Language-level gotchas, runtime errors, compiler and dependency issues.
Our pipelines and Dockerfiles ran corepack enable before installing dependencies with pnpm. After we bumped the base image from Node.js 24 to 26, every build failed: corepack: command not found. Corepack is no longer bundled with Node.js from version 25. How we install it explicitly and keep versions pinned.
A single 40-character form value froze an API worker for minutes. A nested quantifier in a validation regex made Python's backtracking engine try exponentially many paths. We show how we proved it, rewrote the pattern and added RE2 and CI checks.
We stopped adding patterns because a book listed them and kept only the three that removed real pain from a Node.js billing service: strategy for pricing rules, adapter for payment providers and plain constructor injection. Here is the before and after code.
Our cleaning job filled missing countries and lowercased emails, yet the output table still had nulls and mixed case. Chained assignment wrote to a temporary copy, and the warning that said so had been silenced. We fixed it with .loc and turned on Copy-on-Write.
Our nightly export reported the right row count but wrote an empty CSV. A refactor had turned a list into a generator, and the first loop consumed it. Here is how we traced it, the three ways to fix it, and the type hints that now catch it.
Our dosing controllers ran for weeks, then locked themselves out on day 49. The interval check compared now >= lastRun + interval, which breaks when the sum wraps past 2^32 milliseconds. How we proved it with a simulated clock and fixed it with unsigned subtraction.
A security review found that our password reset tokens and temporary passwords came from Python's random module. Its Mersenne Twister generator is fast and statistically good, but not unpredictable. We moved to secrets, hashed tokens at rest, and added Bandit to CI.
We published an internal package to our private Packagist and every app failed to require it: could not find a version matching your minimum-stability (stable). The package had no tags, only a main branch, so Composer saw only dev-main. How stability flags, tags and branch aliases work.
An LRU cache is a hash map plus a linked list. A database index is a B-tree. A rate limiter is often a sorted set. When we started reading system components as data structures, capacity questions and odd latency curves became much easier to explain.
A handful of tests in our Python service failed only when the whole suite ran, and only in some orders. A session-scoped fixture returned a mutable settings object that one test modified. How we proved it with random ordering and bisection, and how fixture scopes, factories and monkeypatch keep tests isolated.
Celery workers stopped picking up thumbnail jobs one by one, with no errors in the logs. A Popen.wait() on a chatty child filled the 64 KiB pipe buffer and both processes waited on each other. We fixed the deadlock, added timeouts, and learned why timeout alone is not enough with shell=True.
Writing a 200-character regex in one go is how parsing bugs are born. We build patterns the way we build code: named parts, explicit groups, alternation that stays contained, lookaheads for extra rules, then extract every field from log lines and key=value strings with tests that keep it honest.
We added a logging middleware to a FastAPI service and a server-sent events endpoint stopped streaming smoothly: events arrived in bursts, timings were wrong and disconnects went unnoticed. The middleware used BaseHTTPMiddleware. Why it interferes, and how pure ASGI middleware fixes it.
A practical first pass at regular expressions with Python's re module: the tokens you use every day, quantifiers, anchors, and the difference between search, match and fullmatch, ending with one pattern that safely validates an upload filename.
We launched local pricing in JPY, KRW and VND and a customer in Osaka was charged 398,000 yen for a 3,980 yen course. Our code multiplied every price by 100 before sending it to Stripe. How we found it, refunded it and built a per-currency exponent table with tests.
A Go pricing service's goroutine count grew by thousands per hour. A helper that raced a slow lookup against a timeout left the lookup goroutine blocked forever on an unbuffered channel nobody would read. How we found it with goroutine profiles and fixed it with context and goleak.
A Go ingestion service that forwarded events to a partner API was OOM-killed every time traffic spiked. Each event started a goroutine that waited on the slow partner, so goroutines and their buffers grew without limit. How we found it with pprof and fixed it with a bounded worker pool.
A new module built with nwidart/laravel-modules worked on every laptop, then production threw Class not found for its service provider right after deploy. The module's composer.json was never merged into the root autoloader in the image build, and an authoritative classmap froze the result.
After we set "type": "module" in package.json, jest.mock stopped replacing our mailer and tests started calling the real SMTP client. Static ESM imports are linked before any mock runs. Here is the mechanism and the fix with unstable_mockModule.
A Node.js queue worker restarted a few times a day, dropping in-flight jobs. An analytics call was started without await or catch; when the analytics service failed, the rejection was unhandled and Node.js terminated the process, as it does by default since version 15. How we fixed it.
One slow partner API call made our whole FastAPI service stop answering, health checks included, until Kubernetes restarted the pods. A synchronous requests call and a time.sleep inside async def were blocking the event loop.
A small refactor added __eq__ to our Money class so amounts could be compared. Soon a cache decorator and several set operations failed with TypeError: unhashable type: 'Money', because defining __eq__ without __hash__ sets __hash__ to None. How equality and hashing must agree.
A refactor passed a class method straight to .then() and our sync client started crashing with Cannot read properties of undefined (reading 'retries'). Methods do not carry their object with them. We compare bind, arrow fields and wrappers, including the arrow-field trap with subclasses.
Whenever someone exported a large CSV report, our Node.js API stopped answering everything else, including liveness probes, and pods restarted mid-export. Building 200,000 rows synchronously blocked the event loop for seconds. How we measured it and moved the work off the main thread.
Customer CSV uploads failed with KeyError 'email' even though the header clearly said email. Excel had written a UTF-8 byte order mark, and other files arrived in Windows-1252. We now detect the encoding explicitly and normalise headers.