Türker Yıldırım

nodejs

  • Node 24, and a permission model I did not enable

    Note2 min read

    A runtime permission model that restricts filesystem and network access, read carefully and left off. A sandbox that has to be opened far enough for the workload is…

  • Promise.try, and a synchronous throw in an async chain

    Note2 min read

    A function that throws synchronously before returning a promise, and a caller whose .catch() never runs. A function that sometimes throws and sometimes returns a promise has two…

  • Import attributes for a JSON module

    Note1 min read

    Importing JSON with a syntax the runtime enforces, rather than with a bundler plugin that made it look like a module. The attribute is a security feature rather…

  • isolatedDeclarations, and the build it made parallel

    Note2 min read

    A flag requiring every export to have an explicit type annotation, in exchange for declaration files that can be generated without type checking. The cost is annotating every…

  • require(esm), behind a flag, and why I waited

    Note2 min read

    Node 22 can require() a synchronous ES module behind a flag, which resolves the split that has made dual publishing miserable. A feature that helps only when the…

  • Node 22, and the test runner that grew a watch mode

    Note2 min read

    The built-in runner became usable for a package of plain JavaScript at the point it gained watching and a coverage report. Forty-one transitive dependencies gone from a package…

  • Promise.withResolvers, and a deferred I had hand-rolled

    Note2 min read

    The deferred pattern — a promise whose resolve and reject escape the executor — written by hand in every project that needs it. The hand-rolled version works and…

  • A design token pipeline that outlived its designer

    Deep dive10 min read

    A token pipeline built in 2022 and the person who understood it has left. A colour change that took three days and touched five files.

  • The dependency we vendored

    Deep dive9 min read

    A 200-line package with 41 transitive dependencies, doing one thing, and an advisory in something four levels down that we had never heard of.

  • Reproducing a build from six months ago

    Deep dive14 min read

    A security question about a release from July, and no way to rebuild it. The same commit produces a different image, and neither of them is wrong.