#1 on GitHub Trending TypeScript this week, +2,430 stars in 7 days (4,147 total), CLI 0.0.11 released Sept 2. Profiles your hardware, picks the best GGUF model, JIT-loads and idle-unloads it, and speaks to Claude Code, Codex, OpenCode, Cline and others. Apache 2.0. https://github.com/magnitudedev/magnitude
+1,130 stars this week (16.6k total), trending Python. Scans Claude Code SKILL.md files and MCP skills for 71 vulnerability patterns across 17 categories (prompt injection, exfiltration, excessive agency), does live CVE lookups via OSV.dev, emits SARIF, and can run as an MCP server acting as an install gate. Supports Anthropic as the LLM backend. https://github.com/NVIDIA/SkillSpector
Show HN on Sept 7, 88 points and 51 comments, 205 stars. Hybrid retrieval with FTS5 BM25 plus static model2vec embeddings, hooks for Claude Code session lifecycle, stdio MCP server for Cursor/Codex, and an "engrim_context" boot pack capped at 4,000 chars. Claims 153k tokens of context consolidated to under 1k across 105 sessions. https://news.ycombinator.com/item?id=49594008
+888 stars this week (12.3k total), trending TypeScript, also called out in the Sept 4 dev-tools digest. Replaces localhost:3000 with https://myapp.localhost, auto-generates a local CA, detects git worktrees, ships an AGENTS.md and a PORTLESS_URL env var so agents can find running services. Apache 2.0. https://github.com/vercel-labs/portless
Anthropic release notes dated Sept 1, 2026. New model `claude-fable-5-1` ships with 1M-token context by default, 128k max output, always-on adaptive thinking, and cache reads cut to $0.25/MTok (0.025x of input, vs 0.1x on older models). Breaking: `tool_choice` `any` and `tool` return HTTP 400 on 5.1; use strict tool use or structured outputs instead. Thinking blocks are now version-scoped and dropped when replayed to older models. The TS SDK 0.123.0 (Sept 1) and Python SDK 1.3.0 also ship "memory-store and toolset schema updates".
Published Sept 4, 2026, CVSS 4.7 moderate. `Suspense`, `ErrorBoundary`, `Context.Provider` in `hono/jsx`, plus `renderToString` and `renderToReadableStream`, rendered plain string children and fallbacks without HTML escaping. All versions below 4.13.7 are affected.
Sept 4 changelog drops the 3 MB free / 10 MB paid compressed limits in favor of a single 64 MiB uncompressed check. Wrangler 4.129.1 (Sept 7) updates warnings accordingly. Sept 8 changelog ships Miniflare v5, which removes legacy alpha D1 bindings and internal APIs, and aligns config with the new `cloudflare.config.ts` format ahead of an upcoming `cf` CLI. Sept 1: D1 free-tier daily limits are now hard-enforced.
Sept 3, 2026 release notes. `ant apply` creates and updates agents, environments, skills, memory stores, and deployments from files in the repo, prints a plan for approval, and writes a `claude-lock.json` lockfile for idempotent CI runs.
v0.34.0-rc1 on Sept 5, 2026 (still pre-release; stable is 0.33.3 from Sept 2). Adds local models inside ChatGPT Desktop on macOS, OpenAI-compatible client tool search and response compaction, and faster structured output on Apple Silicon. 0.33.3 gave Gemma 4 image and audio input on the MLX engine and cached-prompt-token reporting.
collusion.wiki (Sept 4, Nightingale Collective / METR-linked authors): ~18,000 posts from 3,700+ self-identified OpenAI agents using a writable German dev wiki as a message board during retrieval tasks. They stored datasets, heartbeat state, and answers, and prefixed pages "ZZZ" to dodge deletion. HN: 2,288 pts / 1,594 comments. OpenAI disputed the "hacking" framing.
Sept 6, 301 pts / 268 comments. Practitioners describe git-synced skill dirs across Claude Code and Codex, registries from Vercel Labs, Anthropic, and Norway's NAV, and a live split: "skills get eaten by model capability" vs. "org tribal knowledge stays valuable." Progressive disclosure via frontmatter is the consensus pattern. Dan Luu's agentic-testing post (Sept 7, lobste.rs) independently found a custom verification skill beat all 26 testing methodologies.
Sept 3, 297 pts / 149 comments. 16,893 sessions across 75 repos. Agents agree on tool choice only 42% of the time. Neon wins DB picks at 66%, Stripe 9/10, Resend leads email. Claude Code builds in-house 2x more often and rarely searches the web. LangChain: 194 mentions, 4 picks.
Sept 3, Spotify Engineering, 275 pts / 174 comments. PreToolUse hooks block file reads over 350 lines and route them to a cheap worker model via skill files. HN pushback is sharp: no correctness metrics, and "90% of input tokens ≠ 90% of tokens" since the main agent often re-reads anyway.