Mastodon

Today on Trans Day of Visiblity I’m thankful to folks living their lives in an unapologetically authentic way — truly showing us what freedom can look like when we discard the baggage society has imposed on all of us. Love y’all.

Why does socket.dev report that the latest version of next.js has a malware dependency? https://socket.dev/npm/package/next/alerts/15.2.3?tab=dependencies

“Malicious code in gen-mapping (npm) Any computer that has this package installed or running should be considered fully compromised.”

Update: looks like this is a pretty big flaw in the vulnerability scanner — not in next (check the replies for more info)

Screenshot of socket.dev report has the following alert: Known malware: This package is malware. We have asked the package registry to remove it. Found 1 instance in 1 package

this winter storm is making the power go out every ten minutes — my external monitor is on battery backup and my internet connection automatically swaps to my phone hotspot — unfortunately even in the middle of nowhere I can seamlessly continue working weeeeeee

PageSpeed Insights offers some WordPress specific advice on this web site with a 9.5s TTFB:

> Choose a lightweight theme (ideally a block theme) and implement full-page caching or a static site solution. Disable unnecessary plugins to minimize server overhead. Consider upgrading your hosting to managed or dedicated service.

Choose a lightweight theme (ideally a block theme) and implement full-page caching or a static site solution. Disable unnecessary plugins to minimize server overhead. Consider upgrading your hosting to managed or dedicated service. stealmytesla.com 1st party 9,510 ms

Let’s talk about why Baseline browser compatibility doesn’t tell a complete story about whether or not a feature can be used “safely” by developers.

Consider `accent-color` (Not Baseline) versus CSS Nesting (Baseline 2023).

Browser compatibility is only a small piece: it’s far more important to consider the role the feature plays and how progressive-enhancement friendly that feature is.

CSS Nesting requires cross-browser ubiquity before use: `accent-color` is much safer, comparatively!

Look, if we’re going to lean into sites versus apps 🥱 and MPA 🥹 and SPA 😬 have already encrusted their way into the discourse — what about MPS and SPS 😅 (this is a joke don’t use these)

anyway an SPS can go a long way before it needs to be an MPS (and you need a build step to help with duplicated boilerplate)

Just encountered a *wild* JavaScript bug.

App code:
let myDate = DateTime.now();

Library code:
`myDate instanceof DateTime` was false, why??

First thought: multiple different versions of `DateTime` ("luxon") package installed via npm? Nope.

Actual culprit:

App code:
const { DateTime } = require("luxon");

Library code:
import { DateTime } from "luxon";

Luxon exports different versions of DateTime for CommonJS and ESM 😭 I may never trust `instanceof` again 😬 Best friend .contructor.name now