Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof.
Latest posts
Page 9 of 18Periodic code scanning for inactive repositories: find risk without alert overload
GitHub supports periodic code scanning of inactive repositories for eligible security programs. Target repositories by deployment and dependency risk, then route findings to a real owner.
Fetch GitHub Code Quality findings through REST without building a noisy dashboard
GitHub exposes Code Quality findings through REST for integrations and reporting. Import only findings tied to a clear workflow, deduplicate by stable identity, and sync resolution state.
Self-service credential revocation in GitHub incident response
GitHub added self-service credential revocation capabilities for supported enterprise incident workflows. Define who can revoke, how identity is verified, and how affected automation receives replacement credentials.
GitHub security API access restrictions: audit integrations before retirement
GitHub announced upcoming restrictions to public security API endpoints and related views. List every integration, owner, credential, endpoint, and fallback before enforcement.
GitHub closed security alert retention: export what compliance needs
GitHub announced an upcoming data-retention policy for closed security alerts. Identify audit requirements, export permitted records, and avoid storing sensitive alert details longer than necessary.
GitHub code coverage merge protection: prevent untested changes carefully
GitHub announced code coverage merge protection for pull requests. Baseline by repository, focus on changed code, and provide reviewed exceptions.
GitHub Actions 50-rerun limit: fix flaky workflows instead of retrying forever
GitHub limits a workflow run to 50 reruns, including full and partial reruns. Classify failures, use bounded retries around known transient operations, and repair deterministic flakes.
GitHub App token format changes: stop validating opaque tokens with regex
GitHub is rolling out a new installation-token format and recommends storage supporting at least 520 characters. Treat tokens as opaque, widen database columns, and test logs, proxies, and validators.
GitHub release asset download counts: interpret adoption without bad conclusions
GitHub now shows per-asset download counts in the Releases UI for users with write access; source archives are not included. Compare assets by platform and version while labeling bots, retries, and missing archive downloads as limitations.
Test GitHub Actions on Ubuntu 26.04 and Windows 11 ARM64 runners
GitHub provides Ubuntu 26.04 x64 and ARM64 plus Windows 11 ARM64 with Visual Studio 2026 in public preview. Add non-blocking matrix jobs first and compare tool versions and artifacts.
Approve bot-created pull requests before running GitHub Actions
Pull requests created by `github-actions[bot]` can run workflows after approval by a user with write access. Require approval for generated code and keep privileged jobs behind stronger environment gates.
GitHub self-hosted runner minimum versions: avoid queued jobs and brownouts
GitHub requires registration on runner 2.329.0 or newer and ongoing updates within 30 days, with enforcement timelines in 2026. Inventory runner versions, update images and bootstrap scripts, and monitor brownout annotations.
actions/checkout v7 blocks pwn requests: migration checklist
actions/checkout v7 refuses common unsafe fork checkout patterns and GitHub plans enforcement across supported majors. Replace privileged checkout-and-run workflows with unprivileged analysis or a reviewed two-stage design.
Control GitHub Actions workflow triggers with organization rulesets
Workflow execution protections add actor and event allowlists through GitHub rulesets. Run rules in evaluate mode, identify legitimate triggers, then block risky actors and events centrally.
Read-only GitHub Actions cache for untrusted triggers explained
GitHub now issues read-only cache tokens in default-branch contexts triggered by actors without write permission. Move cache population to trusted push or scheduled workflows and let untrusted runs restore only.
Parallel steps in GitHub Actions: use background, wait, and cancel correctly
GitHub Actions adds `background`, `wait`, `wait-all`, `cancel`, and `parallel` workflow controls with separate logs. Parallelize only independent work and name every background step that later steps depend on.
Node.js 26 upgrade rollback plan for APIs and workers
Node.js 26 includes engine, HTTP, API, and removal changes that can affect several application layers. Pin the old image, canary one service, compare telemetry, and make schema changes backward compatible.
Test native Node.js addons before upgrading to Node 26
A major Node and V8 update can require rebuilt binaries or updated addon releases. Test clean installs for every architecture, prefer Node-API packages, and build the production container in CI.
Should production use Node.js 26 Current before LTS?
Node.js 26 is the Current line and is scheduled to enter LTS in October 2026. Use Current for evaluation and controlled services; keep critical production on a supported LTS unless a verified benefit justifies earlier adoption.
Node.js 26 V8 14.6 upgrade: what backend teams should test
Node.js 26 moves to V8 14.6 from the Chromium 146 line. Benchmark startup, hot endpoints, memory, worker threads, and native dependencies on production-shaped traffic.
Node.js 26 removes legacy _stream modules: dependency audit guide
Node.js 26 removes legacy `_stream_wrap`, `_stream_readable`, `_stream_writable`, and related internal modules. Scan the dependency tree and upgrade packages before changing the production runtime.
Node.js 26 removes writeHeader: migrate to writeHead
Node.js 26 fully removes `http.ServerResponse.prototype.writeHeader()` and directs users to `writeHead()`. Search application and dependency code, replace direct calls, and test response status and headers.
Undici 8 in Node.js 26: fetch migration and regression checklist
Node.js 26 updates Undici to version 8.0.2. Test redirects, aborts, proxy use, streaming bodies, connection reuse, and timeout policy against real services.
Iterator.concat in Node.js 26: combine lazy sequences without arrays
V8 14.6 in Node.js 26 includes iterator sequencing through `Iterator.concat()`. Use lazy concatenation when inputs are ordered iterables and consumers can process incrementally.
Node.js 26 Map getOrInsert: practical cache initialization examples
Node.js 26 ships V8 14.6 with `Map.prototype.getOrInsert` and `getOrInsertComputed` support. Use computed initialization for per-key objects and keep compatibility checks for older LTS environments.
TypeScript 6 function inference changes: fix order-sensitive generic errors
TypeScript 6 changes context sensitivity for functions without `this`, reducing some order-dependent inference behavior. Add an explicit type argument or variable annotation at the unstable boundary.
TypeScript 6 DOM iterable merge: simplify the lib array
TypeScript 6 folds DOM iterable and async-iterable declarations into `lib.dom.d.ts`; the separate entries remain empty compatibility files. Remove redundant entries and type-check browser, worker, and server configs separately.
Map getOrInsert in TypeScript 6: replace repeated cache initialization
TypeScript 6 includes types for the standardized upsert methods `getOrInsert` and `getOrInsertComputed` in appropriate libraries. Use the computed form for expensive defaults and verify runtime support before removing a helper.
Fix TypeScript TS5112 when compiling one file beside tsconfig.json
TypeScript 6 reports TS5112 and requires `--ignoreConfig` when file arguments intentionally bypass `tsconfig.json`. Use `tsc -p` for project checks and reserve `--ignoreConfig` for isolated experiments.
TypeScript 6 no-default-lib directive removal: use noLib correctly
TypeScript 6 no longer supports `/// <reference no-default-lib="true"/>`. Use `noLib` or explicit `lib` configuration at the project boundary.