Sunday curated reading. I maintain three AI-curated directory sites and track open-weight model releases and tooling changes for practical reasons: new models land in my Top AI Tools ETL pipeline, and anything touching the GitHub or Supabase ecosystem affects my OSS alternatives directory directly. Five things from this week worth annotating.
1. Inkling — first open-weight model from Thinking Machines Lab
Announced July 15 under Apache 2.0. Thinking Machines Lab is Mira Murati's company, founded more than a year after she left OpenAI — this is their first public model. Inkling is a 975B-parameter MoE where roughly 41B parameters are active per forward pass. It was trained on 45 trillion tokens across text, image, audio, and video, and reasons natively across all four modalities. Weights are on HuggingFace with a 1M context window; the Tinker API drops that to 256K but provides hosted inference.
The Apache 2.0 license is clean — no "non-commercial only" carve-outs, no "you can't compete with us" provisions I can find. What I don't know yet is whether native audio input actually changes anything useful for content generation workflows like mine, or whether "trained on audio" means something different from "usable for audio-adjacent tasks." I'll add Inkling to my AI tools directory listing queue this week and benchmark it against the ETL prompts I currently run on Haiku before drawing any conclusions about model swap feasibility.
2. GitHub Models retires July 30 — ten days left
GitHub announced in June it was closing the free model playground, with the hard shutdown confirmed for July 30. That covers the playground, model catalog, inference API, and bring-your-own-key (BYOK). Brownouts ran July 16; next one is July 23.
I stopped using GitHub Models months ago when I standardized on Claude Haiku via the Anthropic API. But a lot of solo developers I've seen in HN comments relied on it for low-volume prototyping before committing to a billing relationship with any specific provider. The official migration path is Azure AI Foundry. Because GitHub Models spoke the OpenAI-compatible format, the mechanical part of migration is usually just a base URL and key swap — the heavier cost is that Azure's pricing model doesn't have a free tier in the same sense. The product always had a designed off-ramp built in: experiment here, graduate to Azure when you're ready to scale. That arc completed on schedule.
3. Supabase Multigres is now open source
From the Supabase July 2026 developer update: the Multigres Kubernetes operator is now fully open source. It covers direct pod management, zero-downtime rolling upgrades, pgBackRest PITR backups, and OpenTelemetry tracing. The same update includes a TanStack DB alpha integration that syncs collections with Supabase tables over PostgREST and Realtime, and Wrappers v0.6.2 adding MongoDB join support from Postgres.
I already had a Supabase yt-longform video spec queued up in my pipeline before this roundup — the git commit is timestamped before I drafted this — so that connection isn't retrofitted. The Multigres open-source release matters to the OSS alternatives directory because Supabase is listed as an alternative to several managed-Postgres products, and a production-grade Kubernetes operator being freely available changes the self-hosting calculus. I'll watch whether actual self-hosted Supabase deployments increase in the GitHub ETL signal over the next 30 days.
4. CodeQL now detects system prompt injection in JavaScript and TypeScript
From the GitHub Changelog this week: CodeQL added a JS/TS query targeting untrusted values flowing into AI model system prompts without sanitization. The rule catches the pattern where user-controlled or externally-sourced data reaches a system: parameter in LLM API calls directly.
This is the class of vulnerability I've been informally aware of and formally sloppy about. My ETL passes game descriptions, model metadata, and README snippets from Steam, GitHub, and HuggingFace into Claude Haiku prompts. None of that goes through a sanitization pass — my threat model is that the external APIs don't supply adversarial content, which is true until it isn't. The CodeQL query gives me a concrete way to surface which call sites are the highest-risk. I'll run it on the packages that do prompt construction and treat the output as a prioritized list, not necessarily a mandate to fix everything it flags.
5. GitHub Copilot agentic browser tools are generally available
Now GA by default in VS Code, no flag needed. Copilot agents can navigate web pages, inspect DOM content, capture screenshots, and validate web app behavior from within the editor. Parallel agent sessions and visible per-chat cost are also included.
I don't use Copilot — my agentic workflow runs on Claude Code — so this doesn't change my daily setup. What I'm watching is whether browser-navigating agents in VS Code become standard CI tooling or stay in the "advanced feature" tier. For my kind of deployment (Cloudflare Pages, Vercel, static sites with OG images and JSON-LD I want to verify post-deploy), the ability to check a live page from the same session that deployed it is genuinely useful. If Claude Code ships comparable browser tooling, I'd use it. If Copilot's GA adoption makes this the assumed baseline, that changes what readers expect from articles about verification pipelines.
Part of an ongoing 6-month experiment running three AI-curated directory sites. The technical claims here are real; this article was AI-assisted.
Top comments (0)