How-tos
Step by step, from real work.
Guide ·
Astro 6.3, Next.js 16, and SvelteKit 2.57 All Made the Request Pipeline Explicit. Here's What to Upgrade and What to Ignore.
Three major frameworks shipped within weeks of each other and all pushed routing to the front: more explicit, more controllable request handling. Next.js even renamed middleware to proxy. Here's the upgrade decision for a solo builder — including the one change I'm watching because this blog runs on Astro.
Guide ·
Claude Opus 4.8 Shipped a "Fast Mode" That Costs More Per Token. Here's the Build Decision It Forces.
Anthropic's new flagship gives you up to 2.5x output tokens per second — for a premium. Plus effort control and mid-conversation system messages. The interesting part isn't the benchmark; it's that latency-vs-cost is now an explicit per-request lever you set, and most builders are leaving it on the wrong default.
Guide ·
Someone Open-Sourced a Self-Propagating npm Worm and Started a $1,000 Contest to Weaponize It. The Mini Shai-Hulud Campaign Is Already at 170+ Packages.
On May 12 someone published the source for a credential-stealing worm on GitHub under an MIT license, then offered $1,000 on a breach forum for the biggest supply-chain attack built with it. The campaign has since hit 170+ packages with 518M cumulative weekly downloads. Here's the 30-minute defense for a solo operator.
Guide ·
Microsoft Just Open-Sourced Agent Red Teaming in a CI Pipeline. RAMPART Is the Missing Safety Test for Solo Operators Shipping AI Agents.
Microsoft released RAMPART on May 20 — a pytest-based framework that brings adversarial red teaming into your CI pipeline as repeatable pass/fail tests. If you're shipping AI agents with no systematic safety testing, this is the tool to add this week.
Guide ·
NVIDIA Released Nemotron 3 Super — 120B Parameters, 12B Active, Commercially Open. Here's When the Self-Host Math Finally Works for a Solo Builder.
NVIDIA's Nemotron 3 Super is a 120B total / 12B active hybrid Mamba-Transformer MoE model with open weights, training data, and recipes under NVIDIA's permissive Open Model License. For solo operators running LLM pipelines and paying frontier API prices for tasks that don't need frontier reasoning, this is worth a benchmark run.
Guide ·
Hackers Just Poisoned 233 Versions of Laravel-Lang Across 700 GitHub Repos. If You Run a Composer-Based SaaS, Here's the 30-Minute Audit.
A May 22 supply chain attack on Laravel-Lang packages injected a 5,900-line cross-platform credential stealer into 233 package versions using a tag-rewrite technique that most lockfile strategies won't catch. Here's what happened and what to do if you run a Composer-based SaaS.
Guide ·
Veo 3.1 Lite Just Dropped Video Generation to $0.05 a Second. Here Are Three SaaS Products You Could Ship This Month That Weren't Viable Last Year.
At Google I/O 2026, Google restructured Veo pricing into Lite/Fast/Standard tiers. Veo 3.1 Lite starts at $0.05/second. A 60-second product demo video costs $3. A 3-minute explainer costs $9. This isn't enterprise pricing with a sales call attached: it's in the Gemini API, callable by any developer with an API key.
Guide ·
Notion Launched Workers, an External Agent API, and Database Sync on May 13. Here's What Solo Builders Can Actually Build With It.
Notion 3.5 shipped a developer platform with hosted Workers, an External Agent API that works with Claude Code and Cursor, and database sync from Salesforce/Postgres/Zendesk. For solo operators who serve clients already living in Notion, the distribution advantage is real.
Guide ·
A Self-Propagating npm Worm Is Harvesting Developer API Keys Through postinstall Hooks. Here's the 15-Minute Audit Your CI/CD Pipeline Needs Today.
Three coordinated supply chain attacks hit npm, PyPI, and Docker Hub in a 48-hour window, stealing GitHub tokens, AWS credentials, SSH keys, and .env files via postinstall hooks and compromised official images. Solo operators running automated pipelines are the exact target profile.
Guide ·
Google I/O Is in 5 Days. Here's the One API Decision to Make Before Tuesday.
Google I/O starts May 19 and Gemini 4 is almost certainly on the agenda. Gemini 2.0 shuts down June 1. If you have anything running on the 2.0 API, you have 18 days to migrate — and the question is whether to move to 2.5 now or wait five days for the I/O announcement to set context. Here's the actual decision tree.
Guide ·
Google Just Killed Chromebook. Here's What Googlebook Actually Means for the Apps You're Building.
Google announced Googlebook last week — Android 17 rebuilt as a full desktop OS with real windowing, Gemini at the OS layer, and hardware from Dell, HP, and Lenovo shipping this fall. If you have an Android app or a PWA, this changes your development target. Here's what to actually do about it.
Tutorial ·
TypeScript 7 Is About to Land and Your tsc Is Getting 10× Faster: What a Solo Dev Actually Needs to Do
TypeScript 6.0 shipped in March as the last JavaScript-based release. TypeScript 7 (rewritten in Go, 10× faster builds, dramatically lower memory) is in nightly preview as @typescript/native-preview and close to GA. Most coverage is aimed at big teams. Here's the short version for solo builders: three commands, one config flag, done.