• An Unsafe Autofix Can Change What a Test Covers

  The serializer has a test for an array hole: // biome-ignore lint/suspicious/noSparseArray: an array hole is the case under test expect(safeStringify([1, , 3])).toBe('[1,"[undefined]",3]'); Replacing the hole with an explicit undefined …

• The Published Import Wasn't the One in the Source

  The JSR version of my logger could fall back to console output even when Winston was installed. Its warning said Winston wasn’t found, but the failing import pointed to a file inside the logger package. The published code was trying to load …

• An Empty Environment Variable Still Needs Validation

  The logger handled an empty LOG_TIMESTAMP value by leaving the timestamp setting alone. The resulting log output was correct, but a required warning was missing. The configuration contract had two parts: ignore an unrecognized value and …

• Dependency Updates Needed a Coordinated Review

  Six Dependabot pull requests in my wiki project were closed and replaced with two coordinated updates. The packages still needed upgrading. The individual PRs just weren’t a useful way to review the related configuration and migration work. …

• My Test Agreed With My Bug

  The fix was one character. I appended "s" to a string. That’s the entire diff in the file that mattered: func printTimeoutValue(timeout time.Duration) string { seconds := int64(math.Ceil(timeout.Seconds())) if seconds < 1 { seconds = 1 } …

• A Dependency Bump Changed the Shape of My Vectors

  The commit is titled feat(deps): consolidate dependency updates. Sounds like a Tuesday. Bump some carets, watch CI go green, move on. What it actually did was cut every embedding in the database in half and rename the table they live in. …

• I Spent a Weekend on My Search Library and Deleted Its Best Feature

  A couple weekends ago I shipped nine releases of libsql-search, from 0.3.0 up to 0.11.0. The headline change is that I took out the local embedding feature. It used to generate embeddings locally. No API key, no account, no provider. You …

• I Gave Install-Script Permission to a Package I Don't Have

  There’s exactly one file in one of my wiki projects that’s a security control rather than a config file, and I hadn’t read it in months. pnpm 11 removed onlyBuiltDependencies along with four related settings and replaced all of them with a …

• My Logger Documented Four Environment Variables. None of Them Worked.

  I shipped a logging library with a LOG_LEVEL environment variable. The README documented it. A dedicated docs page documented it with examples and runtime-specific caveats. There were unit tests covering it, and they passed on every CI run …

• My Rate Limiter Documented Its Own Bypass

  I went looking through the rate limiter on a docs search API this weekend and found a comment I’d written explaining exactly how to defeat the code directly underneath it. Not a TODO. Not a “we should probably fix this someday.” An …