Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof.
Latest posts
Page 8 of 18Redis 8.8 INCREX rate limiting: model windows without fragile Lua
INCREX can simplify expiring counters, yet a useful limiter still needs a clear identity, window rule, failure policy, and.
PostgreSQL COPY REJECT_LIMIT: safer bulk imports without hiding bad data
REJECT_LIMIT can keep a bulk load moving through a small number of malformed rows, but rejected data still needs an auditable.
PostgreSQL 18 EXPLAIN memory and disk fields: read them correctly
New EXPLAIN details make spills easier to see, but one execution is not enough to choose work_mem or rewrite a.
PostgreSQL 18 skip scans: when a multicolumn index starts helping
Skip scans let PostgreSQL use some multicolumn B-tree indexes even when the leading column is not constrained, but they do not make every index order.
PostgreSQL 18 asynchronous I/O: what backend teams should measure
Asynchronous I/O can improve scans and vacuum work, but an upgrade benchmark must separate storage latency, cache effects, and query-plan.
CodeQL C++ models-as-data field migration: fully qualified names explained
CodeQL is moving C++ models-as-data fields to fully qualified names. Learn what changes, how to audit custom model packs, and how to migrate without losing coverage.
CodeQL Rust hard-coded cryptographic value alerts: reviewing fewer false positives
CodeQL 2.26.1 added barriers that reduce false positives in Rust hard-coded cryptographic value queries. Learn how to separate test vectors from real secrets.
CodeQL Java path injection false positives with @Pattern: what changed
CodeQL 2.26.1 recognizes some Jakarta and Javax Pattern validators as path-injection sanitizers. Learn when an alert may disappear and when validation is still weak.
CodeQL WebClient SSRF alerts in Spring: how to review and fix them
CodeQL now recognizes Spring WebFlux WebClient URI calls as SSRF sinks. Use this guide to trace user input, restrict destinations, and test the fix.
CodeQL Angular postMessage origin check: fixing new HostListener alerts
CodeQL now traces Angular HostListener message events as remote input. Learn why origin checks matter, how to validate payloads, and how to review new alerts.
npm dual-use package metadata: contentPolicy and DISCLOSURE explained
npm security-sensitive packages may need a contentPolicy field and DISCLOSURE file. Learn what dual-use means, how to package the declaration, and how publishing changes.
Benchmark TypeScript 7 in CI without producing misleading numbers
A reproducible TypeScript 7 benchmark method for monorepos and CI, including cold runs, warm runs, diagnostics, declarations, memory, and merge-queue impact.
TypeScript 7 in VS Code: language server setup and rollback checklist
Install the TypeScript 7 VS Code language server, verify the workspace version, test editor features, measure stability, and roll back without changing CI.
Can Astro, Vue, Svelte, and MDX use TypeScript 7 yet?
TypeScript 7 is fast, but embedded-language tools still rely on the old compiler API. Understand what works today and how to test hybrid framework projects safely.
Run TypeScript 7 beside TypeScript 6 when tools still need the compiler API
TypeScript 7 has no stable compiler API yet. Use the official TypeScript 6 compatibility package so fast type-checking and API-dependent tools can coexist.
Node.js July 2026 security update: versions, risks, and rollout plan
Node.js fixed high-severity HTTP/2 and Permission Model flaws on July 29. Use this practical guide to select versions, test production risks, and deploy safely.
GitHub Actions malicious workflow approval: what maintainers should review
GitHub may hold suspicious public-repository workflows for approval. Learn what triggered runs can access, how to review the diff, and when approval is unsafe.
Dependabot malware alerts: enable them and triage a real package alert
GitHub expanded Dependabot malware data beyond npm. This guide shows how to enable malware alerts, verify exposure, contain a package, and avoid unsafe auto-fixes.
npm publish-time malware scanning: fix CI that expects instant installs
npm now scans packages before making them installable. Learn how to handle the normal publishing delay, verify registry availability, and keep release jobs reliable.
TypeScript 7 upgrade guide: migrate without breaking your toolchain
A practical TypeScript 7 migration plan covering TypeScript 6 compatibility, compiler speed, editor setup, CI checks, and tools that still need the old API.
Run and clean up background services in GitHub Actions jobs
GitHub Actions background steps can be named, awaited, and cancelled while retaining separate logs. Start the service as a background step, wait for an explicit health check, run tests, and cancel it during cleanup.
Limit open pull requests from users without write access
GitHub introduced controls to limit open pull requests from users without write access. Set a reasonable limit, publish contribution guidance, and preserve a path for legitimate large efforts.
Restrict GitHub issue creation to collaborators: reduce public repository spam
GitHub added controls that can restrict issue creation to repository collaborators. Use the restriction only with a visible alternative for security reports, support, and community feedback.
Secret scanning validators for Asana, IBM, and MessageBird credentials
GitHub expanded secret-scanning validators for Asana, IBM, and MessageBird credential types. Enable validity checks, map token owners, and rotate active secrets before cleaning history.
Secret scanning public monitoring for enterprises explained
GitHub announced public monitoring capabilities for enterprise secret scanning. Define verified domains and providers, route alerts to an incident queue, and establish external-repository contact procedures.
CodeQL Kotlin 2.4 support: upgrade static analysis with the language
CodeQL 2.26 supports Kotlin versions through 2.4.0. Update CodeQL alongside Kotlin, run a full baseline, and compare extracted files and alert counts.
CodeQL support for Go slog: prevent log injection and clear-text leaks
CodeQL 2.26 adds models for Go’s `log/slog` package to improve log-injection and clear-text-logging analysis. Use stable message templates, structured attributes, secret redaction, and output encoding.
CodeQL Razor Page request sources: catch C# injection paths
CodeQL 2.26 models `OnGet`, `OnPost`, and asynchronous handler parameters as remote-flow sources for C# analysis. Update scanning and review SQL, path, command, and template sinks reached from handler values.
CodeQL SSRF checks for IPv6 transition addresses
CodeQL 2.26 includes an experimental JavaScript query for incomplete IPv6-transition SSRF guards. Parse and normalize addresses with a maintained library, then enforce destination policy after DNS resolution.
Incremental CodeQL analysis: speed up CI without missing the full baseline
GitHub announced incremental analysis improvements for Go, C/C++, and CodeQL CLI workflows. Use incremental checks for fast feedback and schedule full analysis as the authoritative baseline.