Closing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Blog
10⁻¹X Engineer stuff.
Scoping nvim-jdtls to a Maven subproject in a polyglot LazyVim setup
How a root_dir callback gate scopes jdtls to a Maven backend in a polyglot pnpm monorepo on Neovim 0.12.
mise shims resolve from cwd, not buffer path
mise shims on PATH is the documented approach for Neovim IDE integration, but LSP servers started from the wrong cwd resolve the wrong tool version.
Self-Contained mise in Dagger: Eliminating Tool Version Drift
Committing a self-contained mise bootstrap, mounting persistent cache volumes in Dagger, and enforcing the lockfile everywhere so mise.toml is the only source of truth for the toolchain.
Dagger's TypeScript SDK doesn't understand pnpm catalog:
Dagger modules install in isolation with a generated pnpm-workspace.yml that has no catalog. The project root's workspace file is never read.
Unifying a pnpm Monorepo's Dependency Versions with Catalog
Using pnpm catalog to turn two workspace packages with divergent TypeScript and ESLint versions into a single source of truth. Covers a Remotion peer-dep fix and a minimumReleaseAge interaction.
What Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
Adding Dagger CI to a Polyglot Monorepo
Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.
Python's Build System with uv
The frontend/backend split, the wheel pipeline, and why uv sync builds your project.
Adding Dagger CI to an Astro Blog
One container, ten checks, local/CI parity, and three bugs that taught me how Dagger works.
Fixing zizmor findings without suppressions
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
zizmor's auditor persona surfaces findings the default persona hides
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.
Building a 64-Layer ZMK Glove80 Layout
How I widened ZMK's layer state from 32-bit to 64-bit and built a dual-OS keyboard layout for the Glove80.
git rebase warns about local changes that git diff can't see
git rebase detached HEAD and already applied 8 of my feature commits. git diff showed nothing because the 'local changes' were the rebase itself, not uncommitted edits.
Scoping markdownlint rules to subdirectories
markdownlint-cli2 uses hierarchical config. Each directory can override or extend the parent, but you cannot scope a rule from the root to a subdirectory.