GitHub Projects advanced search is GA: your board is not an audit log
GitHub Projects adds AND, OR, and reviews: filtering while deployment statuses now expire after 90 days. A practical guide to separating control views from deployment evidence.
Writing my thoughts on software, business, and life.
All of my long-form thoughts on programming, business, and more
Dependabot now waits three days: turn dependency speed into a supply-chain policy
GitHub now applies a default three-day cooldown to Dependabot version updates. Learn how to separate security fixes from routine upgrades and combine cooldowns with dependency review, lockfiles, npm min-release-age, and frozen CI installs.
Supabase turned connection logs off: keep Postgres observable when the noise disappears
Supabase changed log_connections to off for new projects and existing Free/Pro projects. A practical playbook for retaining connection, pool, query, and audit visibility without permanent log noise.
npm v12 is GA: npm install now asks before running dependency code
npm v12 disables dependency install scripts, Git dependencies, and remote URL dependencies by default. A practical migration guide for node-gyp, native modules, monorepos, CI, OIDC trusted publishing, and staged releases.
Next.js 16.3 Turbopack: faster builds now require cache operations
A practical rollout playbook for Next.js 16.3 Preview Turbopack memory eviction, persistent build cache, Rust React Compiler experiments, and CI cache risk.
GitHub Code Coverage merge protection: decide the rollout contract before the number
GitHub can now use code coverage and code quality thresholds as pull request merge protection. Before setting an 80% rule, teams should define baselines, diff coverage, exclusions, flaky-test handling, approvals, and rollout policy.
Expo Maestro testing improvements: mobile E2E is becoming an operations metric
Expo added EAS Maestro dashboards, trend views, flaky-test tracking, failure-step analysis, failed-only reruns, and JUnit output. Here is how Expo and React Native teams should turn mobile E2E into a release operations signal.
Next.js 16.3 AI Improvements: the end of blind agent edits
Next.js 16.3 Preview adds managed AGENTS.md docs, first-party Skills, Agent Browser React introspection, actionable errors, a focused MCP server, and Markdown docs so agents can read and verify the framework feedback loop.
Next.js 16.3 Instant Navigations: the cache contract matters more than the fast click
Next.js 16.3 Preview introduces Instant Navigations, Partial Prefetching, and a stronger Cache Components story. Here is what teams should decide about route shells, Suspense, CDN caching, revalidation, and rollout before enabling it broadly.
Homebrew 6.0 moves developer supply chain security toward explicit trust
Homebrew 6.0 adds tap trust, Linux sandboxing, brew vulns, and Brewfile improvements. Here is what teams should change on macOS and Linux developer machines and CI.