The Brief #26.29 · GPT-5.6 benchmarks, Fable 5 to July 19, TypeScript 7, npm 12

The model race compressed into one week, and the JavaScript toolchain shipped two releases you’ll feel on your next install.

GPT-5.6 lands, and the gap at the top is one point

GPT-5.6 reached general availability on July 9, the Sol, Terra, and Luna family OpenAI had been previewing since late June. Sol is the flagship at $5 input / $30 output per 1M tokens, Terra sits at $2.50 / $15, Luna at $1 / $6, and all three carry a million-token context window (Simon Willison’s rundown has the spec sheet). Last week the news was the rollout date; now it’s public for everyone, and the independent numbers arrived. Artificial Analysis measured Sol one point behind Claude Fable 5 on its Intelligence Index at roughly a third of the cost per task, and Sol took the top Coding Agent Index score, an 80 run through the Codex harness.

The vendor-picked numbers are messier, which is normal. OpenAI leads with Agents’ Last Exam, where Sol’s 53.6 clears Fable 5’s 40.5 by a wide margin, while Fable 5 still takes SWE-Bench Pro at 80 percent to Sol’s 64.6, a result OpenAI answered by publishing an audit arguing that about 30 percent of SWE-bench Pro tasks are broken. Willison’s early verdict after real use is that Sol is very competent and still hasn’t beaten Fable on his hardest coding tasks.

Anthropic, for its part, kept its best model within reach a little longer. Fable 5 inclusion on paid plans was due to end July 12, and Anthropic extended it again through July 19 at 11:59 PM Pacific, still up to half your weekly limits on Pro, Max, Team, and premium Enterprise seats before it moves to usage credits. If you’ve been meaning to point it at real work, you now have until Sunday.

xAI ships under the SpaceXAI name now, and it released Grok 4.5 on July 8. Musk describes it as an Opus-class model, faster and cheaper. The cheaper part checks out at $2 input / $6 output per 1M tokens, and Artificial Analysis scores it 54, two points under Opus 4.8.

The same product family gave the week its security story. A researcher publishing as cereblab caught Grok Build, the coding CLI, uploading entire git repositories to an xAI-run Google Cloud bucket, a finding first reported by International Cyber Digest. A 12 GB test repo produced about 192 KB of traffic the task actually needed and 5.1 GB of upload to the bucket, full git history and an unredacted .env included, and turning off the “Improve the model” setting changed nothing. Uploads stopped after the writeup went public, through a server-side flag, and xAI’s response so far is an X post pointing at enterprise zero-data-retention and a /privacy command, with no formal advisory as of the time of writing. An agent CLI that can read your repo can also ship your repo somewhere, so weigh a vendor’s data path the way you weigh its benchmark scores.

Even with that mess, the week lands well for anyone on the buying side. Three labs answered each other inside seven days with a launch, an extension, and a cheaper flagship, and the pressure shows up directly in the cost column of the table above. Competition at this pace is good for customers.

TypeScript 7.0 is official, and the ecosystem can’t follow yet

TypeScript 7.0 went official on July 8, the ground-up native Go port that was a release candidate three weeks ago. Microsoft’s numbers hold at 8x to 12x on full builds, with the VS Code codebase compiling in 10.6 seconds instead of 125.7. The speed is the easy half of the story, because 7.0 ships without a stable JavaScript API. Microsoft says it plainly, 7.0 “does not ship with an API,” and “We expect TypeScript 7.1 to ship with a new (and different) API.” The npm package fronts the native compiler, its root export resolves to a version shim, and every programmatic entry point it does expose lives under unstable/*.

That locks out anything that imports typescript for the compiler API. typescript-eslint (74M fetches this week) declares peer support for typescript >=4.8.4 <6.1.0, so npm install fails with an ERESOLVE the moment typescript@7 enters the tree, and TS 7 support sits in issue #10940, labeled blocked by external API and locked by the maintainers. The announcement names the Vue, MDX, Astro, and Svelte tooling in the same position, and the rest of the compiler importers, ts-loader, ts-jest, ts-node, typedoc, and ts-morph, wait alongside them. If your bundler strips types without calling the compiler, the esbuild, SWC, and Vite path, this doesn’t touch your build at all.

Microsoft’s bridge is a pair of npm aliases, an API-bearing TypeScript 6 where tools expect typescript, and the native compiler under a second name.

The published devDependencies arrangement:

"devDependencies": {
    "@typescript/native": "npm:typescript@^7.0.2",
    "typescript": "npm:@typescript/typescript6@^6.0.2"
}

Your lint, docs, and test tooling keeps resolving a typescript with a working API, the native compiler installs as @typescript/native for the actual type checking, and your editor picks up the fast checker through the TypeScript 7 extension for VS Code, with VS Code bundling it in the coming weeks. Rehearse this in a branch and count how many of your devDependencies import the compiler before you flip the switch for real.

npm 12 stops running install scripts by default

npm 12 shipped on July 8, and it changes what happens on every npm install you run. Dependency lifecycle scripts, meaning preinstall, install, and postinstall, plus the implicit node-gyp builds, no longer run unless you explicitly allow them. Git dependencies and remote tarball URLs are blocked by default too, with --allow-git and --allow-remote now defaulting to none. Install scripts are where npm supply-chain attacks actually execute, so this closes the default path a malicious package uses to run code on your machine. npm 11.18 already ships the npm install-scripts approval commands, so you can build the allowlist on 11 and land on 12 without breaking CI.

The 12.0.0 release notes carry the rest of the breaking list. Unknown config keys and CLI flags now throw instead of warning, npm shrinkwrap and root npm-shrinkwrap.json support are gone in favor of package-lock.json, npm adduser is removed, and Node support narrows to ^22.22.2 || ^24.15.0 || >=26.0.0. The same changelog also starts a clock for the registry. Granular access tokens with the 2FA bypass lose that bypass for sensitive operations in early August, and from January 2027 they can’t publish directly at all, with publishing moving to trusted publishing or a staged flow a human approves with 2FA. If your CI publishes with a long-lived token, the migration window is open now.