security
Secrets in argv, and scanners that fail open
A git clone with Authorization on argv is readable from ps, and a scanner that swallows errors is a silent pass. Two fixes from a PR review.
Read the entry →#debugging
8 entries tagged “debugging”.
linux
ENOSPC: System limit for number of file watchers reached
ENOSPC: System limit for number of file watchers reached is an inotify limit, not a full disk. Here's how to find what ate your watchers and raise them.
Read the entry → javascript
Losing this by passing a method as a callback
Passing obj.exec into a list strips this, so stateful plugins crash. Bind it, wrap it, or use an arrow field. Here is the GitProxy fix.
Read the entry → javascript
Optional chaining as an accidental deny
p.chains?.includes(name) dropped every plugin that omitted chains. Optional chaining in a filter is an accidental deny; default with ?? instead.
Read the entry → typescript
Record<string, T> hid a missing key as defined
Record<string, T> types every key as present, so a typo compiled and getChain returned undefined. Thirteen tests failed from one missing key.
Read the entry → node
Package subpath is not defined by exports
Package subpath is not defined by exports, plus ts(2307): the file exists, the exports map hides it. Here's how to import a public type instead.
Read the entry → node
Cannot find package: ESM bare specifiers in config
Cannot find package 'plugins' is Node treating a relative path as a package name. Here is the ESM specifier rule, and the one-character fix.
Read the entry → debugging
Setting environment variables on Windows npm scripts
Why "NODE_ENV=test" fails on Windows, and the one-line fix with cross-env.
Read the entry →