Reading a Lockfile: Supply Chain in Practice
What package-lock.json actually records, what its integrity hashes do and do not prove, and where the real install-time risk sits.
Articles on JavaScript, TypeScript, and the runtimes, frameworks and tooling underneath them.
What package-lock.json actually records, what its integrity hashes do and do not prove, and where the real install-time risk sits.
Control flow analysis is a graph walk over your code. Knowing what widens a type again explains most of the errors that look wrong.
Microtasks, rendering opportunities and starvation — what the loop actually does between your callbacks, in the browser and in Node.
A walk through one request to a Vite dev server: resolution, the transform pipeline, import rewriting, pre-bundling, and why production differs.
Every signals library is the same forty lines of bookkeeping. Here is what those lines do, and where the four popular implementations diverge.
Two functions that look identical can run at very different speeds. The difference is usually shapes, inline caches, and a deoptimization you never saw.