Dependabot delays 72h, Lobsters moves to SQLite, Ronacher flags agent skill loss

TL;DR

• Dependabot now holds update PRs for 72 hours to blunt npm supply-chain worms like Shai-Hulud.
• Lobsters cut VPS cost 50% by moving Rails from MariaDB to a 3.8GB SQLite file.
• Ronacher argues coding agents strip the friction that once synchronized team mental models.
• Each ship pairs its win with a named regression: shrunk canary pool, ASCII-only NOCASE, 47% debugging-skill drop.

Today’s AI-tech leads look unrelated on the surface — a GitHub default, a Rails-to-SQLite migration, and an Armin Ronacher essay on coding agents — but they share one editorial thread: each pairs a headline win with a named regression, and none of the authors hide it. Dependabot’s 72-hour cooldown blunts npm supply-chain worms like Shai-Hulud but shrinks the canary pool that would surface the next one. Lobsters halves its VPS bill on SQLite while permanently losing full-Unicode NOCASE and its regexp/if/stddev UDFs. Ronacher argues coding agents strip the friction that once synced team mental models, citing a 47% drop in debugging skill among heavy AI users as evidence rather than nostalgia. The pattern worth watching this week is how much regression a team is willing to accept — and whether it stays named after the change lands.

GitHub makes Dependabot wait 3 days before update PRs

Source: simon-willison · published 2026-07-14

TL;DR

• Dependabot now waits 72 hours after a package release before opening an update PR, with no config required.
• The default follows the Shai-Hulud npm worm, which republished trojaned TanStack and Nx Console packages within minutes of maintainer compromise.
• Security-advisory patches are exempt — CVE fixes still ship immediately, so the cooldown only gates routine version churn.
• Critics flag two gaps: transitive updates bypass the cooldown, and if everyone waits, the “canary” pool that surfaces malware shrinks.

From opt-in knob to zero-config default

GitHub shipped cooldown as an opt-in dependabot.yml block in July 2025, with per-SemVer knobs like semver-patch-days and semver-major-days running up to 90 days ¹. A year later, three days is simply the default. That’s the actual news: not a new capability, but a bet that the safe path should also be the path taken by every repo whose owner never touches Dependabot’s config.

It also isn’t a GitHub-only move. RubyGems, pnpm, Bun, uv, and pip 26.1’s --uploaded-prior-to all landed native cooldown flags in the same window ². Registries and package managers are converging on “delay-by-default” as a shared norm, and Dependabot flipping its default is the most visible instance of that convergence.

What forced it

The proximate driver was Shai-Hulud, a family of self-propagating npm worms that harvested GitHub tokens from developer environments and auto-published malicious versions of existing packages — TanStack and Nx Console among hundreds compromised ³. That attack shape is exactly what a 72-hour buffer targets: high-visibility, community-detected within hours, yanked from the registry before most CI pipelines wake up. GitHub’s own telemetry pegs ~85% of malicious injections as resolved inside 48 hours; 72 hours covers the long tail without pushing legitimate updates into next week.

The exemption matters as much as the default. Dependabot Security Updates — the ones triggered by a GitHub Advisory — skip the cooldown entirely. So the change slows down routine version bumps while keeping the fast path open for actual CVE remediation. That’s the right split, but it also means the policy protects against unknown-unknowns (poisoned releases nobody has flagged yet) rather than the known-vuln workflow that most enterprises already have tooling for.

Where it doesn’t hold

Two critiques keep surfacing. The first is the install-layer gap: Dependabot’s cooldown only gates direct version bumps in PRs. Transitive dependencies can still slide in through routine lockfile regeneration or an npm install that runs outside the bot’s path ⁴. In an ecosystem where npm averages 4:1 transitive amplification and Maven runs closer to 24:1, that’s not a rounding error.

The second is the canary paradox aired on r/github and echoed by ActiveState:

If the entire ecosystem adopts a cooldown, it might actually postpone the discovery of malicious code because fewer early adopters are tripping over the infection — the safety of the herd depends on a minority who opt out to act as canaries. ⁵

ActiveState pushes the point further: time is a proxy for trust, and a patient attacker can add a sleep(96h) to any payload ⁶. Cooldowns raise the cost of noisy, opportunistic attacks; they do nothing about a sophisticated actor willing to wait out any fixed window.

Takeaway

Treat this as a defense-in-depth increment, not a supply-chain fix. The 72-hour default meaningfully cuts exposure to fast-detected worm-class attacks like Shai-Hulud ³, and it does so without touching the security-advisory fast path. It doesn’t close the transitive path ⁴, doesn’t resolve the free-rider dynamic ⁵, and doesn’t replace artifact analysis. The correct response is to keep the default on, keep reviewing lockfile diffs, and stop pretending “latest” was ever a security posture.

---

Lobsters cuts VPS cost 50% by moving Rails to SQLite

Source: simon-willison · published 2026-07-14

TL;DR

• Lobsters finished its MariaDB→SQLite cutover on one VPS, halving hosting cost and dropping CPU and memory use.
• The primary DB is 3.8GB, split across four files: content, cache, queue, and Rack::Attack.
• February’s first attempt was rolled back when missing FTS indexes pinned CPU at 100% under read-only traffic.
• Permanent regressions: UDFs for regexp/if/stddev and an ASCII-only NOCASE collation replacing MariaDB’s full-Unicode case folding.

The four-file split is now a Rails idiom

The headline number is real: cutting the MariaDB VPS halved hosting cost, CPU and memory dropped, and the Rails app now runs from a single box with a 3.8GB content database, a 1.1GB cache, a 218MB queue, and a 555MB Rack::Attack store. What’s worth noticing is that the four-file split isn’t a Lobsters invention. Rails 8’s Solid stack ships preconfigured with separate production.sqlite3, production_cache.sqlite3, and production_queue.sqlite3 files precisely to keep high-frequency cache and job writes from stealing the primary DB’s write lock ⁷. Lobsters retrofitted the same segmentation onto a pre-Rails-8 codebase and added a fourth file for rate-limiting. The interesting datapoint is that the pattern generalizes cleanly beyond 37signals’ own apps.

flowchart LR
    A[Rails app] --> B[(content 3.8GB)]
    A --> C[(cache 1.1GB)]
    A --> D[(queue 218MB)]
    A --> E[(rack_attack 555MB)]

February’s silent failure

Simon Willison’s writeup reads as a clean win, but the July cutover was attempt #2. A February 2026 try was rolled back within minutes when CPU pinned at 100% even under read-only traffic — the migrated file was missing search indexes and the comments_fts full-text tables, so queries that had been index lookups on MariaDB became full table scans ⁸. There was also a roughly 30-second deployment window where MariaDB-shaped SQL hit the SQLite backend and threw syntax errors ⁸. The July success rested on a stricter checklist: pre-built FTS tables, slow-query-log inspection, and a custom MariaDB→SQLite migrator. “Single-VPS SQLite” is not free of ops discipline; the failure mode is silent index loss during dump/load.

What got worse

Thomas Dziedzic had to register Ruby UDFs for regexp, if, and stddev via the sqlite3 gem, and move comment-confidence ranking out of SQL into Ruby ⁹. The more permanent regression is Unicode. MariaDB’s utf8mb4_general_ci case-folds across the full Unicode BMP; SQLite’s built-in NOCASE collation is ASCII-only ⁹. For a mostly-English tech forum that’s tolerable, but it’s a strict downgrade in username matching and search behavior that the celebratory framing skips.

The dissenting cases

André Arko’s widely-cited “exciting new ways to cause outages” essay argues the Solid-stack turn confuses “we don’t need separation” with “we don’t want it” — a full disk or bad container mount on a single node can “destroy your entire production database” ¹⁰. Hacker News commenters flagged a related lock-in: unlike Postgres↔MySQL, escaping SQLite later means rewriting queries because dialect drift is large ¹¹.

The sharpest counterexample comes from the movement’s loudest evangelists. 37signals reverted Fizzy’s SaaS tier from per-tenant SQLite back to MySQL after hitting “emergent behavior” in distributed write replication ¹². Their own case boundary is one company per install — which is exactly Lobsters’ shape. Read that way, Lobsters isn’t a proof that SQLite scales; it’s a clean datapoint that read-heavy, single-tenant, single-server workloads are where the pattern actually pays.

---

Ronacher: coding agents erase the friction that syncs teams

Source: simon-willison · published 2026-07-14

TL;DR

• Armin Ronacher argues coding agents strip the human friction that once synchronized mental models across a codebase.
• Heavy AI users show a 47% drop in debugging skill, evidence that “friction-based learning” is real, not nostalgia.
• Ronacher’s fix, in a companion talk: agent-legible architectures with linters banning dynamic imports and hidden magic.
• Dissenters flip the arrow — agents force teams to write living docs, replacing Confluence pages nobody read.

The diagnosis

Ronacher’s essay “The Tower Keeps Rising” argues that the real substrate of a software project isn’t Python or English — it’s the shared understanding of what concepts mean, where boundaries sit, and which invariants must hold. Before agents, much of that language was maintained by friction: to change your storage layer I had to read your code, ask you questions, coordinate with the team downstream. Slow, yes. Wasteful, partly. But some of that slowness was the mechanism by which your model of the system became mine.

Agents delete the friction and take the synchronization with it.

External evidence lines up. VirtusLab cites a 47% drop in debugging skill among heavy AI users, framing manual coding as “friction-based learning” whose removal leaves a durable gap between repo and mental model ¹³. Practitioners on r/ExperiencedDevs describe the architectural symptom concretely: current agents are “mortally terrified of exceptions” and stack defensive fallbacks rather than enforcing invariants ¹⁴. Another reading of the essay names the output “slop” — code that is locally reasonable but globally incoherent ¹⁵.

What Ronacher actually prescribes

Simon Willison excerpted only the diagnostic passage, which reads as elegiac. Ronacher’s own AI Engineer talk is more constructive: build agent-legible codebases where the invariants that used to live in conversation are enforced mechanically — linters that ban dynamic imports and other “hidden magic,” strict modular boundaries, no clever runtime meta-programming ¹⁶. The r/PieAi thread sharpens this into an operational rule: automate loops freely for disposable work, but stay in the loop for any code you deeply care about ¹⁷.

That reframes the position as less anti-agent than pro-explicit-architecture.

The counter-case

Not everyone accepts the diagnosis. A widely-shared Medium piece flips the causal arrow: because agents can’t hold context across sessions, they force teams to maintain living “steering documents” and shared-memory artifacts that track the codebase ¹⁸. On this view, the pre-agent “shared language” Ronacher mourns was partly mythical — tacit, unevenly distributed, and lost every time someone quit. Codifying it for agents is a net gain in legibility.

A parallel dissent runs through the r/ExperiencedDevs thread: the modern tower is already too tall for any single human, so a tireless translator isn’t a threat — it’s a necessity ¹⁴.

Three remedies, one diagnosis

The debate converges on the diagnosis (agents outpace human absorption) and splits on the fix:

The takeaway isn’t that agents are bad. It’s that the coordination work friction used to do for free now has to be paid for explicitly. If your team hasn’t chosen a payment plan, it’s accumulating cognitive debt whether or not anyone has named it yet.

Round-ups

Codex Desktop pets get a custom pelican via gpt-image-2

Source: simon-willison

Codex Desktop’s Clippy-style animated pets accept user-defined characters, and Simon Willison built one by asking GPT-5.6 to design a pelican on a bicycle. The model ran multiple gpt-image-2 passes to produce sprite sheets and animation loops, using two Apache 2.0 skills from openai/skills and openai/codex.

Datasette 1.0a37 ships permissions speedups and API revert

Source: simon-willison

The 1.0a37 point release tunes performance and expands docs for Datasette’s permissions system. It also rolls back a cosmetic API change from an earlier alpha that had broken nearly every existing plugin’s test suite.

Footnotes

1. GitHub Changelog (July 2025) — opt-in cooldown precedent — https://github.blog/changelog/2025-07-01-dependabot-supports-configuration-of-a-minimum-package-age/

   Dependabot supports configuration of a minimum package age… allowing developers to specify different waiting periods based on the semantic versioning (SemVer) level.

   ↩

2. Risky Business — ‘RubyGems adds dependency cooldowns’ — https://news.risky.biz/risky-bulletin-rubygems-adds-dependency-cooldowns-to-counter-supply-chain-attacks/

   RubyGems adds dependency cooldowns to counter supply-chain attacks — part of a broader ecosystem shift where npm, pnpm, Bun, pip 26.1’s —uploaded-prior-to and uv have all added native cooldown flags.

   ↩

3. Vicarius — ‘Software supply chain attacks have gone viral’ — https://www.vicarius.io/articles/software-supply-chain-attacks-have-gone-viral-preparing-for-the-era-of-self-propagating-worms

   The Shai-Hulud worm targeted developer environments by harvesting GitHub tokens and automatically publishing malicious versions of existing packages, compromising hundreds including TanStack and Nx Console.

   ↩ ↩²

4. Techi — ‘GitHub Dependabot cooldown install-layer gap’ — https://www.techi.com/github-dependabot-cooldown-install-layer-gap/

   Early implementations only apply cooldowns to direct version bumps, leaving a gap where transitive updates could still be merged through routine lockfile regenerations.

   ↩ ↩²

5. Reddit r/github discussion thread — https://www.reddit.com/r/github/comments/1uwug92/dependabot_version_updates_introduce_default/

   If the entire ecosystem adopts a cooldown, it might actually postpone the discovery of malicious code because fewer early adopters are tripping over the infection — the safety of the herd depends on a minority who opt out to act as canaries.

   ↩ ↩²

6. ActiveState — ‘Beyond dependency cooldowns’ — https://www.activestate.com/blog/beyond-dependency-cooldowns

   Time is merely a proxy for trust and cannot replace deeper security analysis; a patient attacker could theoretically wait out a cooldown period before activating a payload.

   ↩

7. codecurious.dev — Optimizing SQLite for Rails 8 Production — https://codecurious.dev/articles/optimizing-sqlite-for-rails-8-production-a-complete-guide

   Rails 8 is preconfigured to use separate SQLite files for each service—typically production.sqlite3, production_cache.sqlite3, and production_queue.sqlite3… isolation prevents cache churn or high-volume background job writes from exhausting the connection pool.

   ↩

8. daily.dev — Lobsters migration writeup (Feb 2026 attempt) — https://daily.dev/posts/lobste-rs-migrates-from-mariadb-to-sqlite-rlqerses0

   Monitoring showed CPU usage on the primary VPS spiking to 100%… the initial SQLite file migrated to the server lacked critical search indexes and full-text search tables such as comments_fts, forcing full table scans.

   ↩ ↩²

9. GitHub lobsters/lobsters issue #539 (Dziedzic implementation notes) — https://github.com/lobsters/lobsters/issues/539

   Specific functions implemented as UDFs included regexp, if, and stddev… SQLite’s native NOCASE collation is limited to ASCII characters only, whereas MariaDB’s utf8mb4_general_ci provides sophisticated case-insensitivity across the full Unicode spectrum.

   ↩ ↩²

10. André Arko — ‘Rails on SQLite: exciting new ways to cause outages’ — https://andre.arko.net/2025/09/11/rails-on-sqlite-exciting-new-ways-to-cause-outages/

    A single node’s failure or a disk filling up can knock your site offline or even destroy your entire production database.

    ↩

11. Hacker News discussion — https://news.ycombinator.com/item?id=42828883

    Migrating away from SQLite in the future could be painful because the SQL standards differ enough to require a full rewrite of complex queries.

    ↩

12. 37signals Dev — ‘Behind the Fizzy Infrastructure’ — https://dev.37signals.com/fizzy-infrastructure/

    The development team initially planned to use a database-per-customer SQLite model for Fizzy, but eventually reverted to MySQL for the SaaS version due to complexities with global write replication and emergent behavior in distributed SQLite setups.

    ↩

13. VirtusLab — ‘Cognitive Debt: The Code Nobody Understands’ — https://virtuslab.com/blog/ai/cognitive-debt-the-code-nobody-understands

    one study noted a 47% drop in debugging skills among heavy AI users, as the ‘friction-based learning’ of manual coding is lost

    ↩

14. r/ExperiencedDevs — ‘Armin Ronacher is very uneasy about the agent…’ — https://www.reddit.com/r/ExperiencedDevs/comments/1ukttup/armin_ronacher_is_very_uneasy_about_the_agent/

    current AI models are ‘mortally terrified of exceptions’ and tend to add layers of fallbacks rather than enforcing strong invariants

    ↩ ↩²

15. AI-TLDR digest of ‘The Tower Keeps Rising’ — https://ai-tldr.dev/releases/lucumr-tower-keeps-rising-jul13/

    agents often produce ‘slop’—code that is overly defensive, complex, and locally reasoned, lacking a coherent global architecture

    ↩

16. Ronacher, AI Engineer talk (mitsuhiko.github.io) — https://mitsuhiko.github.io/talks/ai-engineer-talk/

    agent-legible architectures that use modularization and strict mechanical enforcement, such as linting rules that prohibit ‘hidden magic’ like dynamic imports

    ↩ ↩²

17. r/PieAi — ‘The Loop Problem: Why Armin Ronacher…’ — https://www.reddit.com/r/PieAi/comments/1udglvp/daily_thought_the_loop_problem_why_armin_ronacher/

    developers must stay ‘in the loop’ for any code they deeply care about to preserve engineering judgment

    ↩ ↩²

18. Medium — ‘Agentic Coding Needs More Than Specs, It Needs Shared Memory’ — https://medium.com/@almirx101/agentic-coding-needs-more-than-specs-it-needs-shared-memory-d2b09ff46cb7

    agents require high-level ‘steering documents’… This requirement effectively incentivizes teams to move away from unread Confluence pages toward ‘working memory’ docs that stay current with the codebase

    ↩ ↩²