How-tos
Step by step, from real work.
Guide ·
npm Finally Turned Off Install Scripts. Two Other Defaults in the Same Release Will Break Your Build First.
Everyone read the headline about allowScripts defaulting to off. The two defaults underneath it, allow-git and allow-remote both going to none, are the ones that fail your CI on a Tuesday morning.
Guide ·
Go 1.27 Shipped Yesterday. One Change Deletes a Dependency, Another Swaps Your JSON Engine Without Asking.
Go 1.27 landed on August 19 with a UUID package in the standard library and a rewritten JSON implementation that now backs encoding/json by default. One of those is free cleanup. The other changes behavior in a package your app almost certainly imports.
Guide ·
Google's Content API for Shopping Started Returning 410 Gone Yesterday. Most Coverage Forgot to Say Who Was Actually Affected.
The sunset date was August 18 and v2.1 endpoints now return HTTP 410. Manual uploads, scheduled fetches, and Google Sheets feeds keep working. Ten minutes tells you which side of that line you are on.
Guide ·
Google Play's August 31 Deadline Does Not Delete Your App. It Makes It Invisible to Every New User on a Modern Phone.
Thirteen days out, and most of the coverage gets the consequence wrong. Nothing is removed and your install base is fine. What dies is discovery, and there are two different API levels you need to hit for two different reasons.
Guide ·
Cloudflare Shipped One-Click Auth for Workers on August 14. If You Have Ever Shipped an Internal Tool to a workers.dev URL, Read the Part About Previews.
The leak is almost never the production route. It is the preview URL you generated once and forgot. Access for Workers attaches the policy to the Worker itself, so previews are covered by default.
Guide ·
A CVSS 9.8 macOS Bug Is Being Used Right Now to Root Internet-Exposed Macs and Mine Monero. Rotating Your VNC Password Does Nothing.
CVE-2026-65400 defeats the authentication path itself, so every hardening step you would reach for first sits downstream of the flaw. Patch or turn Screen Sharing off. There is no third option.
Tutorial ·
Next.js 16.3 Makes Navigation Feel Instant, for the Price of Two Flags
Next.js 16.3 shipped Instant Navigations: a partial prefetching system that swaps per-link prefetch spam for one reusable shell per route, plus dev tooling that turns a slow navigation into a build-time error instead of a support ticket. I flipped the flags on a side project to see what it actually costs.
Guide ·
Chrome Deletes the Last Manifest V2 Listings From the Web Store on August 31. Here's the 30-Minute Check If Your Side Income Is a Browser Extension.
August 31 is when Google removes every dormant Manifest V2 extension from the Chrome Web Store. The runtime deadline already passed a year ago — this one is about whether your listing still exists to be found.
Tutorial ·
TypeScript 7 Went GA on July 8. Three Weeks In, Here's What the Go Rewrite Actually Costs a Solo Codebase
TypeScript 7.0 shipped GA on July 8 with real 8-12x build speedups, and it's now the default tsc on your next npm install. Three weeks of migration reports later, the upgrade is not the drop-in swap I told you it'd be in April.
Guide ·
Astro 7.1 Shipped Four Things This Month. I Run This Blog On It, So I Actually Checked Which Ones Are Worth an Afternoon.
Astro 7.1 landed finer-grained CSP directives, a dev-server lockfile bypass, lower-memory content collections, and custom pagination URLs. This blog runs on Astro — here's which of those four is worth touching this week and which ones are noise for a single-site setup.
Guide ·
npm v12 Shipped July 8 and Turned Off Install Scripts by Default. Three Weeks Later, Here's Why Your CI Broke — and the Two Commands That Fix It
npm v12 landed July 8 and quietly stopped running postinstall scripts, Git dependencies, and remote tarballs by default — the biggest security change in npm's 16-year history, built after North Korean state hackers used postinstall hooks to backdoor Axios and Mastra AI. If a build started failing this month for no obvious reason, this is almost certainly why.
Guide ·
Node.js Just Patched 11 CVEs Across All Three Active Release Lines, Two Days Late. Here's the 15-Minute Patch You Actually Need to Run.
The July 29 Node.js security release fixes 11 CVEs including two High-severity HTTP/2 bugs and three separate Permission Model bypasses. If you sandbox AI agents with --permission, this is the week you patch, not the sprint you schedule it for.