#tooling
Enforcing Best Practices with Jev as a Linter
5 min readAgents write most of our code now, and they respond to checks far more reliably than to documents. I turned a best practice written in plain English into a lint rule with Jev and Oxlint, annotated inline in GitHub pull requests.
The Bun CVE Gap, Closed: Surgical Updates Land in Bun 1.4
11 min readThree months ago, I wrote that Bun was the only mainstream package manager that couldn't do surgical CVE remediation. Bun 1.4 ships in-place transitive updates, bun audit fix, and nested overrides. Time to re-run the original reproductions.
Surgical Transitive Updates with pnpm: audit --fix
5 min readpnpm's audit --fix can now update vulnerable transitives directly in the lockfile instead of reaching for overrides first, and it even plays nicely with minimumReleaseAge. Let's dig in.
Speeding Up Checkout in a Fast-Growing Monorepo with Blacksmith
4 min readWe swapped actions/checkout for Blacksmith's cached checkout across our GitHub Actions. Mean checkout time dropped from 69s to 20s, reclaiming ~33 hours of runner time each weekday.
The Bun CVE Gap: When Your Package Manager Can't Do Surgical Updates
10 min readYarn Berry, pnpm, and npm all support surgical CVE remediation. Bun, today, doesn't. Here's what I found when I tried to apply my own workflow to a Bun project.
Migrating from ESLint, Biome, and Prettier to Oxlint and Oxfmt
8 min readI tasked an agent to migrate our monorepo from a mix of ESLint, Biome, and Prettier to Oxlint and Oxfmt. The full lint pipeline went from 81s to 2.5s.
Stop Using Yarn Classic
5 min readYarn Classic is frozen, and its lack of recursive transitive updates is becoming a real liability in an era where CVEs land weekly. It's time to move on.
Protecting Against Compromised Packages with Minimum Release Age
7 min readLeverage your package manager's minimum release age setting to delay the installation of freshly published versions and reduce the risk of pulling in a compromised package.
Minimizing Risk: Properly and Safely Resolving CVEs in Your Dependencies
10 min readHow to properly and safely update dependencies to resolve CVEs, while also gathering an understanding of how package managers handle dependencies.
Speeding up ESLint—Even on CI
5 min readGotta Cache 'Em All: Leverage ESLint's cache to speed it up.
Graphite: The End of Mammoth Pull Requests? My Experience
6 min readI stack small pull requests with Graphite, so I can keep working while reviews are pending and merge the whole stack through its merge queue.
Use Custom Merge Driver to Simplify Git Conflicts
3 min readTired of solving merge conflicts manually when it could be automated? Let's leverage Git's custom merge driver to simplify the process.
Enforce Best Practices Incrementally With Betterer
3 min readUsing Betterer to adopt, enforce, and teach best practices incrementally without having to refactor the whole codebase.
Setting up an Example App for Your React Native Library
5 min readHaving a hard time with a React Native example app? Here’s how you can simplify this with Metro bundler.