#Security

Critical vulnerabilities in pnpm < 10.26: Update now

Two critical vulnerabilities (CVE-2025-69263, CVE-2025-69264) were discovered in pnpm 10.0.0–10.25. They allow lockfile integrity bypass and remote code execution, so immediate updates are required.

Claude Code Permissions: I Have No Idea What I'm Doing

I started tweaking Claude Code's settings files to stop the constant permission prompts, and fell into a rabbit hole. When the official docs say permissions 'can be bypassed' and call them 'tricky,' perfect control is probably not the goal.

React2Shell Was Such a Headache I Migrated from Next.js to Astro

CVSS 10.0 React2Shell, fix it and another vulnerability appears, fix again... I was done. Migrated to Astro — including a lesson learned from installing 60 shadcn UI components and using only one.

npm Was Broken So I Switched to pnpm [React2Shell Vulnerability]

npm install kept failing with a mysterious error while patching Next.js/React for a security vulnerability. Switching to pnpm fixed it immediately.

Notes on addressing the Next.js/React 'React2Shell' vulnerability

A summary of how to verify impact and the mitigation steps for the CVSS 10.0 React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478), plus additional DoS and source code exposure issues.