aube blocks renovate installs on a @yarnpkg/libzip trust downgrade
mise's embedded aube installer refuses to install renovate because @yarnpkg/libzip@3.2.2 lost the provenance attestation its 3.2.0 release had.
Today I Learned#mise#npm#supply-chain
Daily runs, weekly batches: splitting Renovate's trigger from its policy on self-hosted GitLab
A single daily GitLab schedule keeps Renovate's vulnerability detection fast while a repository-level schedule window collapses routine dependency churn into one weekly review batch.
Development#renovate#gitlab-ci#dependency-managementCheck pnpm view and advisory ranges before forcing a security override
Two commands, `pnpm view <pkg> dist-tags` and a GitHub advisory's affected ranges, show whether a security fix is backported to the major your consumers use, so an override stays patch-level instead of forcing a major bump.
Today I Learned#pnpm#supply-chain#renovateWhy pnpm audit --fix=update kept a vulnerable nanoid behind an auto-installed peer
A pnpm peer-resolution path dropped the update depth, retained nanoid 3.3.16, and made a full lockfile and node_modules refresh the clean no-override fix.
Development#pnpm#supply-chain#dependency-managementComparing a used Mac Mini, ARM64 hardware, and AMD x86 for GitLab CI
A comparison of a used M1/M2 Mac Mini, ARM64 servers, and AMD x86 hardware for a GitLab CI runner with x86_64 production images.
Development#arm64#amd#mac-miniRemoving the brace-expansion patch after moving minimatch to v10
A recurring SyntaxError traced to a brace-expansion patch and an ESM export-shape mismatch: how moving minimatch to v10 removed one patch while a minimatch@3 compatibility patch remained necessary.
Development#pnpm#renovate#dependency-managementClearing thirty Renovate merge requests in one pass
A retrospective of clearing a 30+ MR dependency backlog in a repository with JavaScript, Java, Python, and Terraform projects, including CI, supply-chain, and typecheck changes.
Development#renovate#gitlab-ci#dependency-managementWhat Changed in pnpm Since 11.7 Until 11.13.1
Seven pnpm releases shipped between 11.7 and 11.13.1, and the one that maps to my config is a peak-memory fix for the minimumReleaseAge and trustPolicy resolution path.
Development#pnpm#supply-chain#securityDependency caching belongs at the registry layer, not the package store
Caching the package manager store treats a symptom. A pull-through proxy registry is the layer where cross-runner dependency caching actually compounds.
Development#caching#nexus#platform-engineeringHardcoded tool versions in a GitHub Actions step drift from mise.lock under Renovate
Renovate bumps mise.lock but a version pinned inside a workflow run step stays stale, and MISE_LOCKED=1 then aborts. Install tools by name and let the lockfile decide.
Today I Learned#mise#github-actions#renovateTypeScript 7 is fast, but the Compiler API is gone. Here is what that breaks.
The Go rewrite delivers 10x faster type-checking. It also removes the programmatic API that eslint, Dagger, and every framework template type-checker depends on.
Development#typescript#eslint#daggerReducing Renovate's blast radius: split groups, custom managers, and the temporal-polyfill lesson
A single broken dependency blocked 20 updates in one Renovate PR. Three config changes prevent it from happening again.
Development#renovate#pnpm#supply-chainSelf-hosting Renovate on GitLab CI
Running Renovate as a scheduled GitLab CI job instead of the hosted GitHub App: the execution model, the token strategy, config validation in CI, and the tradeoffs accepted at each step.
Development#security#supply-chain#renovateScoping a GitLab CI monorepo pipeline by what actually changed
A lockfile change rebuilt five unrelated jobs. The fix was to stop using the lockfile as a build trigger and let the cache key encode toolchain changes instead.
Development#ci#gitlab#monorepopnpm audit signatures: a 'terminated' reason is a network error, not tampering
When pnpm audit signatures flags a package as invalid with reason 'terminated', the packument HTTP fetch failed, not a signature failure or tampering.
Today I Learned#pnpm#npm#supply-chainCodifying a pnpm audit remediation SOP into an agent skill
After re-deriving the same pnpm audit remediation decision tree across five JS trees one too many times, I packaged it as an agent skill that runs the process instead of rediscovering it.
Development#pnpm#supply-chain#agentscorepack packagemanager drifts from mise.toml under renovate
Renovate updates mise.toml via the mise manager and packageManager via the npm manager. They land in different PRs. I treated that as defense-in-depth until they disagreed.
Today I Learned#mise#pnpm#renovateClosing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Development#security#supply-chain#renovateWhat Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
Development#pnpm#supply-chain#securityFixing zizmor findings without suppressions
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
Development#zizmor#security#supply-chainzizmor's auditor persona surfaces findings the default persona hides
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.
Today I Learned#zizmor#security#supply-chainUpgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
Development#payload-cms#pnpm#supply-chainHardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
Development#security#supply-chain#renovateAutomated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
Development#security#supply-chain#renovateBeyond Version Checks: Provenance and Behavioral Security
Lockfiles, cooldowns, and exclusion lists are necessary but not sufficient. Provenance verification and behavioral analysis catch the attacks they miss.
Development#security#supply-chain#provenanceKeeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.
Development#security#supply-chain#pnpmSupply Chain Security with mise and pnpm
Trying to survive in the JS minefield
Development#security#supply-chain#mise