Git, editors, package managers, local dev environments.
Our pipelines and Dockerfiles ran corepack enable before installing dependencies with pnpm. After we bumped the base image from Node.js 24 to 26, every build failed: corepack: command not found. Corepack is no longer bundled with Node.js from version 25. How we install it explicitly and keep versions pinned.
A stash pop hit a merge conflict, a reset cleared the mess, and a stash clear tidied up the list. Two days of uncommitted work were gone. Git had kept the stash commit as an unreachable object, and we got it back with git fsck. Here is how, and the habits that make it unnecessary.
We published an internal package to our private Packagist and every app failed to require it: could not find a version matching your minimum-stability (stable). The package had no tags, only a main branch, so Composer saw only dev-main. How stability flags, tags and branch aliases work.
AI coding agents kept running the wrong test command, editing generated files and reading our .env. The fix was repo setup, not better prompts: a short instruction file, deterministic commands, permission rules, formatting hooks and a checked-in MCP config.
A step-by-step build of a small Model Context Protocol server in Python with tools, resources and prompts, then how we test it three ways: the MCP Inspector, a scripted client in pytest and a real AI client, before anyone on the team relies on it.
Most HTTP bugs can be pinned down with one tool you already have. This guide shows the curl options we use daily: verbose output, header-only requests, --resolve and --connect-to for testing servers before DNS changes, timing breakdowns, protocol versions and TLS checks.
Attackers copy popular repositories, add malware and promote the copies with similar names and fake stars. A practical guide for maintainers and users: how fake clones and repojacking work, how to make the real project verifiable with signed releases and provenance, and what to check before installing.
A lockfile-only dependency bump passed CI and then broke production. Our cache key hashed package.json, not package-lock.json, so CI restored old node_modules and skipped npm ci. How we found it and rebuilt dependency caching we can trust.
We extracted a webhook signature verifier from three Laravel apps into a public package. The steps from a folder of classes to an installable Composer package: structure, composer.json, service provider and auto-discovery, Testbench tests, a CI matrix across Laravel versions, tags and Packagist.
During an incident you rarely need a dashboard; you need answers from a log file in under a minute. The handful of grep, awk, sort, uniq, cut and jq patterns we use most, each run against the same sample nginx and JSON logs, with the output and the mistakes to avoid.
A worker image built fine but every container exited at once with "no such file or directory" for a file that clearly existed. A Windows checkout had turned the shebang into /bin/bash with a carriage return. We fixed it with .gitattributes and a CI check.
A routine dependency update moved us to ESLint 9, and lint failed in CI and every editor: ESLint couldn't find an eslint.config file. ESLint 9 uses flat config by default and ignores .eslintrc. How we migrated a TypeScript and React project, kept Prettier out of the way, and avoided the common traps.
Our deploy tool crashed with 'bool' object has no attribute 'upper' the day we added Norway to a YAML list. YAML 1.1 implicit typing turned NO into false and 0755 into 493. Here is how we found it, fixed it and stopped it coming back.
Our deploy script printed a pg_dump authentication error, then happily ran migrations and switched traffic to a half-migrated release. Bash does not stop on errors by default, and a pipe hid the failure even where we checked. Here is the strict-mode setup and its traps.
Every engineer who downloaded our internal deploy helper got a "damaged" dialog. The app was fine; a CI step modified the bundle after signing and Gatekeeper checked the quarantined copy. We now sign, notarize and staple in the right order.
Our deploy ran composer update on a 2 GB server until the resolver ran out of memory. Raising the limit let the OOM killer take MySQL instead. Committing the lock file exposed a second bug: it had been resolved on PHP 8.4 for a PHP 8.2 server.
A developer committed a .env file with a live AWS access key, then deleted it in the next commit. The key stayed in history. We revoked it within 40 minutes, checked CloudTrail, rewrote history with git filter-repo and added scanning so it cannot happen again.
Bumping React to 19 made npm install fail with ERESOLVE. The quick --legacy-peer-deps workaround installed, then crashed tooltips in staging. We learned to read the conflict, upgrade the real offender and use overrides only as a short, tested bridge.
A new Android Studio with JDK 21 forced a Gradle upgrade, the Gradle upgrade pulled in AGP 8, and AGP 8 rejected two old Flutter plugins with Namespace not specified. How we untangled the Gradle, AGP, Kotlin and JDK chain.
Our release notes used to be written from memory on Friday afternoon. Structured commit messages let tools compute the next version and the changelog for us. This is the setup we run: commitlint, PR title checks, and either semantic-release or release-please.
Our yearly Apple distribution certificate expired, we created a new one, and every archive failed: the provisioning profile doesn't include the signing certificate. Profiles embed the certificates they trust. How we regenerated profiles, cleaned keychains and verified signing identities.
A hotfix made on a checked-out tag vanished when the developer switched back to main, and a reset --hard later took a day of work with it. Nothing was really gone: the reflog still pointed at every commit. Here is how we got them back and what gc changes.