The frontier-model desks spent the week on Kimi K3's weights and the MCP spec lock. Underneath that noise, the tools you actually type into shipped a heavier week than the models did. Six releases landed between July 20 and July 26 — a linter that quadruples its own strictness, an ORM feature that quietly kills the most common performance bug in early-stage apps, and a one-line security fix that agent builders should not sleep on. Every item below is verified against its primary changelog or package registry, dated, and carries the single line that matters for a team of one. This is the counterpart to our last toolchain roundup; the pattern holds — the boring tools are where the leverage is.

1. Ruff 0.16.0 turned its default rule set up from 59 to 413 — pin before you upgrade#

Ruff 0.16.0 shipped July 23 and the headline is a number: the default lint set jumps from 59 rules to 413. That is not a typo and it is not opt-in per rule — upgrade Ruff in an existing repo and your next run surfaces every diagnostic those new rules catch. The release also formats Python code blocks inside Markdown files by default, adds a # ruff: ignore[CODE] line-suppression comment (the analogue of # noqa), and prints fixes in check and format --check output, including GitHub and GitLab CI annotation formats so failures show up inline on the pull request.

What it means: If Ruff runs in CI, upgrading blind will turn a green pipeline red on hundreds of pre-existing issues you never agreed to fix today. Pin your Ruff version in pyproject.toml or your lockfile, then bump it deliberately and work through the migration guide the changelog links. The upside is real — a solo builder gets dramatically stronger out-of-the-box linting for free — but adopt it on your schedule, not your CI runner's.

2. Django 6.1's fetch modes are an N+1 killer you don't have to remember to use#

The Django 6.1 release candidate landed July 22 (final expected in August), and its best feature targets the single most common performance bug in early-stage apps: the N+1 query. Django 6.1 adds per-field fetch modes. FETCH_ONE is today's behavior. FETCH_PEERS is the new default worth adopting: when a deferred or related field is missing on an instance, Django fetches it for every instance in the same QuerySet at once — an automatic, on-demand prefetch_related() that collapses a loop of N queries into two. And RAISE turns an unexpected query into a FieldFetchBlocked exception, so you can lock a hot code path and be told when something triggers a stray database hit.

What it means: Most founders hit N+1 the same way — a template loops over a queryset and touches a related field, and a list view that felt instant on 10 rows melts at 10,000. FETCH_PEERS fixes the majority of those cases without you having to predict them and hand-write select_related/prefetch_related. Test the RC against your slowest list endpoints now, before the August GA. We wrote the copy-paste walkthrough — which mode to set where, and how RAISE becomes a regression test — in Django 6.1 fetch modes: kill the N+1 query problem without prefetch_related.

3. The Vercel AI SDK patched a tool-approval forgery bug — upgrade if you gate tool calls#

This is the one security-class item of the week, and it lives exactly where agent builders least want a hole. In the ai package before 7.0.36 (fix released July 23), the experimental_toolApprovalSecret HMAC payload joined its fields with a newline character. A field value that itself contained a newline could collide with a field boundary — meaning a human's signed approval for one tool call could verify as valid for a different one. That is approval forgery: the human-in-the-loop check that's supposed to stop an agent from wiring money or deleting a table could be satisfied by the wrong call.

7.0.36 replaces the fragile join with injective JSON.stringify serialization behind a versioned prefix; old signatures without newlines still verify, so the upgrade is backwards-compatible. The prior release, 7.0.35 (July 22), separately added a per-step first-content timeout so a stalled streaming generation surfaces before the full request timeout instead of hanging your UI.

What it means: If your agent uses the Vercel AI SDK's human-in-the-loop tool approvals, upgrade ai to at least 7.0.36 today — this is the rare dependency bump that closes a real authorization gap, not just a feature. Human approval is only a safety control if it can't be forged. For the pattern itself — where approvals belong in the loop and how to fail closed — see human-in-the-loop tool approval across LangGraph, Vercel, and OpenAI.

4. uv put a supply-chain malware check in the package manager you already run#

uv 0.11.31 (July 21, part of a 0.11.30 → 0.11.32 run across the week) added audit.malware-check and audit.malware-check-url configuration settings — a dependency malware check built into the installer itself — plus a per-index hash-algorithm setting for lockfile generation and a fix that stops uv from retrying TLS certificate-verification failures. The 0.11.32 release (July 23) added --package/--all-packages selection to uv check and stricter lockfile canonicalization.

What it means: Dependency supply-chain attacks — a typosquatted or hijacked package pulled in transitively — are a genuine risk for small teams with no security function. A malware check you enable in one config line, in the package manager you already use, is close to free insurance. Turn it on.

5. Cloudflare Wrangler made local Workers traceable — and queryable by your agent#

Wrangler 4.114.0 (July 23) gives wrangler dev and the Vite plugin a trace for every local Worker invocation — spans, logs, and console.* output, including calls that cross Worker or Durable Object boundaries — surfaced in a new Observability tab in the Local Explorer. More interesting for the agent-builders reading this: it exposes a read-only SQL endpoint (/cdn-cgi/explorer/api/local/observability/query) over the spans and logs tables. It's off by default while it stabilizes (X_LOCAL_OBSERVABILITY=true).

What it means: Debugging that used to require a deploy now happens locally, and the SQL endpoint is a concrete hook for wiring a coding agent into your debug loop — let it query the spans of a failing local run and reason about them directly. That's a small but real step toward agents that fix their own integration tests.

6. Playwright 1.62 added AbortSignal cancellation and WebP screenshots#

Playwright 1.62 (July 24) moved component testing to a "stories and galleries" model with a new mount fixture, and shipped two things every test suite benefits from: most operations and web-first assertions now accept an AbortSignal signal option to cancel a long-running action, wait, or assertion, and visual snapshots can be stored as WebP (toHaveScreenshot('x.webp'), or lossy screenshot({ quality })).

What it means: For anyone running E2E tests — increasingly including agent-driven browser automation — AbortSignal makes a flaky, open-ended wait controllable instead of a hang, and WebP shrinks the snapshot files that bloat your repo. If you test components, plan the migration to the new model; if you just run browser tests, adopt signal on the waits that flake.

Do this before Friday: upgrade ai to ≥7.0.36 if you gate tool calls, pin Ruff before it floods your CI, enable uv's malware check, and — if performance is biting — test Django 6.1's FETCH_PEERS against your worst endpoint. The models get the headlines; the toolchain is where your week actually gets faster.