zizmor's auditor persona surfaces findings the default persona hides
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.
Blog
10⁻¹X Engineer stuff.
Building a 64-Layer ZMK Glove80 Layout
How I widened ZMK's layer state from 32-bit to 64-bit and built a dual-OS keyboard layout for the Glove80.
git rebase warns about local changes that git diff can't see
git rebase detached HEAD and already applied 8 of my feature commits. git diff showed nothing because the 'local changes' were the rebase itself, not uncommitted edits.
Scoping markdownlint rules to subdirectories
markdownlint-cli2 uses hierarchical config. Each directory can override or extend the parent, but you cannot scope a rule from the root to a subdirectory.
Upgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
Why I use two different file pickers in Neovim
fff.nvim is fast and frecency-aware but opinionated about git repos. Snacks.picker covers what fff skips: dotfiles, non-git directories, everything. I wired both into the LazyVim dashboard.
Sitemaps should not include redirecting URLs
The @astrojs/sitemap integration includes your redirect page in the sitemap, but it shouldn't.
Early look at Astro 7 alpha with Vite 8 and Rolldown
Updating this blog to Astro 7 alpha surfaced vite version conflicts, rolldown type incompatibilities, and the fact that pnpm update bypasses minimumReleaseAge.
Fixing white borders on Apple touch icons
How transparent PNGs cause white borders on Apple devices and the fix.
Hardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
Opening terminal paths in an existing Neovim pane with Kitty hyperlinks
How I wired kitty, OSC 8 hyperlinks, and Neovim remote control so plain clicks on ls and rg output open files in the nvim pane already running in the same window.
Short git hunk previews and CodeDiff in LazyVim
How I replaced diffview with CodeDiff and wired gh and ]h for wrapped gitsigns hunk previews in LazyVim.
Automated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
Beyond Version Checks: Provenance and Behavioral Security
Lockfiles, cooldowns, and exclusion lists are necessary but not sufficient. Provenance verification and behavioral analysis catch the attacks they miss.
Keeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.