Debian 12 exits regular support, Bun moves to Rust, and a 29-year-old Squid bug finally gets a name.

1. Debian 12 “Bookworm” regular security support ends, LTS team takes over — Debian News · Jul 12
   As of July 12, 2026, Debian 12 “Bookworm” exits regular security support and the LTS team takes over, extending coverage through June 30, 2028. Users who can should upgrade to Debian 13 “Trixie”; those stuck on Bookworm get two more years of patches across amd64, i386, arm64, armhf, and – new for LTS – ppc64el. Not every package is covered: run debian-security-support to identify gaps. Separately, Debian 11 “Bullseye” LTS hits end-of-life August 31, 2026, so anyone still on Bullseye needs to move now.
2. Bun is rewriting itself in Rust, moving away from Zig — Freek Van der Herten · Jul 10
   Jarred Sumner explains that Bun is migrating its codebase from Zig to Rust after persistent memory safety problems caused by mixing GC and manual memory management. The rewrite is being done mechanically, driven by the existing test suite, with Claude handling much of the translation work so the team doesn’t have to freeze feature development for a year. The source article is a short pointer to the original post on bun.com, so the full reasoning is there rather than here.
3. GitHub: better Copilot code-review tools made quality worse, then they fixed it — GitHub Engineering · Jul 10
   GitHub’s Copilot code review team swapped its custom code-exploration tools for the shared Unix-style tools (grep, glob, view) already used by Copilot CLI, expecting a clean win on maintenance overhead. Instead, benchmarks showed higher review cost and fewer useful comments caught – not because the tools were worse, but because their instructions implied a broad “explore the repo” workflow rather than a reviewer’s “start from the diff, narrow fast” workflow. Rewriting the tool instructions to match how a reviewer actually investigates a pull request – grep and glob first to narrow, view only when a specific file or line range is identified, batch searches before reads – flipped the regression into roughly 20% lower average review cost while holding quality steady. The same focused instructions applied to Copilot CLI didn’t produce the same gain, which is the useful counterexample: shared tools work across products, but the workflow instructions have to match the job. The broader point, written up by engineer Napalys Klicius, is that tool descriptions for LLM agents are closer to API contracts than implementation details – vague prompting changes what the agent notices, how much context it carries, and when it decides it has enough evidence.
4. Realtek RTL8723BS WiFi driver hardened against malicious access points in Linux 7.2-rc3 — Phoronix · Jul 12
   Alexandru Hossu patched multiple out-of-bounds memory read/write conditions in the RTL8723BS staging driver, triggered by malformed over-the-air frames from a malicious access point – no user interaction beyond connecting to a rogue AP required. The flaws have existed since the driver entered Linux staging in 2017, so roughly eight years of kernels are affected. The fixes land in Linux 7.2-rc3 and will be back-ported to stable branches. The RTL8723BS is an 802.11 b/g/n SDIO chip with Bluetooth 4.0 found in a wide range of embedded and low-cost devices, so the exposure surface is broad even if each individual device seems obscure.
5. Datadog on making agentic token costs visible in production — Datadog Blog · Jul 10
   Datadog’s 2026 State of AI Engineering report found that token usage per request more than doubled for median customers year-over-year and quadrupled for 90th-percentile users across Datadog-monitored services. The article breaks down where agentic token costs actually accumulate – tool schemas loaded on every call regardless of relevance, unbounded session history in multi-turn ReAct-style agents, and redundant retrieval loops that inject duplicate chunks into context. Fixes include trimming tool catalogs to only what the current task needs, using sliding-window or summarization-based history compaction, and deduplicating retrieval chunks across loop iterations – but the article is clear that none of these are verifiable without span-level token instrumentation in place first. The practical guidance is to capture input vs. output token splits at the individual span level, not just aggregate dashboards, since aggregate figures hide the compounding behavior. This is a Datadog product post, so the observability tooling it recommends is their own – but the diagnostic framing around tool schema bloat and session history growth applies regardless of what you use to instrument it.

---

// In other news

Stay patched, stay skeptical – see you Monday.