Reading a Lockfile: Supply Chain in Practice
What package-lock.json actually records, what its integrity hashes do and do not prove, and where the real install-time risk sits.
tooling
2 posts
What Actually Happens When Vite Serves a Module
A walk through one request to a Vite dev server: resolution, the transform pipeline, import rewriting, pre-bundling, and why production differs.