Page 7 - Monthly Archives: November 2025

Static code analysis and dependency checking are among the security features GitLab ships built in, and they can be wired into an existing .gitlab-ci.yml with just a few lines. The real work starts only afterwards: results need to be assessed, real vulnerabilities need to be prioritized, and false alarms need to be suppressed cleanly, without the security noise eroding developer trust in the tooling. This article covers integrating SAST and Dependency Scanning into an existing PHP or Node pipeline, and the practical handling of the findings that come out of it.

Code Vision displays right above every method how often it is called and whether related tests were last green, while inline hints show parameter and type information right inside the code itself. Both features can be enormously helpful for grasping context at a glance, but just as easily clutter the editor visually when left active everywhere without a second thought. This article shows how to configure both features precisely and how a team can settle on a shared convention for them, instead of every developer seeing a different view of the same code.

As soon as two devices edit the same record offline and both later synchronize, a conflict inevitably arises that the app has to resolve. This article shows how such conflicts technically occur, which resolution strategies hold up in practice, and where automatic solutions reach their limits.

The from/to definition of a transition only decides which state a transition is reachable from at all, but says nothing about whether it should be allowed under the current business conditions. That is exactly what the Symfony Workflow component's guard events and TransitionBlocker class are for, letting you block state transitions with fine granularity and meaningful error messages, combinable with Security Voters for role-based rules.

The fact that fopen, file_get_contents, and file_put_contents can handle not just local paths but also prefixes like http:// or php:// comes down to a single mechanism: the stream wrapper registry. Understanding how stream_wrapper_register works and which methods a wrapper class must implement lets you register your own protocols, whether for cloud storage or an in-memory filesystem that makes file access testable in unit tests without a real disk.

Routing in React has long been a source of runtime errors: wrong URL parameters, untyped search params, missing route guards. TanStack Router fixes this fundamentally through a fully type-safe routing system in which the TypeScript compiler catches every error in navigation, params and search params before the code ever reaches the browser.

An internal TypeScript package that gets imported inside the monorepo but suddenly throws type errors or loads the wrong runtime module when the application bundles almost always has the same root cause, a misconfigured exports field. Understanding the details of conditional exports and typesVersions avoids this class of bugs for good.

Building TypeScript projects with Webpack forces a core tradeoff: full type checking during the build or maximum compile speed. This article shows how ts-loader, babel-loader, and fork-ts-checker-webpack-plugin work together, how to structure a type-safe webpack.config.ts, and when switching to esbuild, swc, Vite, or Rspack actually pays off.

Using SSH correctly in automation scripts is trickier than it looks: disabling StrictHostKeyChecking solves the first connection problem, but it opens the door to man in the middle attacks. This article shows how SSH automation works without compromising security.

Polling is not a realtime architecture, it is a compromise that collapses under load. WebSocket and Mercure offer genuine push communication, but integrating them into React requires well thought out custom hooks, robust reconnect logic and secure state management for realtime data streams.