Dependabot delays 72h, Lobsters moves to SQLite, Ronacher flags agent skill loss
Every URL the pipeline pulled into ranking for this issue — primary sources plus the supporting and contradicting findings each Researcher returned. Inline citations in the issue point back here.
Sources
Quoting GitHub Changelog simonwillison.net
Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration. — GitHub Changelog , embracing dependency cooldowns Tags: dependency-cooldowns , packaging , security , github
lobste.rs is now running on SQLite simonwillison.net
lobste.rs is now running on SQLite Community site Lobsters has been planning a migration away from MariaDB since August 2018 - originally targeting PostgreSQL, but last year they decided to investigate SQLite instead. This weekend they completed the migration, and now consider it stable enough that it looks like this is the permanent architecture for the site going forward: SQLite seems to have passed with flying colors: cpu usage is down, memory usage is down, site seems to be snappier at leas…
Quoting Armin Ronacher simonwillison.net
The shared language of a software project is not English or Python but it is the common understanding of what its concepts mean, where the boundaries are, which invariants matter, who owns what, and why the system has the shape it does. This language is rarely written down in one place. It lives partly in documentation and code, but also in code review, conversations, arguments, and the experience of having to explain a change to somebody else. Before agents, some of this shared understanding w…
simonw/pedalican simonwillison.net
Codex Desktop’s Clippy-style animated pets accept user-defined characters, and Simon Willison built one by asking GPT-5.6 to design a pelican on a bicycle. The model ran multiple gpt-image-2 passes to produce sprite sheets and animation loops, using two Apache 2.0 skills from openai/skills and openai/codex.
datasette 1.0a37 simonwillison.net
The 1.0a37 point release tunes performance and expands docs for Datasette’s permissions system. It also rolls back a cosmetic API change from an earlier alpha that had broken nearly every existing plugin’s test suite.
References
Techi — ‘GitHub Dependabot cooldown install-layer gap’ techi.com
Early implementations only apply cooldowns to direct version bumps, leaving a gap where transitive updates could still be merged through routine lockfile regenerations.
GitHub Changelog (July 2025) — opt-in cooldown precedent github.blog
Dependabot supports configuration of a minimum package age… allowing developers to specify different waiting periods based on the semantic versioning (SemVer) level.
Risky Business — ‘RubyGems adds dependency cooldowns’ news.risky.biz
RubyGems adds dependency cooldowns to counter supply-chain attacks — part of a broader ecosystem shift where npm, pnpm, Bun, pip 26.1’s —uploaded-prior-to and uv have all added native cooldown flags.
Vicarius — ‘Software supply chain attacks have gone viral’ vicarius.io
The Shai-Hulud worm targeted developer environments by harvesting GitHub tokens and automatically publishing malicious versions of existing packages, compromising hundreds including TanStack and Nx Console.
ActiveState — ‘Beyond dependency cooldowns’ activestate.com
Time is merely a proxy for trust and cannot replace deeper security analysis; a patient attacker could theoretically wait out a cooldown period before activating a payload.
Reddit r/github discussion thread reddit.com
If the entire ecosystem adopts a cooldown, it might actually postpone the discovery of malicious code because fewer early adopters are tripping over the infection — the safety of the herd depends on a minority who opt out to act as canaries.
André Arko — ‘Rails on SQLite: exciting new ways to cause outages’ andre.arko.net
A single node’s failure or a disk filling up can knock your site offline or even destroy your entire production database.
37signals Dev — ‘Behind the Fizzy Infrastructure’ dev.37signals.com
The development team initially planned to use a database-per-customer SQLite model for Fizzy, but eventually reverted to MySQL for the SaaS version due to complexities with global write replication and emergent behavior in distributed SQLite setups.
daily.dev — Lobsters migration writeup (Feb 2026 attempt) daily.dev
Monitoring showed CPU usage on the primary VPS spiking to 100%… the initial SQLite file migrated to the server lacked critical search indexes and full-text search tables such as comments_fts, forcing full table scans.
GitHub lobsters/lobsters issue #539 (Dziedzic implementation notes) github.com
Specific functions implemented as UDFs included regexp, if, and stddev… SQLite’s native NOCASE collation is limited to ASCII characters only, whereas MariaDB’s utf8mb4_general_ci provides sophisticated case-insensitivity across the full Unicode spectrum.
codecurious.dev — Optimizing SQLite for Rails 8 Production codecurious.dev
Rails 8 is preconfigured to use separate SQLite files for each service—typically production.sqlite3, production_cache.sqlite3, and production_queue.sqlite3… isolation prevents cache churn or high-volume background job writes from exhausting the connection pool.
Hacker News discussion news.ycombinator.com
Migrating away from SQLite in the future could be painful because the SQL standards differ enough to require a full rewrite of complex queries.
VirtusLab — ‘Cognitive Debt: The Code Nobody Understands’ virtuslab.com
one study noted a 47% drop in debugging skills among heavy AI users, as the ‘friction-based learning’ of manual coding is lost
r/ExperiencedDevs — ‘Armin Ronacher is very uneasy about the agent…’ reddit.com
current AI models are ‘mortally terrified of exceptions’ and tend to add layers of fallbacks rather than enforcing strong invariants
AI-TLDR digest of ‘The Tower Keeps Rising’ ai-tldr.dev
agents often produce ‘slop’—code that is overly defensive, complex, and locally reasoned, lacking a coherent global architecture
Ronacher, AI Engineer talk (mitsuhiko.github.io) mitsuhiko.github.io
agent-legible architectures that use modularization and strict mechanical enforcement, such as linting rules that prohibit ‘hidden magic’ like dynamic imports
Medium — ‘Agentic Coding Needs More Than Specs, It Needs Shared Memory’ medium.com
agents require high-level ‘steering documents’… This requirement effectively incentivizes teams to move away from unread Confluence pages toward ‘working memory’ docs that stay current with the codebase
r/PieAi — ‘The Loop Problem: Why Armin Ronacher…’ reddit.com
developers must stay ‘in the loop’ for any code they deeply care about to preserve engineering judgment
