Engineering guides

Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof.

Back to engineering guides

Latest posts

Page 3 of 14

TypeScript project references: when incremental builds go stale

Project references speed large repositories only when dependency direction, outputs, and build info files stay consistent.

TypeScript package exports: expose types and runtime together

A package should expose matching type and runtime entry points so consumers do not resolve declarations from a path Node cannot execute.

NodeNext module resolution: why file extensions matter

NodeNext follows Node’s ESM rules, so relative imports in emitted code need runtime-valid extensions even when the source file is TypeScript.

TypeScript verbatimModuleSyntax: type imports without surprises

Verbatim module syntax keeps imports and exports closer to what you wrote, making type-only intent explicit and exposing module mismatches earlier.

TypeScript exactOptionalPropertyTypes: missing is not undefined

With exact optional properties, an absent key and a present key holding undefined are different states, which matters for patches and serialization.

TypeScript noUncheckedIndexedAccess: fix unsafe lookups clearly

This option makes array and dictionary access include undefined, revealing assumptions that need a guard, a default, or a stronger data model.

Benchmark TypeScript 7 correctly: cold build vs editor latency

A single tsc timing misses the experience developers feel, so measure clean builds, incremental builds, editor startup, and completion latency separately.

TypeScript 7 migration checklist for a Node.js monorepo

Treat the TypeScript 7 upgrade as a compiler and tooling migration: capture the TypeScript 6 baseline, remove deprecated options, then compare diagnostics package by package.

Graceful shutdown in Node.js: drain HTTP, queues, and database work

Closing the HTTP listener is only the first step; a process must stop taking work, finish bounded in-flight tasks, and then release.

CORS preflight caching: reduce OPTIONS traffic without weakening policy

Preflight caching can reduce repeated OPTIONS requests, but it cannot repair an overly broad origin or credential.

Server-Sent Events in Node.js: production reconnects and backpressure

SSE is simple for one-way updates, but production code must handle proxy buffering, disconnect cleanup, event IDs, and slow.

HTTP 103 Early Hints: when preloading helps and when it wastes bandwidth

Early Hints can start critical fetches before the final response, but incorrect hints compete with the resources a page actually.

Passkey backend verification: the checks tutorials often omit

A browser ceremony is not authentication until the server validates challenge, origin, RP ID, signature, counters, and credential.

Node.js diagnostics_channel: add observability without patching libraries

diagnostics_channel provides low-coupling instrumentation points, but subscribers must remain cheap and protect sensitive.

OpenTelemetry in Node.js: trace one request across API, queue, and worker

Distributed tracing becomes useful when context survives asynchronous boundaries and span names describe operations rather than framework.

Docker multi-stage builds for Node.js: smaller without missing runtime files

A smaller image is useful only when native modules, certificates, migrations, and source maps required at runtime still arrive in the final.

Docker BuildKit cache in GitHub Actions: stop rebuilding every layer

Remote BuildKit cache can reduce CI time, but only if Dockerfile ordering and cache ownership match the repository.

Kafka partition count planning: throughput is only one constraint

Partitions control parallelism, ordering, recovery work, and metadata cost, which makes a single messages-per-second formula.

Kafka consumer lag is not enough: measure processing age too

A consumer can have low offset lag while processing old events, so operations need both queue depth and event-age.

Kafka KRaft migration: a rollback-aware plan for production clusters

Moving Kafka metadata from ZooKeeper to KRaft is an operational migration, not a configuration rename, and each phase needs a stop.

Redis hot-key detection: find the key behind uneven latency

A healthy average can hide one key receiving a disproportionate share of traffic and blocking a Redis.

Redis vector sets in Node.js: build semantic search you can debug

A vector search feature becomes maintainable only when embeddings, distance metrics, filters, and evaluation examples are versioned.

Redis 8.8 arrays explained: where ordered values fit

Redis arrays add another way to represent ordered data, so teams should compare update patterns and memory rather than replacing lists.

Redis 8.8 INCREX rate limiting: model windows without fragile Lua

INCREX can simplify expiring counters, yet a useful limiter still needs a clear identity, window rule, failure policy, and.

PostgreSQL COPY REJECT_LIMIT: safer bulk imports without hiding bad data

REJECT_LIMIT can keep a bulk load moving through a small number of malformed rows, but rejected data still needs an auditable.

PostgreSQL 18 EXPLAIN memory and disk fields: read them correctly

New EXPLAIN details make spills easier to see, but one execution is not enough to choose work_mem or rewrite a.

PostgreSQL 18 skip scans: when a multicolumn index starts helping

Skip scans let PostgreSQL use some multicolumn B-tree indexes even when the leading column is not constrained, but they do not make every index order.

PostgreSQL 18 asynchronous I/O: what backend teams should measure

Asynchronous I/O can improve scans and vacuum work, but an upgrade benchmark must separate storage latency, cache effects, and query-plan.

Node.js July 2026 security update: versions, risks, and rollout plan

Node.js fixed high-severity HTTP/2 and Permission Model flaws on July 29. Use this practical guide to select versions, test production risks, and deploy safely.

GitHub Actions malicious workflow approval: what maintainers should review

GitHub may hold suspicious public-repository workflows for approval. Learn what triggered runs can access, how to review the diff, and when approval is unsafe.