You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “dependencies”

Every note filed under dependencies, newest first.

A filtered view of the notes.

2026

  1. Four Hundred Findings

    A scanner report is not a list of your vulnerabilities. It is a list of your dependencies crossed with a database — and about one in thirty is reachable from code you actually run.

    security vulnerabilities dependencies supply-chain tooling dissecting-systems

  2. Can I Use This Library?

    A strict CSP quietly turns every dependency into a security decision. Here is the tree I walk to make it — per library, and across a whole app.

    security csp web architecture dependencies dissecting-systems

  3. You Don't Want Separate Repos

    Repository topology decides whether coupled code shares one content-addressed snapshot or negotiates version strings across a registry boundary.

    monorepo versioning git pnpm npm package-managers dependencies content-addressing modularity security supply-chain genkit sdk-design dissecting-systems