Tag archive
A JWT library that can be talked into using a public key as an HMAC secret, and a decompression library that follows symlinks out of the target directory. Both have fixes; neither is fixed by upgrading Node.
Navigating npm ERESOLVE Errors: A Strategic Guide for Engineering Leaders For dev teams,...
The Best Approach to Dependency Vulnerability Scanning in CI Pipelines Dependency...
I have a Python project on my hands: a tool built on FastAPI and DuckDB that scans file shares and...
Most AI tools focus on writing new code, but up to 80% of the cost of software comes from...
Originally published at norvik.tech Introduction Explore the technical rationale behind...
Quản lý dependency: lockfile, ba loại dependency, và rủi ro supply chain Một dự án Node...
Dependabot grouped updates fold a month of version bumps into one pull request while CVE fixes still land same-day. The cooldown key most configs miss.
Every large engineering org eventually wants the same thing: one view of every dependency across...
We extracted a stateful watcher agent from a governance kernel and enforced a one-way agent-to-kernel dependency edge — the kernel must not import its agents.
An honest survey of the infrastructure dependency tooling landscape in 2026 — what Backstage, Renovate, HCP Terraform Explorer, Nx, Wiz, and DIY sc...
Why every platform team eventually builds the same brittle script, and why it keeps breaking. A deep look at cross-repo dependency visibility — the...