Sign in

Karl Horky

@karlhorky.com
2.8K followers 2.4K following 473 posts

Technical Founder, Curriculum Engineer @upleveled.io Org Team React Amsterdam, AmsterdamJS, @reactvienna.com Canadian, Austrian, he/him 📍Amsterdam github.com/karlhorky

PostsRepliesMedia
Karl Horky @karlhorky.com · 26/08/2026
introducing the `code-comments` skill: clearer, more deterministic code comments why: AI mostly writes in horrible, unclear, twisted ways (esp Claude) and that slop is saved in your codebase code comments, w. human + AI comprehension costs npx skills add karlhorky/agent-skills
https://github.com/karlhorky/agent-skills/pull/2

Add code-comments skill

karlhorky

3 hours ago

Comments written by AI agents often:

lead with the mechanism rather than the reason (the "what" instead of the "why")
bury the failure being avoided ("bury the lede")
use vague nouns or identifiers from another layer
repeat column or field names instead of describing stored values
The code-comments skill defines three forms:

an action opening with an imperative verb
a fact opening with the system or entity it describes
a column or field description written as a noun phrase
Actions use <verb> <noun> <reason>, except when the action and nearby code make the reason clear. Comments put affected records or entities near the start for faster debugging and use identifiers from the surrounding code so they remain searchable.

The skill also covers failure-first comments, matching TSDoc and CREATE TABLE descriptions, comment prefixes, and long background comments.

 Add action, https://github.com/karlhorky/agent-skills/blob/main/.agents/skills/code-comments/SKILL.md

Code Comments
Overview
Write comments for what the code does not express, usually a reason or behavior. Most comments take one of three forms:

Action: start with an imperative verb
Fact: omit the action and state a reason or behavior with its subject first
Description: use a noun phrase for what a database field or TypeScript property stores
Write actions as <verb> <noun> <reason>. Common words before an explicit reason include because, so, so that, to and for.

Exceptions:

Omit <reason> only when the action and nearby code make it clear
Use one sentence with no trailing period, wrapping it across lines when needed. Use multiple paragraphs only when the comment requires background.

Announce at start: "I'm using the code comments skill."

Examples of Code Comments
Start actions with an imperative verb
Example 1: omit a reason clear from nearby code
Good:

-- Sort optional lectures after other rPut debugging details first for scannability
Comments are often read while debugging, so two things are critical for speed of scanning:

1. The first word of the comment
2. The words near the start of the comment
Start actions with a verb followed by affected records or entities. Start facts with affected records or entities. Put generic conditions and reasons afterward.

Example 1: action verb directly followed by affected records
Good:

-- Exclude Tech Fundamentals Foundations (Immersive) cohorts, which
-- never had graduation events, so their certificates have no end
-- date to print
Example 2 (bad): put a generic condition first
Bad:

-- Return no certificate for Immersive cohorts with no graduation event,
-- because there is no end date to print - currently only Tech
-- Fundamentals Foundations (Immersive) cohorts
Why bad:

- Names the affected cohorts on the last line
- Starts with a generic condition that does not identify the affected cohortsName failures with Avoid or Prevent
Start workaround, guard and fallback comments with Avoid or Prevent. Follow the action form above, naming the failure before the reason (<Avoid/Prevent> <failure> <reason>). Common words before the reason include by and with.

Example 3: name the failure before the reason
Good:

-- Avoid signup failure when the browser reports a time zone missing
-- from time_zones by falling back to 'Etc/UTC'
Example 4 (bad): start with the fallback
Bad:

-- Fall back to 'Etc/UTC'
Why bad:

Starts with the fallback instead of the failure
Omits the missing time zone reason
220
Karl Horky @karlhorky.com · 20/08/2026
@philippeserhal.com would @netlify.com switch off Corepack for pnpm now that it's officially recommended against? x.com/karlhorky/st...
x.com
Karl Horky (@karlhorky) on X
Official recommendation from the pnpm team to avoid Corepack
220
Karl Horky @karlhorky.com · 19/08/2026
still trying to get Claude Code (Opus 5, but all Anthropic models are like this) to be more grounded in reality and less persuasive / rhetoric-heavy the responses are by default so unstructured and void of proof / verification push a little bit against the rhetoric and "You're absolutely right!"
https://github.com/karlhorky/dotfiles/blob/393f4d4149db43af38f04210d9d80a0de1c88cb4/settings/.codex/agents.md?plain=1#L49-L56

# Reasoning

- avoid rhetoric in your reasoning: report like a lab notebook, not an argument
  - show the command / code and its output for every factual claim
  - tables or other illustrative instruments which summarize data are nice, but they never replace the data behind them - show both the summary and the cited data
  - when you haven't verified something, mention:
    - you haven't verified yet
    - you're guessing / inferring
    - the next steps for verifying
  - drop persuasive language in headlines and body text: `Verdict:`, `Why X is wrong`, conclusions with no accompanying data
131
Karl Horky @karlhorky.com · 18/08/2026
TypeScript overlays in MDX files 😍 Using TS 7.x Content Mappers by @andrewbran.ch 🙌
0180
Karl Horky @karlhorky.com · 12/08/2026
ahh @github.com is removing "Close" notifications?? 😬 notifications are already bad enough, making them worse? submit your feedback here: github.com/orgs/communi...
August 10, 2026 • 1 minute read
Custom thread subscriptions are being deprecated

You’ll no longer be able to configure custom thread subscriptions for GitHub notifications.
300
Karl Horky @karlhorky.com · 12/08/2026
new proof of concept script: diagnostics from Next.js TypeScript language service plugin on the command line 😍 (also in CI) like `astro check` or `vue-tsc` or `mdx-tsc`
https://github.com/karlhorky/next-js-tricks#check-nextjs-typescript-plugin-diagnostics-in-terminal

Check Next.js TypeScript Plugin Diagnostics in Terminal
Next.js includes a custom TypeScript plugin for diagnostics such as missing types on metadata exports. However, the plugin diagnostics are not reported by tsc or a next CLI subcommand.

The TypeScript team have up until now (August 2026) rejected the feature request that tsc execute TypeScript language-service plugins:

microsoft/TypeScript#16607
To report the Next.js plugin diagnostics in the terminal and CI, install @typescript-eslint/project-service:

pnpm add --save-dev @typescript-eslint/project-service
Make sure the existing tsconfig.json enables the Next.js plugin:

{
  "compilerOptions": {
    "plugins": [{ "name": "next" }]
  }
}
Add the following script:

scripts/next-tsc.ts

...VS Code showing the Next.js metadata TS71008 warning and next-tsc exit code 1GitHub Actions failing on the Next.js metadata TS71008 warning from next-tsc
220
Karl Horky @karlhorky.com · 10/08/2026
another of my weird code review habits check PR changes (even for your PRs) - if not self-explanatory in PR context, make line comments on what/why benefits: 1. finds many logic errors + overengineering 2. returning to PRs later offers extra context both for AI and people
playwright/leadSeesMatchingDesignAndContent.spec.ts

```diff
// after Reach UI Tabs hides some images
// - https://github.com/microsoft/playwright/issues/31737#issuecomment-2233775909
-  await expect(lazyImagesLocator).toHaveCount(23);
+  await expect(lazyImagesLocator).toHaveCount(26);
```

@karlhorky
add 3 lazy-loaded SVG <Image /> (next/image) on homepagepackages/database/tables/0150-quizzes.ts

```diff
-  typeId: QuizType['id'];
+  curriculumVersionId: CurriculumVersion['id'];
+  quizTypeId: QuizType['id'];
```

@karlhorky

switch from `type_id` to `quiz_type_id` to match existing foreign key naming patterns
110
Karl Horky @karlhorky.com · 07/08/2026
that kind of day ... where a React key warning in your app leads you to discover a bug in React 🤯 github.com/react/react/...
https://github.com/react/react/issues/37240

Bug: False-positive missing key warning when Flight outlines a static child

 #37240
Open
Description
@karlhorky
karlhorky
opened 5m ago
Contributor
React version: 19.2.8

Steps To Reproduce
Open /repro and observe the Each child in a list should have a unique "key" prop. error message in the browser console.
Compare with /control, which reduces the preceding serialized prop from 4000 to 2500 characters.
020
Karl Horky @karlhorky.com · 07/08/2026
Even with all of these new code review tools lately, we still have diffs like this on GitHub (even SemanticDiff can't ignore the {' '} diff) Wonder if these belong in Git as semantic diff drivers per language/framework 👀 so diffs everywhere can ignore these 🤔
-                      {formField.label} {formField.required && <Asterisk />}
+                        {formField.label}{' '}
+                        {formField.required && <Asterisk />}-                            <option key={`option-${option}`} value={option}>
+                              <option
+                                key={`option-${option}`}
+                                value={option}
+                              >
450
Karl Horky @karlhorky.com · 05/08/2026
Naming is hard So try to avoid naming things as much as possible - use existing names, from the language, framework, external APIs, etc One of my latest additions to AGENTS . md github.com/karlhorky/do...
https://github.com/karlhorky/dotfiles/blob/main/settings/.codex/agents.md

- simplicity and transparency of values and program flow over abstraction and multiple levels of indirection
- naming
  - avoid inventing project-specific DSLs, aliases, or terminology when the underlying languages (eg. HTML, TS, SQL, etc), frameworks, protocols, external APIs or existing project-specific DSLs already name the concept
    - eg. instead align application APIs and props with underlying data (entities, values, elements, external names)
      - eg. expose `className`, HTML attributes, and Google/GitHub/Mailchimp/etc. field names
- prefer the Principle of Least Surprise over cleverness when choosing value shapes, ids, naming, and control flow
000
Karl Horky @karlhorky.com · 30/07/2026
Lightweight AI planning (avoiding a "plan" or "spec" which easily gets out of date): Start PRs with an empty commit + include all of the planned tasks in PR title and description (using checkboxes) Then keep this up to date and check off the points as you / AI implement github.com/karlhorky/do...
https://github.com/karlhorky/dotfiles/blob/main/settings/.codex/agents.md?plain=1#L4-L12

# GitHub

- opening PRs
  - always make user review title and description before starting work
    - as usual: create a branch
    - create an empty commit with a title with the prefix `Add initial empty commit`
    - as usual: push the branch to GitHub
    - propose 3 possible PR titles along with 1 possible PR description, following your PR title and description rules
    - ask the user for approval
    - after any iteration and approval, create a PR with the approved title and description
    - once you're ready to commit the first time, amend the empty commit and force pushhttps://github.com/upleveled/youtube-private-invitations/pull/2

Example PR title and description:

Add endpoint sync with OpenAPI contract #2

Depends on PR #1

Manual sync in PR #1 lets channel owners paste add/remove invitees in YouTube Studio, so it works without a backend. Some teams already decide private-video invite changes outside the extension (eg. cohort tools, admin dashboards, CRMs), and need the extension to fetch those pending changes without background polling.

This PR adds endpoint sync on top of the manual YouTube Studio automation. The options page stores API request settings, and the popup fetches pending invitations only when the user opens it or refreshes it.

Before changing YouTube private-video invitees, the popup shows one pending invitation change:

affected videos
invitees to add
invitees to remove
previous/next controls
an Apply button
When the user clicks Apply, the extension opens the first pending video's YouTube Studio edit page for the native private-share seed save, applies the same invitee changes to the affected videos, and reports each result back to the endpoint.

TODO

- [ ] Add options page API request settings textarea
- [ ] Parse .http-style endpoint URL and request headers
- [ ] Fetch pending invitations from GET <endpoint> only from popup open or refresh
- [ ] Add popup pending-change preview, navigation, refresh, and Apply action
- [ ] Show add/remove invitees and compact affected video links before applying
- [ ] Collapse affected video links after 5 videos
- [ ] Open the first pending video's YouTube Studio edit page for the native seed save
- [ ] Detect ytcp-error-section.app-load for wrong active channel or inaccessible videos
- [ ] Ask the user to switch YouTube Studio channels manually when YouTube Studio blocks access
- [ ] Reuse YouTube Studio automation for add and remove actions
- [ ] POST each invitation result to <endpoint>
- [ ] Keep failed invitations pending by endpoint behavior
- [ ] Always send reque...
231
Reposted by Karl Horky
TypeScript @typescriptlang.org · 08/07/2026
📣 The moment is here. 📣 TypeScript 7 is officially released! 7️⃣ devblogs.microsoft.com/typescript/a...
devblogs.microsoft.com
Announcing TypeScript 7.0 - TypeScript
Today we are proud to announce the availability of TypeScript 7, a 10x faster native port of TypeScript! Since its early days, TypeScript has promised to
15617156
Reposted by Karl Horky
Node.js @nodejs.org · 18/06/2026
⚠️ Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues. More information here: nodejs.org/en/blog/vulnerability/ju…
nodejs.org
Node.js — Thursday, June 18, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
03710
Karl Horky @karlhorky.com · 17/06/2026
Security: VS Code 1.125 finally has a delay for auto-updates of extensions 👍 // Delay extension updates for 7 days "extensions.autoUpdateDelay": 168, Prompted by the recent security breaches and over 300 upvotes on my feature suggestion code.visualstudio.com/updates/v1_1...
VS Code release notes blog post showing a new setting:

Configurable extension auto-update delay
Setting: 
extensions.autoUpdateDelay
This setting is managed at the organization level. Contact your administrator to change it.ORG
To give you more control over when extension updates are installed, you can now configure a delay for automatic extension updates. This builds on the delayed extension auto-updates feature introduced in the previous release.

Use the 
extensions.autoUpdateDelay
This setting is managed at the organization level. Contact your administrator to change it.ORG setting to configure the delay in hours. By default, VS Code waits two hours before installing extension updates. The delay only applies when auto-update is enabled.issue on GitHub:

"Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions" by @karlhorky

which received 334 upvotes
111
Karl Horky @karlhorky.com · 17/06/2026
Had a great time MCing at @jsnation.gitnation.org 2026 in Amsterdam! Great to see all the friends and make new connections Thanks to the organizers at @gitnation.bsky.social , and everyone else who helped organize, spoke and otherwise joined the event! #JSNation
Hall full of people at JSNation 2026 in AmsterdamKarl Horky MCing on stage at JSNation 2026 in AmsterdamKarl Horky asking questions to Erick Wendel on stage at JSNation 2026 in Amsterdam
100
Reposted by Karl Horky
Vite @vite.dev · 04/06/2026
Today, VoidZero joins Cloudflare. Vite remains MIT, vendor-neutral, and stewarded by the same wider team. The same goes for Vitest, Rolldown, and Oxc. Cloudflare is also committing $1M to an OSS fund to support independent development in the Vite ecosystem.
vite.dev
Cloudflare supports Vite's mission
The VoidZero team is joining Cloudflare. Vite remains MIT, vendor-neutral and stewarded by the same wider team.
521238
Karl Horky @karlhorky.com · 02/06/2026
Looking forward to MCing at JSNation Conf 2026 in Amsterdam next week 🚀 As a preview, here's multiple badly-generated AI photos of me on stage, which don't look like me at all hint: I like talking about AI slop / AI fails ✨ and how we can do better See you all there!
bad AI-generated photo of Karl, wrong eyes, wrong facebad AI-generated photos of Karl on stage as a giant, pointing down at peoplebad AI-generated photos of Karl on stage as a giant, sitting in the air on nothing, with spotlights shining down on him
120
Reposted by Karl Horky
Jiahan Chen @chenjiahan.bsky.social · 26/05/2026
Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks? It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts. This is what happened in the recent Nx supply-chain compromise, which led to GitHub’s source code being leaked.
2347
Karl Horky @karlhorky.com · 19/05/2026
Come and join us at Jetbrains for the next AmsterdamJS, with some TC39 members 🙌
080
Karl Horky @karlhorky.com · 17/05/2026
VS Code extension Security: I proposed a setting in VS Code to limit extension installs to versions older than X days This is to mitigate supply chain attacks, similar to pnpm's minimumReleaseAge github.com/microsoft/vs...
Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions #316867

In the last years, supply chain attacks have increased dramatically. A few examples in the VS Code extension ecosystem:

- AI-Slop ransomware test sneaks on to VS Code marketplace - BleepingComputer
- Malicious VS Code AI Extensions With 1.5M Installs Found Exfiltrating Code - The Hacker News
- Fake Clawdbot VS Code Extension Installs ScreenConnect RAT - Aikido
- Solidity Devs Targeted Again: Malicious VS Code Extension Drops ScreenConnect RAT - Checkmarx
- VS Code extensions contain trojan-laden image - ReversingLabs
- Malicious VSCode extensions on Microsoft's registry drop infostealers - BleepingComputer
- Malicious VSCode extensions infect Windows with cryptominers - BleepingComputer
- Nx Compromised to Steal Wallets and Credentials - Semgrep
- Supply Chain Risk in VS Code Extension Marketplaces - Wiz

Allow for minimumReleaseAge-style...
1291
Karl Horky @karlhorky.com · 27/04/2026
Great research into the changing team dynamics of AI, and how a lot of tools and processes are built for: 1. slow, pre-AI ways of collaboration 2. multiplying singular AI users and siloing the AI interactions, instead of making it team-first
040
Karl Horky @karlhorky.com · 16/04/2026
VS Code: I suggested an "edit mode" for the integrated browser, for WYSWYG-style workflows of changing text copy If you also want this: it is a backlog candidate now, needs 20 👍 reactions to move it to backlog github.com/microsoft/vs...
Integrated browser "edit mode": use inline text edits as a signal for Copilot edits #310710

karlhorky
opened 5 hours ago · edited by karlhorky
When performing marketing copy edits, it is often faster to just change text copy directly in the integrated browser than to describe the change in chat and wait for Copilot to make the change and the dev server to update the integrated browser (especially true with slower dev servers).

In the integrated browser, introduce a mode where DOM elements/nodes containing text are temporarily editable (eg. the behavior of contenteditable attribute). The user can then edit text inline and click on a "Save" button, upon which Copilot should use the diff of the edited text (plus nearby DOM context and innerHTML, as necessary) as a signal to propose source edits in the backing tsx / jsx / html / svelte / vue / etc file.

This proposal is NOT about persisting DOM edits deterministically to files. The browser would only be the interaction surface, while Copilot still generates normal source edits for review, based on the diff.

This could be extended to other non-text edits in future, such as image paths.

Alternatives considered
Full WYSIWYG editor, mapping changes to source files deterministically

cc @meganrogge @jruales @kycutler
140
Karl Horky @karlhorky.com · 06/04/2026
Tomorrow: React Amsterdam ⚛️ April edition, at Picnic - Kirill Voloshin and Masoud Alali: Evolving the Picnic Page Platform with React Server Components - Leon Liefting: Building Flexible Breadcrumbs in Next.js With the App Router Hope to see you there! guild.host/events/react...
guild.host
React Amsterdam Meetup: React Server Components & more! | Guild
Apr 7th 6:30PM: Hey, React Amsterdam Community! We’re excited to kick off our next React meetup on April 7! Join us for an evening of practical insights, great conversations, and community vibes — fr...
020
Karl Horky @karlhorky.com · 31/03/2026
The axios breach is a good opportunity to review your package manager settings I recommend pnpm @pnpm.io Default: postinstall scripts are blocked, protects against axios vector Also try: - minimumReleaseAge: 10080 (pkgs must be min 7 days old) - trustPolicy - blockExoticSubdeps
3100
Karl Horky @karlhorky.com · 21/01/2026
Feb 5: Come and join our next React Amsterdam meetup 🚀 at Albert Heijn's AH Technology office in Zandaam Talks: - Releasing 20 Micro-Frontends in 1 Week With Module Federation by Gonzalo Beviglia - The Design System Journey by Gabriel Cardoso guild.host/events/react...
guild.host
React Amsterdam Meetup: The Design System Journey & more! | Guild
Feb 5th 6:00PM: Hey, React Amsterdam Community! We’re kicking off 2026 with our first meetup on February 5. Join us to explore how to scale
010
Karl Horky @karlhorky.com · 13/01/2026
🔒Node.js v22.22.0, v24.13.0, v25.3.0 fix 3 high, 4 med, 1 low severity security vulnerabilities (+ dependencies) Upgrade now: Windows: choco upgrade nodejs # or nodejs-lts macOS: brew upgrade node # or node@24 Ubuntu: sudo apt-get --only-upgrade install nodejs
Security releases available

Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:

- 3 high severity issues.
- 4 medium severity issues.
- 1 low severity issue.

This security release includes the following dependency updates to address public vulnerabilities:

- c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x
- undici (6.23.0, 7.18.0) on 20.x, 22.x, 24.x, 25.x
220
Karl Horky @karlhorky.com · 05/12/2025
pnpm 10.21 continues to add security features 🛡️ trustPolicy: 'no-downgrade' fails install if trust level of a package decreases with a new version
030
Karl Horky @karlhorky.com · 29/11/2025
Petition in Germany recognizing open source as volunteering for the common good 🤩 Seems like a good step towards recognition and a healthier open source ecosystem www.openpetition.de/petition/onl...
openPetition

Recognition of Work on Open-Source as Volunteering in Germany
Henning Lammert
 Petition is addressed to
German Bundestag, Petition Committee
 3,256 Signatures

3,134 from 30,000 for quorum in Germany
0184
Karl Horky @karlhorky.com · 19/11/2025
Wow, no more cookie banners in EU? 🤯🚀 Yes please! > some “non-risk” cookies won’t trigger pop-ups at all > central browser controls that apply to websites broadly [for other cookies] www.theverge.com/news/823750/...
theverge.com
Europe is scaling back its landmark privacy and AI laws
The EU folds under Big Tech’s pressure.
121
Karl Horky @karlhorky.com · 18/11/2025
Ohh, interesting opportunity to be the Head of the Sovereign Tech Fund in Berlin 👀
021
Karl Horky @karlhorky.com · 22/10/2025
Security: Do not install OpenAI Atlas, Perplexity Comet, etc At least until the security implications are more fully understood Multiple security research firms have found vulnerabilities in AI browser architecture, not restricted to only one specific browser brave.com/blog/unseeab...
brave.com
Unseeable prompt injections in screenshots: more vulnerabilities in Comet and other AI browsers | Brave
AI browsers remain vulnerable to prompt injection attacks via screenshots and hidden content, allowing attackers to exploit users' authenticated sessions.
000
Karl Horky @karlhorky.com · 16/10/2025
npx-safe by @rafaelgss.dev : Use the Node.js permissions model to make running npx on untrusted packages safer 🔥 github.com/RafaelGSS/do...
alias npx-safe='function _npx_safe() {
  local node_opts="--permission --allow-fs-read=$(npm prefix -g) --allow-fs-read=$(npm config get cache)"
  local package=""
  local package_args=()
  while [[ $# -gt 0 ]]; do
    if [[ "$1" == --* ]]; then
      # Anything starting with `--` goes into node_opts
      node_opts+=" $1"
    else
      # The first non-`--` argument is the package; the rest are package args
      if [[ -z "$package" ]]; then
        package="$1"
      else
        package_args+=("$1")
      fi
    fi
    shift
  done
  echo "============================="
  echo "         npx-safe Log        "
  echo "============================="
  echo "Node.js options:"
  echo "  $node_opts"
  echo
  echo "Package:"
  echo "  $package"
  echo
  if [[ ${#package_args[@]} -gt 0 ]]; then
    echo "Arguments:"
    for arg in "${package_args[@]}"; do
      echo "  $arg"
    done
    echo
  fi
  echo "============================="
  npx --node-options="$node_opts" "$package" "${package_args[@]}"
}; _npx_safe'
010
Reposted by Karl Horky
Rafael Gonzaga | Node.js @rafaelgss.dev · 15/10/2025
Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements and JIT pipeline optimizations. This release introduces the permission model --allow-net, Web Storage is enabled by default, and more! nodejs.org/en/blog/rele...
nodejs.org
Node.js
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
09523
Karl Horky @karlhorky.com · 10/10/2025
Ahh version control conflicts are a great use case for AI - conflicts can be super hairy, so any tools or context that can help with this is 🔥🔥
130
Reposted by Karl Horky
François Best @francoisbest.com · 18/07/2025
A phishing attack is going on against maintainers on @npmjs.bsky.social, be aware! - email is spoofed from npmjs.org (which doesn’t use DMARC but redirects to npmjs.com) - login link points to npnjs(dot)com (clear giveaway)
Email coming from npmjs.org, looking like an account maintenance notification, prompting the user to log in.The link to login looks identical to the NPM login, but hosted on npnjs.com
47342
Karl Horky @karlhorky.com · 25/09/2025
My request for Dependabot: Full support for @pnpm.io (updates to transitive deps fail currently) Voice support in the issue 🙌 github.com/dependabot/d...
pnpm transitive dependency updates support #13177

Dependabot doesn't support transitive dependency updates for pnpm, a very popular package manager (31M downloads / week as of writing).
140
Reposted by Karl Horky
Jen Simmons @jensimmons.bsky.social · 15/09/2025
Safari 26 is here!!! Anchor Positioning, Scroll-driven animations, High Dynamic Range images, the new HTML <model> element, the all-new Digital Credentials API, SVG icon support, WebGPU, WebKit in SwiftUI, every site can be a web app on iOS and iPadOS, and much more. webkit.org/blog/17333/w...
webkit.org
WebKit Features in Safari 26.0
We’re happy to share with you what’s arriving in Safari 26.0!
714030
Karl Horky @karlhorky.com · 04/09/2025
React Advanced meetup coming Toronto 🇨🇦 Any speakers interested: apply to the CFP at the link below 🙌
000
Karl Horky @karlhorky.com · 30/08/2025
Codemods for Node.js 😍 Looking great, thanks to all contributors!
npx codemod search scope:nodejs
Found 8 packages:

╭─────────────────────────────────────────┬──────────────┬──────────┬──────────────────╮
│ 📦 Name                                 │ 📊 Downloads │ ⭐ Stars │ 👤 Author        │
├─────────────────────────────────────────┼──────────────┼──────────┼──────────────────┤
│ @nodejs/fs-access-mode-constants        │ 8            │ 4        │ nekojanai (Jana) │
│ @nodejs/util-log-to-console-log         │ 8            │ 3        │ Bruno Rodrigues  │
│ @nodejs/process-main-module             │ 5            │ 4        │ Bruno Rodrigues  │
│ @nodejs/tmpDir-to-tmpdir                │ 4            │ 4        │ nekojanai (Jana) │
│ @nodejs/rmdir                           │ 7            │ 6        │ Augustin Mauroy  │
│ @nodejs/create-require-from-path        │ 5            │ 4        │ Augustin Mauroy  │
│ @nodejs/import-assertions-to-attributes │ 7            │ 5        │ Augustin Mauroy  │
│ @nodejs/correct-ts-specifiers           │ 0            │ 0        │ nodejs           │
╰─────────────────────────────────────────┴──────────────┴──────────┴──────────────────╯
1111
Karl Horky @karlhorky.com · 11/08/2025
@netlify.com multiple users reporting Netlify edge functions being down, in case you didn't know yet Maybe you can update the status page with the outage? answers.netlify.com/t/the-site-s...
My site https://fincaguarumo.com (hosted by Netlify via fincaguarumo.netlify.app, a next.js app) suddenly returns a 500 error.

In the logs, I can see only this:

Error handling request: TypeError: functions is not a function
at file:///root/src/bootstrap/server.ts:53:45
at mapped (ext:deno_http/00_serve.ts:407:24)
at mapped (ext:deno_http/00_serve.ts:513:16)
at ext:deno_http/00_serve.ts:729:29
at eventLoopTick (ext:core/01_core.js:178:7)
at async netlify:bootstrap-stage1:4:1

I have not changed anything recently, I do not have any custom functions. I have no idea how to debug this error as it seems to stem from Netlify itself and not something on my end.

Just to be sure, I triggered a manual deploy without cache, updated the @netlify/plugin-nextjs to 5.12.0, but to no avail.

The app uses next.js 15.

Is there anything else that can be done on my end?
110
Karl Horky @karlhorky.com · 09/08/2025
VS Code 1.103 (Jul 2025) finally has expandable hovers in JavaScript and TypeScript 😍 for when the hover info is showing the type name instead of the object / array / etc code.visualstudio.com/updates/v1_1...
3294
Reposted by Karl Horky
GitHub @github.com · 05/08/2025
Is more funding possible for open source maintainers in Europe? 🇪🇺 A new study commissioned by GitHub explores why creating an EU Sovereign Tech Fund could provide sustainable resources for critical OS projects. Learn how you can help make it a reality.👇 github.blog/open-source/...
github.blog
We need a European Sovereign Tech Fund
With a new feasibility study, GitHub’s developer policy team is building a coalition of policymakers and industry to close the maintenance funding gap.
15011
Reposted by Karl Horky
mikkelam.com @mikkelam.com · 07/07/2025
I made an emoji picker for Mac! Fun,but also rather frustrating experience 🙃 Swift was my third choice after 2 attempts with rust GUIs github.com/mikkelam/Emo...
github.com
GitHub - mikkelam/Emoji-Ninja: Fast emoji picker🥷💨
Fast emoji picker🥷💨. Contribute to mikkelam/Emoji-Ninja development by creating an account on GitHub.
021
Karl Horky @karlhorky.com · 18/07/2025
@bengubler.com Welcome to Bluesky! 🎉 Thanks for your work on the new `experimental.typedRoutes` Next.js Turbopack feature! bsky.app/profile/did:...
040
Karl Horky @karlhorky.com · 17/07/2025
Looks like `experimental.typedRoutes` is coming to Next.js Turbopack, thanks to Ben Gubler 🚀 🎉 github.com/vercel/next....
Screenshot of PR, showing that `experimental.typedRoutes` is no longer marked as "unsupported"
080
Reposted by Karl Horky
Jhey ʕ·ᴥ· ʔ @jhey.dev · 08/07/2025
SVG filters provide a basic lighting system you can sync with a little JavaScript and use in your web apps 💡 ... not as powerful as MacOS implementation but pretty cool
1353348
Reposted by Karl Horky
React @react.dev · 22/04/2025
React Compiler RC is now available! We've added support for swc and are working towards a stable release react.dev/blog/2025/04...
react.dev
React Compiler RC – React
The library for web and native user interfaces
010625
Reposted by Karl Horky
Igalia @igalia.com · 22/05/2025
With the next TC39 plenary less than a week away, Igalia’s Compilers team has just dropped a thorough blog post recapping April’s session. It walks through the standout proposals and discussions that will help steer JavaScript’s evolution in the months ahead. blogs.igalia.com/compilers/20...
blogs.igalia.com
Summary of the April 2025 TC39 plenary
A summary of the most exciting updates from the TC39 meeting held in April 2025
1198
Karl Horky @karlhorky.com · 21/05/2025
My work in open source, from fixing papercuts to support students to discussing standards 🚀 Thanks so much to the Open Source Initiative @opensource.org for featuring me as a maintainer for Maintainer Month 2025! opensource.org/maintainers/...
Screenshot of Open Source Initiative blog post by Karl Horky:


Karl Horky: From Papercuts to Standards

Hi, I’m Karl Horky (GitHub, LinkedIn), Technical Founder at UpLeveled – tech education programs for all skill levels.

In an educational landscape of AI-generated solutions, disconnected islands of knowledge and barriers to entry, I focus on helping students level up by designing accessible curricula and contributing to open source.

Then and Now

I’ve been in open source for over 13 years, and in tech for more than 20, through which I have used a range of languages and technologies, from QBasic and C to...
1151
Reposted by Karl Horky
Jeff Lindsay @progrium.bsky.social · 07/05/2025
What if you took the core abstractions of Plan 9 from Bell Labs and put them in a WebAssembly module? progrium.xyz/blog/2025/sp...
progrium.xyz
The Spirit of Plan 9 on the Web
Homepage and blog of hacker/builder Jeff Lindsay, aka progrium
095