies and here's what they told us. Ea…
- [R] [reddit-saas] Learnings, reflections from my decade long B2B SaaS career. No AI, no backspace. — https://www.reddit.com/r/SaaS/comments/1wuro71/learnings_reflections_from_my_decade_long_b2b/ — Started in B2B SaaS in 2015, worked across sales, support, product and marketing in a few B2B startups. This is what I've realized, in no pa…
- [R] [reddit-saas] Changed my ad strategy: bounce rate went from 95% to ~45%, but traffic dropped to almost nothing. How do I scale? — https://www.reddit.com/r/SaaS/comments/1wujon5/changed_my_ad_strategy_bounce_rate_went_from_95/ — Hi everyone. I'm launching a financial planning web tool for entrepreneurs and small businesses, and I'd like your take on my ad results. My…
- [R] [reddit-saas] 94 active users in 24h from LinkedIn, cold outreach and X. What should I do next to get to 100 paying customers? — https://www.reddit.com/r/SaaS/comments/1wul9zd/94_active_users_in_24h_from_linkedin_cold/ — Building MyKayd a form builder that doesn’t just collect responses, but helps you understand them, spot where people drop off, and figure ou…
- [R] [reddit-saas] SaaS founders can GTM easily now. — https://www.reddit.com/r/SaaS/comments/1wuqdwx/saas_founders_can_gtm_easily_now/ — "I built the SaaS. Then I posted about it and nobody GAF." Does this sound familiar? I think everyone in this subreddit has felt it. Founder…
- [R] [reddit-saas] I will help you build website/app , price: $200/week — https://www.reddit.com/r/SaaS/comments/1wutkb3/i_will_help_you_build_websiteapp_price_200week/ — Hey everyone, developer here. I have 4+ years of experience working with React, Next.js, Node.js, and React Native. I’ve worked on SaaS webs…
- [R] [reddit-saas] Problems with Copilot — https://www.reddit.com/r/SaaS/comments/1wutjqa/problems_with_copilot/ — I’ve been looking at Microsoft Copilot and I’m curious what people who actually use it think. A few limitations I’ve noticed: Limited connec…
- [R] [reddit-saas] Promo video for my site — https://www.reddit.com/r/SaaS/comments/1wupiyh/promo_video_for_my_site/ —   submitted by   /u/mothh9 [link]   [comments]
- [R] [reddit-saas] I just got my first paying subscriber 🎉 — https://www.reddit.com/r/SaaS/comments/1wut7r8/i_just_got_my_first_paying_subscriber/ — $6 not much, but motivating that somebody is actually willing to pay🤯 I built an app called AppBlockr to fight doomscrolling while helping…
- [R] [reddit-saas] High running costs before customers — https://www.reddit.com/r/SaaS/comments/1wubbvr/high_running_costs_before_customers/ — How do people deal with operating a service that has high running costs when you don't have any income from it? For example, I posted recent…
- [R] [reddit-saas] Interested in learning about reddit ads for SaaS — https://www.reddit.com/r/SaaS/comments/1wut2nc/interested_in_learning_about_reddit_ads_for_saas/ — Has anyone here actually run Reddit Ads for a B2B SaaS product? I’m interested in hearing about your experience and what you learned from it…
- [R] [reddit-saas] The cheapest positioning check I know: one noun, three Wayback snapshots, 20 minutes — https://www.reddit.com/r/SaaS/comments/1wuss1i/the_cheapest_positioning_check_i_know_one_noun/ — Most positioning advice asks you to decide who you are. This one ask what you already did, which is easier to answer and harder to look at.…
- [R] [reddit-saas] How good is giving a free trial for your product? — https://www.reddit.com/r/SaaS/comments/1wusrnq/how_good_is_giving_a_free_trial_for_your_product/ — I recently launched my product, and initially, there was no free trial. People started coming in and creating new accounts every day. Almost…
- [R] [reddit-saas] I built an AI study app because normal studying is painfully boring. Here’s the demo. — https://www.reddit.com/r/SaaS/comments/1wulz8k/i_built_an_ai_study_app_because_normal_studying/ —   submitted by   /u/HeadChance123 [link]   [comments]
- [R] [reddit-saas] What CRM are you using to manage customers? — https://www.reddit.com/r/SaaS/comments/1wusags/what_crm_are_you_using_to_manage_customers/ — I'm at the point where I need some kind of CRM/customer management system, but I'm not sure if I should use an existing tool or build someth…
- [R] [reddit-saas] Is “generate and hope” the biggest problem with AI visual tools? — https://www.reddit.com/r/SaaS/comments/1wus68u/is_generate_and_hope_the_biggest_problem_with_ai/ — I rebuilt my AI visual tool after realizing something: Generating a visual isn’t the hard part. The hard part is getting from your content t…
- [R] [reddit-saas] What’s something about your users that surprised you? — https://www.reddit.com/r/SaaS/comments/1wuo31m/whats_something_about_your_users_that_surprised/ — We’ve had a few assumptions about how people would use MWorld that turned out to be completely wrong. You build something with a certain use…
- [R] [gh-nextjs] v16.4.0-canary.54 — https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.54 — Next.js 16.4 canary 54 includes fixes such as MCP middleware DNS rebinding and next/image DNS pinning, but these ship in the stable 16.3.8 security release covered separately.
- [P] [gh-nextjs] v16.3.8 — https://github.com/vercel/next.js/releases/tag/v16.3.8 — Next.js 16.3.8 fixes one high-severity SSRF in image optimization plus several medium advisories: cache poisoning of SSG/ISR pages in self-hosted apps, Draft Mode leaking through 'use cache', and a metadata image route dynamicParams bypass. Upgrade any Next.js app, especially self-hosted ones or those using next/image or 'use cache'. A 15.5.27 backport also appeared.
- [R] [gh-nextjs] v15.5.27 — https://github.com/vercel/next.js/releases/tag/v15.5.27 — Next.js 15.5.27 backport release on the 15.x line. Same underlying story as 16.3.8, covered in that item.
- [R] [vercel-changelog] Vercel Agent now installs private packages from npm and custom registries — https://vercel.com/changelog/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries — Vercel Agent can now install private npm/custom-registry packages via shared env vars. Narrow feature for Vercel Agent users.
- [P] [vercel-changelog] AI Gateway adds Browserbase Search and Fetch tools — https://vercel.com/changelog/ai-gateway-adds-browserbase-search-and-fetch-tools — AI Gateway now exposes Browserbase Search and Fetch as tools usable across providers with one API key (AI SDK 7.0.116+). Useful for adding web search and retrieval to agents without a separate integration. Check pricing in the docs before adopting.
- [R] [vercel-changelog] Edge Requests are now called CDN Requests — https://vercel.com/changelog/edge-requests-are-now-called-cdn-requests — Vercel renamed Edge Requests to CDN Requests; pricing and limits unchanged. Only billing-API integrations matching on ServiceName need to switch to SkuId.
- [R] [vercel-changelog] Vercel Sandbox now supports Secure Compute — https://vercel.com/changelog/vercel-sandbox-now-supports-secure-compute — Vercel Sandbox supports Secure Compute, Enterprise-only. Not relevant to a solo shop.
- [P] [vercel-changelog] Ling 3.1 Flash is now available on AI Gateway — https://vercel.com/changelog/ling-3-1-flash-is-now-available-on-ai-gateway — Ling 3.1 Flash (InclusionAI, 560B total/25B active, 262K context) is free on AI Gateway through Oct 13, 2026. The standard ID starts billing afterwards while the -free ID stops serving, so don't leave it wired into anything.
- [P] [vercel-changelog] Vercel CDN no longer caches responses with Vary: Cookie — https://vercel.com/changelog/vary-cookie-responses-no-longer-cached — Vercel CDN no longer caches origin responses whose Vary header includes Cookie; they are served normally but marked MISS with cache reason vary_key_denied. If you rely on cached routes that send Vary: Cookie, expect more origin hits and cost. Check Runtime Logs and fix the origin header.