Source map · 4 of 18 lit
Ephemeris.
Four picks today. A patch calendar, a research skill, a capability gap, a trace.
Patch day now has a date.
Next.js is leaving ad-hoc security patches behind. From now on the team posts advance notice roughly once a month, naming the expected date and the highest severity in the batch, so you can book the upgrade window instead of discovering it. The first scheduled release lands today: patch releases for 16.2 and 15.5 covering four high and five medium severity issues, with CVE detail published alongside the patch.
The lead time is the point: it lets Vercel coordinate with hosting providers on firewall mitigations before the fix is public, covering apps that will not patch on day one. Andrew Imm and Josh Story name the pressure driving the cadence — LLM-assisted vulnerability research. Mozilla disclosed 271 issues in a single Firefox release, all surfaced by Anthropic's Mythos Preview. Vercel runs the same class of tooling against Next.js through its own deepsec project and a widened bug bounty.
Thirty days, read in one pass.
Give /last30days a topic and it resolves the handles and communities that matter, then searches Reddit, Hacker News, X, YouTube, TikTok, arXiv, GitHub, Techmeme and Polymarket in parallel — and returns one synthesis instead of nine tabs.
Ranked by what people actually engaged with, not by what an editor put first.
The ranking is the design decision. Results are scored on upvotes, views and prediction-market odds, duplicate stories are clustered, and every claim comes back with a citation, so a topic sweep reads as evidence rather than a link dump.
Reddit, Hacker News, GitHub and Polymarket work with no configuration. X, YouTube, arXiv and Techmeme come up through a guided first run. Install it as a Claude Code plugin with /plugin marketplace add mvanhorn/last30days-skill, or pull it into another harness via npx skills add.
Version 3.16.0 shipped on 16 July, the fifteenth release, with over a thousand commits and 52-plus contributors adding sources, language coverage and security hardening. It also works on people: point it at a name and you get their last month of public activity, with the numbers attached.
$12.50 a task. Or 28 cents.
The UK AI Security Institute measured how far open-weight models trail the closed frontier on offensive cyber work: 70 narrow tasks spanning vulnerability research, reverse engineering, web exploitation and cryptography, plus full cyber ranges — including The Last Ones, a 32-step attack on a simulated corporate network.
On the narrow suite GLM-5.2 matched Opus 4.6, released 4.3 months earlier, and DeepSeek V4-Pro landed between Opus 4.5 and GPT-5. Chained into a full operation the picture changes: on the long-horizon ranges the gap is still wider than on single skills, which is where the remaining defensive margin sits. Kimi K3 gets evaluated once its weights are public.
The query that ate the request.
James Crosswell wires MongoDB's own OpenTelemetry instrumentation into Sentry in four moves: switch Sentry to OTLP mode with options.UseOtlp(), build a TracerProvider subscribed to MongoTelemetry.ActivitySourceName, export with AddSentryOtlp(dsn), and your database spans land beside the errors and session replays you already collect — with operation, duration and queries-per-minute attached.
The caveat is line 4. Query text is exactly where customer data leaks into your traces, so the post adds a BaseProcessor<Activity> that strips or hashes those fields client-side, before anything leaves the process. The chain underneath — vendor instrumentation, OTel SDK, OTLP exporter — is the transferable part; swap Mongo and .NET for any instrumented library that emits spans.
That's today.
Two of today's four stories are about attackers getting cheaper, and two are about seeing your own system clearly — a release calendar you can plan around, and a trace that names the slow query. Issue 092, 21 July 2026.