Developer Tools

How do you configure Yarn registries safely with npmScopes and HTTPS?

Yarn routes packages with npmRegistryServer and npmScopes, requires HTTPS by default and strict SSL. How to scope private registries and avoid token leaks.

How do you read a yarn.lock file to find the real version?

A yarn.lock v1 entry maps one or more version ranges to a single resolved version. Here is how to read it and why scanners use it instead of package.json.

Yanked, retracted, deprecated, archived: which flag should block a build?

Registries use different words for a dependency that should not be used. What yank, retract, deprecate and archived mean to a consumer, and which should fail a build.

Can you write release notes from an SBOM diff?

An SBOM diff gives you the dependency section of release notes: components added, removed and updated, plus advisories cleared. Includes a template.

How do you write golden path docs that developers actually read?

Golden path docs fail when they read like policy. Use a one page quick start, copyable commands, a why section and a fix guide for each blocking check.

How do you publish a scan report as a GitHub Actions job summary?

Append Markdown to the GITHUB_STEP_SUMMARY file and GitHub shows it on the run page. A table template, safety cautions and what to leave out of the report.

How do you write a Roslyn analyzer for a custom .NET code check?

A Roslyn analyzer derives from DiagnosticAnalyzer, registers a syntax action, reports a diagnostic, and gets unit tests. Steps and severity setup in .NET.

What should a regression test for a vulnerability fix assert?

A good security regression test fails before the fix, passes after, covers bypass variants, and still lets valid input through. Here is what to assert.

How do you write a Python security check with the ast module?

Parse Python with ast.parse, subclass NodeVisitor, match one risky call, report file and line, then test on safe and unsafe samples. Short working example.

How do you write a custom Go analyzer and test it with analysistest?

Define a Go analysis.Analyzer with a Run function, report diagnostics, and test it with analysistest using want comments in testdata files. Steps shown.

Should a design system wrap its third party UI dependencies?

Wrapping a third party date picker or chart in your own component limits the blast radius of an update. When it pays off, what it costs, how to do it.

Should you wrap a third party library or call it directly?

Wrap a library behind your own interface when swapping it would be costly or risky. Call it directly when it is small, stable, and easy to replace.