How-tos
Step by step, from real work.
Guide ·
GitHub Kills Gemini 2.5 Pro and Gemini 3 Flash in Copilot Tomorrow. If You Pinned a Model Months Ago and Forgot, Check Today.
GitHub deprecates Gemini 2.5 Pro and Gemini 3 Flash across every Copilot surface on July 31, 2026. GitHub announced it back on July 2 — the kind of notice a solo operator sets a reminder for and then loses to three weeks of actual work. Here's the five-minute check before it breaks something tomorrow.
Guide ·
GitHub Just Put Every npm Publish Through Malware Scanning. If Your Package Does Anything Security-Adjacent, You Need a Disclosure File Now.
GitHub's July 28 npm changes add automatic publish-time malware scanning and a new dual-use disclosure regime — a contentPolicy field and required DISCLOSURE file for legitimate tools that can look like malware to a scanner. If you maintain a scraper, pentest tool, or automation package, this is the audit to run before your next publish gets held up or rejected.
Guide ·
Free AI Coding Tiers Cover Most of What a Solo Dev Needs Now. Here's the Real 2026 Stack.
GitHub Copilot Free, Windsurf's unlimited autocomplete, and bring-your-own-key agents quietly cut $50-80/month off a solo dev's tooling bill. Google's Gemini Code Assist shutdown twelve days ago is the reminder that free can vanish overnight.
Guide ·
MCP Just Ripped Out Its Own Session Model. The 2026-07-28 Spec Is a Breaking Change Dressed Up as a Point Release
The Agentic AI Foundation shipped the 2026-07-28 MCP spec on July 28, retiring the initialize/initialized handshake every MCP server depends on in favor of a stateless request model with new required headers. If you run an MCP server, this is a migration, not a changelog entry.
Guide ·
Turbopack Is Finally Stable for Production Builds in Next.js 16. Here's the Boring Way to Decide When to Actually Migrate.
Turbopack is now the default and stable for both dev and prod builds. 'Faster builds' is the least interesting reason to touch it. As the entire engineering org, you need an upgrade decision, not a hype post: so here's the checklist.
Guide ·
npm v12 Turned Off Install Scripts. The AsyncAPI Attackers Ran Their Payload at Import Time Instead. Here's the 15-Minute Sunday Audit.
npm v12 shipped this month blocking install scripts by default — the mechanism behind a year of supply-chain worms. On July 14, Microsoft documented the @asyncapi compromise: malicious versions with the loader moved to import time, which install-script blocking does nothing to stop.
Guide ·
Gumroad's '10% and We Handle the Taxes' Costs More Than You Think. Here's the Effective-Rate Math Before You Pick a Checkout.
Gumroad's direct-sale take lands around 12% once you count payment processing, and Discover marketplace sales run 30%. A widely-shared Indie Hackers post claimed a jump from $750 to $3,250 a month. The specific number is unverified; the math underneath it is not. Here's when the Merchant-of-Record tax is a bargain and when it's the most expensive line in your P&L.
Guide ·
Self-Hosting Supabase? Two Silent Default Changes Land This Week. Check Your Config Before It Breaks Your Login Flow.
The week of July 6, the default self-hosted Supabase config for API_EXTERNAL_URL picks up an /auth/v1 prefix, and log_connections flips from on to off. Neither is a headline. Both are exactly the kind of quiet default change that passes local and breaks prod.
Guide ·
A Kernel Bug Named 'Bad Epoll' Hands Any Local User Root — 99% of the Time. If You Run a Linux VPS, This Is Your Sunday.
CVE-2026-46242 is a use-after-free in the Linux kernel's epoll code that lets an unprivileged user climb to root with a proof-of-concept that works about 99% of the time. It hits mainline 6.4 and up, plus Android. The fix landed in April — but plenty of distros haven't shipped the backport.
Guide ·
Cordyceps Found 300+ Exploitable GitHub Repos at Microsoft, Google, and Cloudflare. The Bug Is in Your CI YAML — and Your AI Agent Is Writing More of It.
Novee Security disclosed Cordyceps on June 24 — a class of GitHub Actions misconfigurations where pull requests get more power than they should. A scan of ~30,000 high-impact repos found 300+ fully exploitable. This one isn't a dependency CVE. It's the workflow file you let an agent scaffold and never read. Here's the 15-minute Saturday audit.
Guide ·
Your Self-Hosted Redis Has a Remote-Code-Execution Hole. Here's the 10-Minute Patch Before the Weekend.
CVE-2026-23479 is a use-after-free bug in Redis that can lead to remote code execution. It lived in the code from version 7.2.0 through 8.6.2 — about two years — and an autonomous AI tool is what finally found it. If you run your own Redis, you're probably on a vulnerable build. Here's the fix and the config check that matters more.
Guide ·
A Single npm Account Pushed 14 Typosquatted Packages in Four Hours to Steal Cloud and CI Secrets. Here's the 10-Minute Audit.
On May 28 one maintainer alias dropped 14 packages typosquatting OpenSearch, ElasticSearch, and DevOps libraries, built to lift cloud and CI/CD credentials. Typosquatting hits differently than an upstream compromise — the vulnerability is a typo in your install command. Here's the Saturday checklist.