There is an active npm security event: https://socket.dev/blog/shai-hulud-strikes-again-v2

At time of writing, Eleventy core and our official suite of plugins are unaffected.

Pretty wild that GitHub Contribution Graphs don’t count responding to or closing issues as Activity (though *opening* issues counts 🥸)

we are definitely triaging like we’ve never triaged before

SORRY FOR THE LATE RESPONSE.
APPRECIATE YOUR PATIENCE.
SORRY FOR THE RESPONSE.
APPRECIATE YOU.
SORRY, RESPONSE.
APPRECIATE.
SORRY.

we are really leaning into those outages today, huh https://www.githubstatus.com/

I can track web development eras like tree rings, but each ring is move-fast-and-break-things devs saying “we don’t care about Y and you shouldn’t either—here are a bunch of tools that disregard Y” and indie folks saying “no thanks, I do care about Y—those tools aren’t useful if they don’t take Y into account.”

Later it becomes “as an industry we have always thought Y was very important—we should build *new* tools that embrace Y, I wish someone would have said something before”

Rinse & repeat.

RE: https://infosec.exchange/@jerry/115571012524697515

we should have a cyber-monday-esque international holiday where we turn the web off for an entire day

you know what hasn’t taken down Cloudflare (afaik): dangerouslySetInnerHTML

“are the devtools keeping pace with emerging web standards?” is a very good litmus test for whether a browser vendor is investing alongside the web or just treading water

Jeppe Reinhold was kind enough to share this tool from Craigory Coppola to compare popularity of different Major/Minor versions of a package on npm:

https://craigory.dev/npm-burst/

via https://bsky.app/profile/reinhold.is/post/3m5kacyaljc2t

It’s a little frustrating that GitHub Discussions don’t automatically link back when mentioned (like Issues do)

(…or show any activity like when a Discussion title is renamed)

haven’t been in the 200’s on Eleventy Core in *awhile*

no one move, I want to just sit with this for a bit 😅

sometimes I post something that’s earnest which I know is very confusing

my wife and two kids are still enjoying starcraft and it genuinely feels like I’ve won the lottery 🤑

we won a 2v2 against Very Hard bots yesterday — slowly improving my APM (at 40 right now)

#Blessed

The Ruby ecosystem is going through some pretty hefty turmoil in an attempt to rescue and restore the integrity of their community.

I’m even seeing some good efforts in PHP-land to better distance itself from the vacuum of stable leadership in WordPress too.

Is there any such movement in JavaScript (the same problems exist)? The biggest pattern I’m seeing is a *huge* centralization in project funding!

Reading along to https://blogs.gnome.org/alatiera/2025/11/06/dhh-and-omarchy-midlife-crisis/ and this quote really resonated:

“Is it any surprise that such a person later would find the most minuscule kind of opposition as an all-out attack on his self-image?”

You can tell a *lot* about a software community by how it handles criticism.

as “industry” survey season rolls around again it’s important to remember that the results from these things reflect the biases of the most popular dev communities that promote them (and then we get to all pretend like the results are meritocratic)

I now believe it’s better to not participate at all

my son and I were matching for halloween this year

Thinking about dark/light mode pickers that have three options: Auto/Dark/Light.

If the default is “Auto” — in what scenario might someone want to move away from Auto (which would visually be a noop to the same theme?)

I’m using Light mode as my system preference, but it seems unlikely that I would swap from Auto (Light mode) to Light mode (not Auto) on a specific site

maybe the API could use this web site https://whoisinspace.com/

my privacy settings are that I’m fine with a geolocation API but it should only return a boolean that reveals whether or not I’m on planet earth

look, my conscious brain *knows* that the death of google reader and the death of XSLT are unrelated…

…but my subconscious brain has questions

that a completely freeform chat interface might be more usable than your web site isn’t much more than an indictment of your web site

here are two of the cats (allegedly this is all of them)

the thing they don’t tell you about having two cats that look very similar is the implausible but persistent suspicion that you may actually have three cats that look very similar

TIL that CSS attr() cannot be used to compute anything in `url()` as the spec considers these to be “attr()-tainted” (for very valid security reasons): https://drafts.csswg.org/css-values-5/#attr-security

Thought maybe there was a way forward for global custom CSS-only favicons via new advancements in attr() https://developer.chrome.com/blog/advanced-attr (but alas, no — which, in hindsight — seems valid and fair)

do y’all think cloudflare socks would be too on the nose or…

Huh, this piece of the WordPress drama was new to me: https://wordpressenginetracker.com/

How did WordPress get a list of all of the domains hosted with WPEngine? and is this count starting with a static list or is it populating with new WPEngine customers?

HMM

https://www.youtube.com/watch?v=hE-yXDsmaKQ from https://www.jordansmartmusic.com/