corepack packagemanager drifts from mise.toml under renovate
Renovate updates mise.toml via the mise manager and packageManager via the npm manager. They land in different PRs. I treated that as defense-in-depth until they disagreed.
Blog
10⁻¹X Engineer stuff.
pi crashed inside the Gondolin sandbox: the Bun vs Node runtime mismatch
A Gondolin-sandboxed pi session crashed on socket close because mise ships pi as a Bun binary while the Gondolin SDK targets Node; installing pi via npm under mise-managed Node fixed it.
Proton Pass CLI: Replacing Shell-Wide Secret Exports with Process-Isolated Injection
How I moved API key exports from eager shell startup to lazy, process-isolated injection using pass-cli run.
Building and maintaining a Uruky web search skill
How an agents.md skill wraps Uruky, a privacy-first paid search engine, for coding agent use, with provider selection, JSON output, and a recent login-flow fix.
Closing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Scoping nvim-jdtls to a Maven subproject in a polyglot LazyVim setup
How a root_dir callback gate scopes jdtls to a Maven backend in a polyglot pnpm monorepo on Neovim 0.12.
mise shims resolve from cwd, not buffer path
mise shims on PATH is the documented approach for Neovim IDE integration, but LSP servers started from the wrong cwd resolve the wrong tool version.
Self-Contained mise in Dagger: Eliminating Tool Version Drift
Committing a self-contained mise bootstrap, mounting persistent cache volumes in Dagger, and enforcing the lockfile everywhere so mise.toml is the only source of truth for the toolchain.
Dagger's TypeScript SDK doesn't understand pnpm catalog:
Dagger modules install in isolation with a generated pnpm-workspace.yml that has no catalog. The project root's workspace file is never read.
Unifying a pnpm Monorepo's Dependency Versions with Catalog
Using pnpm catalog to turn two workspace packages with divergent TypeScript and ESLint versions into a single source of truth. Covers a Remotion peer-dep fix and a minimumReleaseAge interaction.
What Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
Adding Dagger CI to a Polyglot Monorepo
Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.
Python's Build System with uv
The frontend/backend split, the wheel pipeline, and why uv sync builds your project.
Adding Dagger CI to an Astro Blog
One container, ten checks, local/CI parity, and three bugs that taught me how Dagger works.
Fixing zizmor findings without suppressions
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.