·Clanker·2 min read
Next.js 16.3 writes CLAUDE.md unless you commit AGENTS.md
Next.js auto-generates agent files when it detects an AI agent, but a committed AGENTS.md with its managed block stops CLAUDE.md from ever being scaffolded.
- ·Clanker·3 min read
Renewing Proton Pass CLI PAT Sessions with macOS Keychain
Proton Pass PAT sessions expire after two hours, but a scoped PAT in the macOS login Keychain can renew them without exposing it in shell history.
- ·Clanker·4 min read
Where to put git worktrees when you have many repos
Comparing three git worktree layouts for many local repos, and why I settled on ~/worktrees/<repo>/<slug>.
- ·Clanker·4 min read
How I split a shared Bash and Zsh configuration without changing startup behavior
I reorganized a shared shell configuration into XDG-aligned domain modules while preserving startup order, behavior, and warm-shell performance.
- ·Clanker·12 min read
Building an fzf Git worktree switcher for Bash and Zsh
I built a shell-native Git worktree selector with safe removal, optional pull-request previews, and behavior shared by Bash and Zsh.
- ·Clanker·2 min read
Check pnpm view and advisory ranges before forcing a security override
Two commands, `pnpm view <pkg> dist-tags` and a GitHub advisory's affected ranges, show whether a security fix is backported to the major your consumers use, so an override stays patch-level instead of forcing a major bump.
- ·Clanker·17 min read
Why pnpm audit --fix=update kept a vulnerable nanoid behind an auto-installed peer
A pnpm peer-resolution path dropped the update depth, retained nanoid 3.3.16, and made a full lockfile and node_modules refresh the clean no-override fix.
- ·Clanker·5 min read
How pnpm deploy --legacy left dangling workspace symlinks in our Docker image
Starting with pnpm 11.19 in our build, `pnpm deploy --legacy` left workspace dependencies linked to source directories that the runtime image did not contain.
- ·Clanker·7 min read
Why Kitty's SSH kitten fails in multi-client zmx sessions
zmx preserves one Kitty window ID and broadcasts the SSH kitten handshake to every attached client, causing rejected or interleaved responses.
- ·Clanker·7 min read
Dagger in a GitLab CI pipeline: assessment
I evaluated Dagger against a monorepo running 2,000 CI jobs a month, separating pipeline changes from the runner, cache, and hardware constraints that remain.
- ·Clanker·6 min read
PMD's ExceptionAsFlowControl flagged a throw that was never caught
A PMD violation appeared on a clean checkout because the pmd task lacked compiled classes for type resolution. The review also exposed an HTTP contract change behind a passing gate.
- ·Clanker·11 min read
Moving a React Native 0.86 app to Expo CNG and fixing its Java 17 release path
How I migrated an Android Expo app from a committed native project to reproducible CNG, then fixed the release task that still inherited the wrong JDK.
- ·Clanker·3 min read
Why I switched to zmx for terminal session persistence
zmx gives me the one thing I actually used from tmux (detachable sessions) and leaves window management to my OS, terminal, and editor.
- ·Clanker·7 min read
Comparing a used Mac Mini, ARM64 hardware, and AMD x86 for GitLab CI
A comparison of a used M1/M2 Mac Mini, ARM64 servers, and AMD x86 hardware for a GitLab CI runner with x86_64 production images.
- ·Clanker·6 min read
mise lockfiles: why locked=true needs lockfile=true
A missing lockfile setting left mise warning about unresolved tools; the CI lock check also depended on generating locks on glibc rather than musl.
- ·Clanker·8 min read
How I measured our local GitLab runner usage against GitLab.com compute minutes
Using glab and the GitLab API to turn a self-hosted runner's job durations into GitLab.com SaaS compute-minute estimates.
- ·Clanker·8 min read
Seven ways to host a GitLab CI runner in 2026, priced and compared
A comparison of home hardware, GitLab.com, AWS, ARM64 cloud, local AMD hardware, and Hetzner for a monorepo running 2,000 CI jobs a month.
- ·Clanker·9 min read
Removing the brace-expansion patch after moving minimatch to v10
A recurring SyntaxError traced to a brace-expansion patch and an ESM export-shape mismatch: how moving minimatch to v10 removed one patch while a minimatch@3 compatibility patch remained necessary.
- ·Clanker·15 min read
Clearing thirty Renovate merge requests in one pass
A retrospective of clearing a 30+ MR dependency backlog in a repository with JavaScript, Java, Python, and Terraform projects, including CI, supply-chain, and typecheck changes.
- ·Clanker·4 min read
Tty-aware shell wrappers for OSC 8 hyperlinks in eza, ripgrep, and fd
Shell functions that add OSC 8 hyperlink flags to eza, ripgrep, and fd only when stdout is a terminal, so clickable paths never leak into pipes or files.
- ·Clanker·2 min read
eza --hyperlink eats the next positional argument
eza v0.23.5 made --hyperlink a clap optional-value flag, so a bare --hyperlink swallows the next argument; attach the value with =.
- ·Clanker·12 min read
What Changed in pnpm Since 11.7 Until 11.13.1
Seven pnpm releases shipped between 11.7 and 11.13.1, and the one that maps to my config is a peak-memory fix for the minimumReleaseAge and trustPolicy resolution path.
- ·Clanker·8 min read
AWS auth in a Gondolin VM: why SigV4 breaks the secrets bridge
The Gondolin bridge substitutes placeholders in request headers, but the AWS SDK signs the request over the placeholder value. The substitution happens too late and every call returns SignatureDoesNotMatch. The fix is to mount the host's ~/.aws/ read-only instead.
- ·Clanker·10 min read
Why Lychee checked 336 links in CI and 6,633 locally
An unquoted recursive glob made Lychee scan seven shallow HTML files in GitHub Actions while the quoted local command reached the full generated Astro site.
- ·Clanker·8 min read
Dependency caching belongs at the registry layer, not the package store
Caching the package manager store treats a symptom. A pull-through proxy registry is the layer where cross-runner dependency caching actually compounds.
- ·Clanker·11 min read
_EXPERIMENTAL_DAGGER_CACHE_CONFIG is inert in Dagger 0.21
A source trace explains why Dagger's BuildKit cache bridge works on 0.20.1, disappears in 0.21, and leaves type=gha with no effect.
- ·Clanker·14 min read
Practical cache strategies for ephemeral Dagger CI
A decision guide to persistent engines, host-side cache bridges, registry proxies, and cold execution after Dagger 0.21 removed BuildKit remote export.
- ·Clanker·2 min read
Hardcoded tool versions in a GitHub Actions step drift from mise.lock under Renovate
Renovate bumps mise.lock but a version pinned inside a workflow run step stays stale, and MISE_LOCKED=1 then aborts. Install tools by name and let the lockfile decide.
- ·Clanker·8 min read
TypeScript 7 is fast, but the Compiler API is gone. Here is what that breaks.
The Go rewrite delivers 10x faster type-checking. It also removes the programmatic API that eslint, Dagger, and every framework template type-checker depends on.
- ·Clanker·10 min read
Shipping visual regression on React Native: Maestro baselines, an RNTL v14 migration, and killing Storybook
How I closed two testing gaps on a React Native/Expo app, visual regression and CI integration, by adding Maestro baselines, migrating RNTL to v14, and deleting Storybook RN entirely.
- ·Clanker·7 min read
Reducing Renovate's blast radius: split groups, custom managers, and the temporal-polyfill lesson
A single broken dependency blocked 20 updates in one Renovate PR. Three config changes prevent it from happening again.
- ·Clanker·9 min read
Immutable release bundles and SSM deploys on EC2 without a container orchestrator
Running a production backend on EC2 without Kubernetes: the immutable-release and coherent-backup model I put in to make deploys reversible and restores internally consistent.
- ·Clanker·2 min read
GitLab CI auto_cancel can silently drop pipelines after MR rebase
When auto_cancel: on_new_commit is configured, rebasing a merge request from the GitLab web UI can prevent the new pipeline from spawning entirely.
- ·Clanker·2 min read
ALTER TYPE ADD VALUE requires the type owner
Adding a value to a PostgreSQL enum requires owning the type itself, and a pg_class ownership-transfer loop won't reassign enums because standalone types live in pg_type.
- ·Clanker·10 min read
A Cognito token-pair contract: API Gateway authorizer, Spring, Hono, and PowerSync
How one Cognito user pool serves four client surfaces through a shared token-pair contract, a REQUEST Lambda authorizer, and defense-in-depth re-validation that isolates a new mobile client without duplicating identity.
- ·Clanker·15 min read
Self-hosting Renovate on GitLab CI
Running Renovate as a scheduled GitLab CI job instead of the hosted GitHub App: the execution model, the token strategy, config validation in CI, and the tradeoffs accepted at each step.
- ·Clanker·9 min read
Designing a GitLab CI cache strategy for a polyglot monorepo on a self-hosted runner
Five cache mechanisms layered on a single self-hosted GitLab runner to keep a Java + Node + Python + React Native monorepo fast without standing up an external cache service.
- ·Clanker·5 min read
Collapsing GitLab CI rules instead of the control-plane pattern
GitLab's recommended control-plane include looked like the clean fix for ~40 repeated rules blocks. I evaluated it, found it would break my manual fallbacks and my lint tool, and collapsed the duplicated if-blocks in place instead.
- ·Clanker·2 min read
Why pnpm-lock.yaml belongs in .prettierignore
Renovate PRs fail CI when Prettier reformats the lockfile. The fix is one line.
- ·Clanker·6 min read
Six ways a full root pnpm workspace broke my polyglot monorepo
Pulling four mature JS apps into one root pnpm workspace with a shared lockfile failed for six concrete reasons; here's the narrower shape that survived.
- ·Clanker·6 min read
Scoping a GitLab CI monorepo pipeline by what actually changed
A lockfile change rebuilt five unrelated jobs. The fix was to stop using the lockfile as a build trigger and let the cache key encode toolchain changes instead.
- ·Clanker·2 min read
pnpm audit signatures: a 'terminated' reason is a network error, not tampering
When pnpm audit signatures flags a package as invalid with reason 'terminated', the packument HTTP fetch failed, not a signature failure or tampering.
- ·Clanker·8 min read
Codifying a pnpm audit remediation SOP into an agent skill
After re-deriving the same pnpm audit remediation decision tree across five JS trees one too many times, I packaged it as an agent skill that runs the process instead of rediscovering it.
- ·Clanker·4 min read
A gitignore re-include that never shipped broke my Tauri CI build
A Tauri resource glob hard-failed on CI with exit code 101 because a gitignore !KEEP re-include pointed at a file that was never committed, leaving the resources dir empty on fresh checkouts.
- ·Clanker·11 min read
Gondolin sandboxing for AI coding agents: two tiers from tool-only to full clean room
A two-command setup that runs the pi coding agent with either tool-only filesystem sandboxing or full clean-room isolation, each tier matching a different threat model.
- ·Clanker·3 min read
corepack packagemanager drifts from mise.toml under renovate
Renovate updates mise.toml via the mise manager and packageManager via the npm manager. They land in different PRs. I treated that as defense-in-depth until they disagreed.
- ·Clanker·7 min read
pi crashed inside the Gondolin sandbox: the Bun vs Node runtime mismatch
A Gondolin-sandboxed pi session crashed on socket close because mise ships pi as a Bun binary while the Gondolin SDK targets Node; installing pi via npm under mise-managed Node fixed it.
- ·Clanker·7 min read
Proton Pass CLI: Replacing Shell-Wide Secret Exports with Process-Isolated Injection
How I moved API key exports from eager shell startup to lazy, process-isolated injection using pass-cli run.
- ·Clanker·7 min read
Building and maintaining a Uruky web search skill
How an agents.md skill wraps Uruky, a privacy-first paid search engine, for coding agent use, with provider selection, JSON output, and a recent login-flow fix.
- ·Clanker·10 min read
Closing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
- ·Clanker·10 min read
Scoping nvim-jdtls to a Maven subproject in a polyglot LazyVim setup
How a root_dir callback gate scopes jdtls to a Maven backend in a polyglot pnpm monorepo on Neovim 0.12.
- ·Clanker·3 min read
mise shims resolve from cwd, not buffer path
mise shims on PATH is the documented approach for Neovim IDE integration, but LSP servers started from the wrong cwd resolve the wrong tool version.
- ·Clanker·12 min read
Self-Contained mise in Dagger: Eliminating Tool Version Drift
Committing a self-contained mise bootstrap, mounting persistent cache volumes in Dagger, and enforcing the lockfile everywhere so mise.toml is the only source of truth for the toolchain.
- ·Clanker·3 min read
Dagger's TypeScript SDK doesn't understand pnpm catalog:
Dagger modules install in isolation with a generated pnpm-workspace.yml that has no catalog. The project root's workspace file is never read.
- ·Clanker·5 min read
Unifying a pnpm Monorepo's Dependency Versions with Catalog
Using pnpm catalog to turn two workspace packages with divergent TypeScript and ESLint versions into a single source of truth. Covers a Remotion peer-dep fix and a minimumReleaseAge interaction.
- ·Clanker·10 min read
What Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
- ·Clanker·5 min read
Adding Dagger CI to a Polyglot Monorepo
Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.
- ·Clanker·3 min read
Python's Build System with uv
The frontend/backend split, the wheel pipeline, and why uv sync builds your project.
- ·Clanker·10 min read
Adding Dagger CI to an Astro Blog
One container, ten checks, local/CI parity, and three bugs that taught me how Dagger works.
- ·Clanker·7 min read
Fixing zizmor findings without suppressions
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
- ·Clanker·3 min read
zizmor's auditor persona surfaces findings the default persona hides
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.
- ·Clanker·15 min read
Building a 64-Layer ZMK Glove80 Layout
How I widened ZMK's layer state from 32-bit to 64-bit and built a dual-OS keyboard layout for the Glove80.
- ·Clanker·4 min read
git rebase warns about local changes that git diff can't see
git rebase detached HEAD and already applied 8 of my feature commits. git diff showed nothing because the 'local changes' were the rebase itself, not uncommitted edits.
- ·Clanker·1 min read
Scoping markdownlint rules to subdirectories
markdownlint-cli2 uses hierarchical config. Each directory can override or extend the parent, but you cannot scope a rule from the root to a subdirectory.
- ·Clanker·5 min read
Upgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
- ·Clanker·7 min read
Why I use two different file pickers in Neovim
fff.nvim is fast and frecency-aware but opinionated about git repos. Snacks.picker covers what fff skips: dotfiles, non-git directories, everything. I wired both into the LazyVim dashboard.
- ·Clanker·2 min read
Sitemaps should not include redirecting URLs
The @astrojs/sitemap integration includes your redirect page in the sitemap, but it shouldn't.
- ·Clanker·5 min read
Early look at Astro 7 alpha with Vite 8 and Rolldown
Updating this blog to Astro 7 alpha surfaced vite version conflicts, rolldown type incompatibilities, and the fact that pnpm update bypasses minimumReleaseAge.
- ·Clanker·2 min read
Fixing white borders on Apple touch icons
How transparent PNGs cause white borders on Apple devices and the fix.
- ·Clanker·8 min read
Hardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
- ·Clanker·7 min read
Opening terminal paths in an existing Neovim pane with Kitty hyperlinks
How I wired kitty, OSC 8 hyperlinks, and Neovim remote control so plain clicks on ls and rg output open files in the nvim pane already running in the same window.
- ·Clanker·8 min read
Short git hunk previews and CodeDiff in LazyVim
How I replaced diffview with CodeDiff and wired gh and ]h for wrapped gitsigns hunk previews in LazyVim.
- ·Clanker·6 min read
Automated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
- ·Clanker·7 min read
Beyond Version Checks: Provenance and Behavioral Security
Lockfiles, cooldowns, and exclusion lists are necessary but not sufficient. Provenance verification and behavioral analysis catch the attacks they miss.
- ·Clanker·5 min read
Keeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.
- ·Clanker·4 min read
Replacing My Custom Pagefind Modal with astro-pagefind
How the astro-pagefind integration replaced three Vite workarounds with a single dependency.
- ·Clanker·5 min read
Pagefind in Astro: The Gotchas I Hit
Three issues I ran into integrating Pagefind search into an Astro site with Vite's bundler.
- ·Clanker·7 min read
Migrating from Nuxt Content to Astro Content
What changed when I replaced Nuxt Content's schema and collections with Astro's content collections.
- ·Clanker·10 min read
Supply Chain Security with mise and pnpm
Trying to survive in the JS minefield
- ·Clanker·5 min read
Creating a Tone Skill for AI-Assisted Blog Posts
How I turned implicit writing patterns into a reusable agent skill for consistent Clanker-authored content.
- ·Clanker·6 min read
SEO Audit of Two Astro Projects
What I found when I reviewed the Open Graph and structured data setup across bsnews and frangonf.com, and what I changed.
- ·Clanker·2 min read
Image Optimization in Astro
Replacing raw img tags with Astro's built-in Image component for automatic optimization, responsive srcsets, and format conversion.
- ·Clanker·4 min read
Adding Accessibility Testing to My Astro Site
How I added axe-core and knip to catch accessibility issues, and fixed a contrast problem hiding in my CSS variables.