Igor Savin

Maintainer of knex.js and a principal engineer at @lokalise. Mostly writing about Node.js stuff.

[Igor Savin @kibertoad]

@G0nZaIeZ @pair_of_ind а Скорцезе-то и не в курсе

[Igor Savin @kibertoad]

@shortstorylonq claude code web вообще без проблем создаёт PR'ы. надо только интеграцию с гитхабом включить и залогиниться

[Igor Savin @kibertoad]

@shortstorylonq достаточно настроить gh cli и сказать ему об этом. по дефолту на закрытых репах он пытается использовать именно это

[Igor Savin @kibertoad]

@jjho_y @valigo @ankkala that regression clearly wasn't a very niche edge case

[Igor Savin @kibertoad]

@valigo @ankkala the terrifying part to me was that there clearly were not enough tests to capture this bug. so it was a disaster waiting to happen to begin with.
LLMs expose gaps in your quality guards. hard and fast.

[Igor Savin @kibertoad]

@badlogicgames they have no regression tests?..

[Igor Savin @kibertoad]

@0xPrajwal_ have you ever seen the human-written mess?

[Igor Savin @kibertoad]

@walterwhitepill @blightersort @InezFeltscher what? there is an audiobook on Audible

[Igor Savin @kibertoad]

@zkochan @pnpmjs not necessarily, if it gets explicitly stopped with explicit message, it is more likely to obey

[Igor Savin @kibertoad]

@pnpmjs @sseraphini yes, please

[Igor Savin @kibertoad]

@froyalx @MPokrovskiy К Обсидианам это не относится никак. У них литералли просто нет таких бюджетов.

[Igor Savin @kibertoad]

@GeminiJack11 @nuhre_ animation costs money and takes time
voiceover costs money and takes time

writing is by far the cheapest part of it.

[Igor Savin @kibertoad]

@nuhre_ Most teams do not have a five year budget.

[Igor Savin @kibertoad]

pnpm should be the default package manager to consider for any JS/TS repo these days. Both security and performance wins are very tangible.

[Haz @diegohaz]

Ways to mitigate GitHub/npm supply chain attacks:

- Use pnpm
- Block all postinstall scripts unless necessary
- Use minimumReleaseAge
- Set up Trusted Publisher on npm/GitHub
- Disallow npm tokens
- Require 2FA for all org members
- Avoid pull_request_target
- If repo is public, consider restricting PRs to collaborators only
- Pin GitHub actions (peter⁠-⁠evans⁠/⁠create⁠-⁠pull⁠-⁠request⁠@⁠v8 → peter⁠-⁠evans⁠/⁠create⁠-⁠pull⁠-⁠request⁠@⁠5f6978f...)

[Igor Savin @kibertoad]

@dustindeus @wundergraphcom Congratulations!

[Igor Savin @kibertoad]

@MissPookems Star Control 2, and it's not even close.

[colinhacks/zod @colinhacks]

with the soft-transition complete, I'm now recommending that ecosystem library authors support Zod 4 exclusively moving forward

👉 Zod 3 should be considered functionally EOL (last patch 10mo ago)
👉 Zod 4 is stable and no future major version is planned
https://t.co/VJxM78Qrv4

[Igor Savin @kibertoad]

@mattjay you can just use pnpm 11+, it blocks packages that are too new by default