わだまる

ダックスフンド is かわいい /

[わだまる @wadackel]

キャップが7歳になりました🎉🐕
めでたいぬ

[りんたろー @re_taro_]

React Conf 2025 に参加してきたので特に印象に残ったセッションたちを振り返りました！！！！

#reactconf

https://t.co/tvFUW1Fp8x

[Yuji Sugiura / りぃ @leaysgur]

9月のまとめだよ〜
oxlintのプラグインがJSでかけるようになるよ〜

What’s New in ViteLand: September 2025 Recap | VoidZero
https://t.co/iprn4bWfZY

[わだまる @wadackel]

@SA0843061372988 はじめまして、ブログを読んでいただいてありがとうございます！ 申し訳ありませんが、一般頒布・販売の予定は現状ありません🙇（素人知識で作成しており安全性の担保、権利管理に十分に担保されていないため）
今後もし販売する機会があればぜひよろしくお願いします。

[わだまる @wadackel]

日記📝 / 自作した分割無線キーボードの現在地点
https://t.co/3UvPE8nxRD

[わだまる @wadackel]

Design Context なるほど
https://t.co/i1Ose9qWMo

[わだまる @wadackel]

storycap-testrun の addon-vitest 対応の件、ブログ書けた🐾
Storybook Vitest addonで安定したVisual Regression Testingを行うためのnpm packageを公開した
https://t.co/jUTi3KMXkL

[Chrome for Developers @ChromiumDev]

Announcing our public preview of Chrome DevTools MCP! Experience the full power of DevTools in your AI coding agent → https://t.co/u5kOrjFgrq

With Chrome DevTools MCP, your AI agent can run performance traces, inspect the DOM, & perform real-time debugging of your web pages.

[わだまる @wadackel]

対応おわったー🐾　結果として後方互換性の維持が困難だったので `@\storycap-testrun/browser` という新たな package として公開することとした。
細かい点での変更もあるしブログ書こう📝
https://t.co/4SJF8wX3K0

[わだまる @wadackel]

storycap-testrun の addon-vitest 対応やるかー

[わだまる @wadackel]

人生で初めて5週以上、週末にジムへ通う実績を解除したのでお祝いしたい

[Obsidian @obsdmd]

Less is safer: how Obsidian reduces the risk of supply chain attacks

Supply chain attacks are malicious updates that sneak into open source code used by many apps. Here’s how we design Obsidian to ensure that the app is a secure and private environment for your thoughts.

Less is safer

It may sound obvious but the primary way we reduce the risk of supply chain attacks is to avoid depending on third-party code. Obsidian has a low number of dependencies compared to other apps in our category. See a list of open source libraries on our Credits page.

Features like Bases and Canvas were implemented from scratch instead of importing off-the-shelf libraries. This gives us full control over what runs in Obsidian.

- For small utility functions we almost always re-implement them in our code.
- For medium modules we fork them and keep them inside our codebase if the licenses allows it.
- For large libraries like pdf.js, Mermaid, and MathJax, we include known-good, version-locked files and only upgrade occasionally, or when security fixes land. We read release notes, look at upstream changes, and test thoroughly before switching.

This approach keeps our dependency graph shallow with few sub-dependencies. A smaller surface area lowers the chance of a malicious update slipping through.

What actually ships in the app

Only a handful of packages are part of the app you run, e.g. Electron, CodeMirror, moment.js. The other packages help us build the app and never ship to users, e.g. esbuild or eslint.

Version pinning and lockfiles

All dependencies are strictly version-pinned and committed with a lockfile. The lockfile is the source of truth for builds so we get deterministic installs. This gives us a straightforward audit trail when reviewing changes.

We do not run postinstall scripts. This prevents packages from executing arbitrary code during installation.

Slow, deliberate upgrades

When we do dependency updates, we:

1. Read the dependency’s changelog line-by-line.
2. Check sub-dependencies introduced by the new version.
3. Diff upstream when the change set is large or risky.
4. Run automated and manual tests across platforms and critical user paths.
5. Commit the new lockfile only after these reviews pass.

In practice, we rarely update dependencies because they generally work and do not require frequent changes. When we do, we treat each change as if we were taking a new dependency.

Time is a buffer

We don’t rush upgrades. There is a delay between upgrading any dependency and pushing a release. That gap acts as an early-warning window: the community and security researchers often detect malicious versions quickly. By the time we’re ready to ship, the ecosystem has usually flagged any problematic releases.

—

No single measure can eliminate supply chain risk. But choosing fewer dependencies, shallow graphs, exact version pins, no postinstall, and a slow, review-heavy upgrade cadence together make Obsidian much less likely to be impacted, and give us a long window to detect problems before code reaches users.

If you’re curious about our broader approach to security, see our security page and past audits.

[わだまる @wadackel]

Wasm 3.0 だ🐕 全然追えてなかったけどすごく進化してる
Wasm 3.0 Completed - WebAssembly https://t.co/o865jd56qT

[Publickey @publickey]

ブログ書きました： GitHub、総合的なMCPサーバのレジストリを目論む「GitHub MCP Registry」公開
https://t.co/ZKl1IUPFca

[わだまる @wadackel]

storybook-testrun の対応、addon-vitest と test-runner で取れる Story の情報に結構差分があるから、完全互換は厳しいなー。実用上困らないだろう落とし所を見つけないとだ🐾

[わだまる @wadackel]

@re_taro_ 💪

[わだまる @wadackel]

その他、Node での処理が必要な箇所は適宜 Commands API を通じて実装可能なんだ。割と柔軟に色々できそう

[わだまる @wadackel]

Vitest の Browser Mode で CDP 触るの面倒くさそうだなーと思ったけど、`cdp` 関数が export されているんだ
https://t.co/UJ3VfVod0v

[よしこ / yoshiko @yoshiko_pg]

4月〜6月で開発業務におけるAIの活用を推進する旗振り役をやっていて、結構手ごたえあったので何をしてたかまとめてみました！
どの会社でもそういう話が持ち上がっていそうな一方、具体の事例はまだあまり多くなさそうなので何かの参考になれば🙏
https://t.co/d04ws0orZe

[わだまる @wadackel]

作業ログ📝 /
ブログをCloudflare PagesからWorkersへ移行した作業ログ - https://t.co/tZ6kYjH4gQ
https://t.co/uCcEhmgGU1