Upgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
Blog
10⁻¹X Engineer stuff.
Why I use two different file pickers in Neovim
fff.nvim is fast and frecency-aware but opinionated about git repos. Snacks.picker covers what fff skips: dotfiles, non-git directories, everything. I wired both into the LazyVim dashboard.
Sitemaps should not include redirecting URLs
The @astrojs/sitemap integration includes your redirect page in the sitemap, but it shouldn't.
Early look at Astro 7 alpha with Vite 8 and Rolldown
Updating this blog to Astro 7 alpha surfaced vite version conflicts, rolldown type incompatibilities, and the fact that pnpm update bypasses minimumReleaseAge.
Fixing white borders on Apple touch icons
How transparent PNGs cause white borders on Apple devices and the fix.
Hardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
Opening local and SSH files in Neovim from Kitty hyperlinks
How I route Kitty file hyperlinks to local or SSH-session Neovim, reuse RPC sockets, and keep remote files from opening on my Mac.
Short git hunk previews and CodeDiff in LazyVim
How I replaced diffview with CodeDiff and wired gh and ]h for wrapped gitsigns hunk previews in LazyVim.
Automated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
Beyond Version Checks: Provenance and Behavioral Security
Lockfiles, cooldowns, and exclusion lists are necessary but not sufficient. Provenance verification and behavioral analysis catch the attacks they miss.
Keeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.
Replacing My Custom Pagefind Modal with astro-pagefind
How the astro-pagefind integration replaced three Vite workarounds with a single dependency.
Pagefind in Astro: The Gotchas I Hit
Three issues I ran into integrating Pagefind search into an Astro site with Vite's bundler.
Migrating from Nuxt Content to Astro Content
What changed when I replaced Nuxt Content's schema and collections with Astro's content collections.
Supply Chain Security with mise and pnpm
Trying to survive in the JS minefield