Our Blog
Explore our blog posts on web design, development, and digital marketing to stay up-to-date with the latest trends and strategies.
Found 57 blog posts
npm Supply-Chain Hardening in 2026: Lifecycle Scripts, minimumReleaseAge, and the Postinstall We Stopped Trusting
npm lifecycle scripts execute arbitrary dependency code before an application ever starts. These are our team's field notes on disabling install scripts by default, adding a release-age cooldown so no freshly published version reaches a lockfile, and what npm provenance does and does not prove.
Multi-Tenant SaaS in the Next.js App Router: How We Handle Subdomain Middleware and the Cache Leak We Caught in Time
We break down how we architect multi-tenant SaaS on the Next.js App Router: resolving tenants in middleware without a database hit per request, tenant-scoped caching, and the Postgres row-level security backstop that fails closed when application code forgets to scope a query.
Hybrid Search in Postgres with pgvector: Our Field Notes on HNSW, tsvector, and Reciprocal Rank Fusion
pgvector is a Postgres extension that adds vector column types and approximate-nearest-neighbour indexes. We shipped a RAG retrieval pipeline on it, watched it miss exact error codes and SKUs, and fixed it by fusing vector similarity with Postgres full-text search using Reciprocal Rank Fusion. These are our notes on HNSW versus IVFFlat, the 2000-dimension index limit, and the WHERE clause that returned fewer rows than the LIMIT asked for.
Web Workers in the Next.js App Router: Our Field Notes on import.meta.url, DataCloneError, and What a Worker Cannot Fix
A Web Worker is a background JavaScript thread with no DOM access. We moved CSV parsing, image resizing, and a search index off the main thread in a Next.js App Router app — here is why a hoisted new URL() returns 404 in production, why class instances arrive without methods, and why React StrictMode left our team with two workers.
Turborepo in a Real Monorepo: Field Notes on Cache Misses, NEXT_PUBLIC Poisoning, and the tasks Key That Replaced pipeline
Turborepo is a task runner that hashes each script's inputs and replays cached outputs instead of re-running the work. We moved a two-app monorepo onto Turborepo 2 — here is why the cache never hit, why a cache hit once shipped staging URLs to production, and why --affected silently builds everything on a shallow CI clone.
Temporal in Production: Replacing JavaScript Date, Fixing the Same-Day Bug, and the RSC Boundary Nobody Warns You About
Temporal is the TC39 API that replaces JavaScript's Date object with immutable, time-zone-aware types. We migrated a Next.js application's date handling onto Temporal, and these are our field notes: which Temporal type maps to which field, why Temporal objects cannot be passed as Server Component props, and how to keep the Postgres round-trip honest.
Parallel Routes and Intercepting Routes in the Next.js App Router: Field Notes on the Photo-Modal Pattern
We use parallel routes and intercepting routes to build shareable photo modals in the Next.js App Router — named @slot folders, the (.) interception convention, and the default.tsx file that decides what happens on a hard refresh.
Observability in the Next.js App Router: Field Notes on instrumentation.ts, onRequestError, and the Trace That Leaked Across Requests
instrumentation.ts and onRequestError give the Next.js App Router real tracing and centralized error reporting. Fluid Compute reusing one instance across concurrent requests broke a module-level trace variable we'd relied on for years — our field notes on wiring up OpenTelemetry correctly.
Testing the Next.js App Router: Field Notes on Server Components, Mocking fetch(), and Where Playwright Takes Over
Server Components run through Next.js's RSC renderer, not react-dom, so React Testing Library can't mount them directly. Field notes on the test pyramid that actually works: extracted functions and Client Components in Vitest, Server Actions called directly, and full routes in Playwright.
Database Connections in Serverless: Pool Math, PgBouncer Transaction Mode, and the Flags That Survive It
A connection pool in a serverless deployment is per-instance, not per-application, so the real ceiling is concurrent instances multiplied by pool size. Our team's field notes on why PostgreSQL starts rejecting clients, what Fluid Compute changed, and the driver settings that survive transaction-mode pooling.
Environment Variables in Next.js: Build-Time Inlining, Real Leak Paths, and Failing the Build with Zod
A NEXT_PUBLIC_ variable is not read at runtime — Next.js inlines it into the bundle at build time. Our field notes on the three ways this bites production apps: stale values that survive redeploys, the real paths a server secret takes to the browser, and a Zod schema that fails the build instead of the first request.
Webhooks in the Next.js App Router: Raw Bodies, Signature Verification, and Returning 200 Fast
A webhook signature is an HMAC over the raw request bytes, so parsing the body before verifying destroys the evidence. Our field notes from wiring payment and Git webhooks into the Next.js App Router: req.text(), constant-time comparison, acknowledging fast, and idempotent processing.
Stay Updated
Subscribe to our newsletter for the latest insights on web design, development, and digital marketing.