Page 23 - Monthly Archives: January 2025

The CSS Popover API solves a problem that has plagued the web for years: dropdowns, tooltips, and modal overlays always had to be implemented with JavaScript. With the native popover attribute, ::backdrop, and the :popover-open pseudo-class, the browser now provides a complete solution that is accessible, performant, and free of external dependencies.

Using Doctrine or Eloquent is easy, understanding why they work the way they do is not. Once you have built your own minimal ORM, hydration, unit of work, and identity map stop being abstract terms and become concrete decisions with clear trade-offs.

A list component that renders rows regardless of whether they represent users, products or orders is a classic case for TypeScript generics, yet Vue components long lacked the right syntax for it. Since Vue 3.3, script setup supports its own generic attribute, letting props, emits and slots bind type-safely to a generic type parameter without falling back on any or unknown. The result is components that behave like generic functions: written once, but usable for arbitrary, concrete item types with full autocompletion.

Storybook and Tailwind CSS are a natural combination: Tailwind provides the design system foundation through utility classes, Storybook makes it visible, testable and documented for the whole team. The result is a living component catalog that stays in sync with the code.

Log injection, also called log forging, arises when an application writes user-controlled input into log files unfiltered, and an attacker deliberately injects control characters like line breaks (`\r\n`) to visually and structurally split a single, actually contiguous log entry into multiple, seemingly standalone entries. These forged additional entries can be crafted to look like legitimate, harmless system events, causing actual malicious activity to get buried in a flood of forged distraction entries, or deliberately misleading forensic analysis after a security incident.

OPcache Preloading loads selected classes and functions exactly once when a PHP-FPM worker starts, into a persistent memory area, so they are immediately available for every following request. Configured correctly it noticeably saves time for autoloading, inheritance resolution and interface checks, configured incorrectly it accomplishes nothing or produces hard to trace errors after every deploy.

Every Composer and npm dependency is a silent trust contract with someone else's code. Typosquatting packages, hijacked maintainer accounts, and malicious install scripts inject attacks straight into build pipelines. This article covers real attack patterns and concrete countermeasures for PHP and Magento projects.

Generating code from OpenAPI specifications sounds tempting, but in practice it often produces unreadable cruft that immediately needs manual patching. That defeats the whole point of generation. This article shows how to configure openapi-generator so the output code is maintainable, and why template overrides are the key to that.

Magento 2 already ships with a working caching solution in the form of its built-in full page cache, yet many projects put Varnish in front of the shop anyway without checking whether the actual requirements call for it. This article compares both approaches based on traffic volume, hosting setup and team skills, and uses VCL examples, purge strategies and monitoring commands to show when the extra operational effort of Varnish really pays off.