Naming is hard So try to avoid naming things as much as possible - use existing names, from the language, framework, external APIs, etc One of my latest additions to AGENTS . md github.com/karlhorky/do...
Karl Horky
@karlhorky.com
Technical Founder, Curriculum Engineer @upleveled.io Org Team React Amsterdam, AmsterdamJS, @reactvienna.com Canadian, Austrian, he/him 📍Amsterdam https://github.com/karlhorky
Lightweight AI planning (avoiding a "plan" or "spec" which easily gets out of date): Start PRs with an empty commit + include all of the planned tasks in PR title and description (using checkboxes) Then keep this up to date and check off the points as you / AI implement github.com/karlhorky/do...
![https://github.com/upleveled/youtube-private-invitations/pull/2
Example PR title and description:
Add endpoint sync with OpenAPI contract #2
Depends on PR #1
Manual sync in PR #1 lets channel owners paste add/remove invitees in YouTube Studio, so it works without a backend. Some teams already decide private-video invite changes outside the extension (eg. cohort tools, admin dashboards, CRMs), and need the extension to fetch those pending changes without background polling.
This PR adds endpoint sync on top of the manual YouTube Studio automation. The options page stores API request settings, and the popup fetches pending invitations only when the user opens it or refreshes it.
Before changing YouTube private-video invitees, the popup shows one pending invitation change:
affected videos
invitees to add
invitees to remove
previous/next controls
an Apply button
When the user clicks Apply, the extension opens the first pending video's YouTube Studio edit page for the native private-share seed save, applies the same invitee changes to the affected videos, and reports each result back to the endpoint.
TODO
- [ ] Add options page API request settings textarea
- [ ] Parse .http-style endpoint URL and request headers
- [ ] Fetch pending invitations from GET <endpoint> only from popup open or refresh
- [ ] Add popup pending-change preview, navigation, refresh, and Apply action
- [ ] Show add/remove invitees and compact affected video links before applying
- [ ] Collapse affected video links after 5 videos
- [ ] Open the first pending video's YouTube Studio edit page for the native seed save
- [ ] Detect ytcp-error-section.app-load for wrong active channel or inaccessible videos
- [ ] Ask the user to switch YouTube Studio channels manually when YouTube Studio blocks access
- [ ] Reuse YouTube Studio automation for add and remove actions
- [ ] POST each invitation result to <endpoint>
- [ ] Keep failed invitations pending by endpoint behavior
- [ ] Always send reque...](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:b3xwbnwkl5qzjjhkwoimvb6x/bafkreiejt2ftsy4z6rrxxxeeia65kxwmnq5lglmul6d6gogtitt26rgfxy)
📣 The moment is here. 📣 TypeScript 7 is officially released! 7️⃣ devblogs.microsoft.com/typescript/a...
Announcing TypeScript 7.0 - TypeScript
Today we are proud to announce the availability of TypeScript 7, a 10x faster native port of TypeScript! Since its early days, TypeScript has promised to
devblogs.microsoft.com
⚠️ Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues. More information here: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
Node.js — Thursday, June 18, 2026 Security Releases
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
Security: VS Code 1.125 finally has a delay for auto-updates of extensions 👍 // Delay extension updates for 7 days "extensions.autoUpdateDelay": 168, Prompted by the recent security breaches and over 300 upvotes on my feature suggestion code.visualstudio.com/updates/v1_1...
Had a great time MCing at @jsnation.gitnation.org 2026 in Amsterdam! Great to see all the friends and make new connections Thanks to the organizers at @gitnation.bsky.social , and everyone else who helped organize, spoke and otherwise joined the event! #JSNation
Today, VoidZero joins Cloudflare. Vite remains MIT, vendor-neutral, and stewarded by the same wider team. The same goes for Vitest, Rolldown, and Oxc. Cloudflare is also committing $1M to an OSS fund to support independent development in the Vite ecosystem.
Cloudflare supports Vite's mission
The VoidZero team is joining Cloudflare. Vite remains MIT, vendor-neutral and stewarded by the same wider team.
vite.dev
Looking forward to MCing at JSNation Conf 2026 in Amsterdam next week 🚀 As a preview, here's multiple badly-generated AI photos of me on stage, which don't look like me at all hint: I like talking about AI slop / AI fails ✨ and how we can do better See you all there!
Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks? It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts. This is what happened in the recent Nx supply-chain compromise, which led to GitHub’s source code being leaked.
Come and join us at Jetbrains for the next AmsterdamJS, with some TC39 members 🙌
JSNation@jsnation.gitnation.org · 3mo agoSpecial Edition Meetup with TC39 members on May 21! Meet the speakers 👀 • @mikbar.bsky.social & Alberto Tontoni - IDE for Reading and Navigating the ECMAScript Specification • @nicr.dev - Topic TBA • TC39 Panel 👉 Register now: guild.host/events/amste... 🙌 Thanks to @jetbrains.com for hosting
VS Code extension Security: I proposed a setting in VS Code to limit extension installs to versions older than X days This is to mitigate supply chain attacks, similar to pnpm's minimumReleaseAge github.com/microsoft/vs...
Great research into the changing team dynamics of AI, and how a lot of tools and processes are built for: 1. slow, pre-AI ways of collaboration 2. multiplying singular AI users and siloing the AI interactions, instead of making it team-first
Maggie Appleton@maggieappleton.com · 4mo agoGot to talk at @aidotengineer.bsky.social conf last week about the need for collaborative AI engineering. All our current coding agents are single player. We're trying to scale up individual productivity, but creating tons of alignment problems in the process. We have no good tools for...
VS Code: I suggested an "edit mode" for the integrated browser, for WYSWYG-style workflows of changing text copy If you also want this: it is a backlog candidate now, needs 20 👍 reactions to move it to backlog github.com/microsoft/vs...
Tomorrow: React Amsterdam ⚛️ April edition, at Picnic - Kirill Voloshin and Masoud Alali: Evolving the Picnic Page Platform with React Server Components - Leon Liefting: Building Flexible Breadcrumbs in Next.js With the App Router Hope to see you there! guild.host/events/react...
React Amsterdam Meetup: React Server Components & more! | Guild
Apr 7th 6:30PM: Hey, React Amsterdam Community! We’re excited to kick off our next React meetup on April 7! Join us for an evening of practical insights, great conversations, and community vibes — fr...
guild.host
The axios breach is a good opportunity to review your package manager settings I recommend pnpm @pnpm.io Default: postinstall scripts are blocked, protects against axios vector Also try: - minimumReleaseAge: 10080 (pkgs must be min 7 days old) - trustPolicy - blockExoticSubdeps
Feb 5: Come and join our next React Amsterdam meetup 🚀 at Albert Heijn's AH Technology office in Zandaam Talks: - Releasing 20 Micro-Frontends in 1 Week With Module Federation by Gonzalo Beviglia - The Design System Journey by Gabriel Cardoso guild.host/events/react...
React Amsterdam Meetup: The Design System Journey & more! | Guild
Feb 5th 6:00PM: Hey, React Amsterdam Community! We’re kicking off 2026 with our first meetup on February 5. Join us to explore how to scale
guild.host
🔒Node.js v22.22.0, v24.13.0, v25.3.0 fix 3 high, 4 med, 1 low severity security vulnerabilities (+ dependencies) Upgrade now: Windows: choco upgrade nodejs # or nodejs-lts macOS: brew upgrade node # or node@24 Ubuntu: sudo apt-get --only-upgrade install nodejs
pnpm 10.21 continues to add security features 🛡️ trustPolicy: 'no-downgrade' fails install if trust level of a package decreases with a new version
pnpm@pnpm.io · 9mo agoA new setting, trustPolicy, adds protection against supply-chain attacks. When set to no-downgrade, pnpm will fail installation if a package’s trust level drops — e.g. from a trusted publisher → provenance only → no trust evidence.
Petition in Germany recognizing open source as volunteering for the common good 🤩 Seems like a good step towards recognition and a healthier open source ecosystem www.openpetition.de/petition/onl...
Wow, no more cookie banners in EU? 🤯🚀 Yes please! > some “non-risk” cookies won’t trigger pop-ups at all > central browser controls that apply to websites broadly [for other cookies] www.theverge.com/news/823750/...
Europe is scaling back its landmark privacy and AI laws
The EU folds under Big Tech’s pressure.
theverge.com
Ohh, interesting opportunity to be the Head of the Sovereign Tech Fund in Berlin 👀
Sovereign Tech Agency@sovereign.tech · 9mo agoWir suchen eine neue Leitung für den Sovereign Tech Fund! 🚀 Der #SovereignTechFund ist das Flagship-Programm der Sovereign Tech Agency. Seit 2022 investieren wir in kritische #OpenSource Infrastruktur — von curl bis hin zu Technologien wie DNS, die das Web antreiben — für #digitaleSouveränität. 1/3
Security: Do not install OpenAI Atlas, Perplexity Comet, etc At least until the security implications are more fully understood Multiple security research firms have found vulnerabilities in AI browser architecture, not restricted to only one specific browser brave.com/blog/unseeab...
Unseeable prompt injections in screenshots: more vulnerabilities in Comet and other AI browsers | Brave
AI browsers remain vulnerable to prompt injection attacks via screenshots and hidden content, allowing attackers to exploit users' authenticated sessions.
brave.com
npx-safe by @rafaelgss.dev : Use the Node.js permissions model to make running npx on untrusted packages safer 🔥 github.com/RafaelGSS/do...
![alias npx-safe='function _npx_safe() {
local node_opts="--permission --allow-fs-read=$(npm prefix -g) --allow-fs-read=$(npm config get cache)"
local package=""
local package_args=()
while [[ $# -gt 0 ]]; do
if [[ "$1" == --* ]]; then
# Anything starting with `--` goes into node_opts
node_opts+=" $1"
else
# The first non-`--` argument is the package; the rest are package args
if [[ -z "$package" ]]; then
package="$1"
else
package_args+=("$1")
fi
fi
shift
done
echo "============================="
echo " npx-safe Log "
echo "============================="
echo "Node.js options:"
echo " $node_opts"
echo
echo "Package:"
echo " $package"
echo
if [[ ${#package_args[@]} -gt 0 ]]; then
echo "Arguments:"
for arg in "${package_args[@]}"; do
echo " $arg"
done
echo
fi
echo "============================="
npx --node-options="$node_opts" "$package" "${package_args[@]}"
}; _npx_safe'](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:b3xwbnwkl5qzjjhkwoimvb6x/bafkreif5l4ryqge3ybrwgdrxdv4666pky5cgicxkohru7f3hw3ow7b6rae)
Node.js 25 is here! We have upgraded V8 to 14.1, bringing major JSON.stringify performance improvements and JIT pipeline optimizations. This release introduces the permission model --allow-net, Web Storage is enabled by default, and more! nodejs.org/en/blog/rele...
Node.js
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
Ahh version control conflicts are a great use case for AI - conflicts can be super hairy, so any tools or context that can help with this is 🔥🔥
Visual Studio Code@vscode.dev · 10mo ago🔀 Resolve merge conflicts with AI assistance! When VS Code detects merge conflicts, you can now get AI-powered resolution suggestions through an agentic Chat flow.
A phishing attack is going on against maintainers on @npmjs.bsky.social, be aware! - email is spoofed from npmjs.org (which doesn’t use DMARC but redirects to npmjs.com) - login link points to npnjs(dot)com (clear giveaway)
My request for Dependabot: Full support for @pnpm.io (updates to transitive deps fail currently) Voice support in the issue 🙌 github.com/dependabot/d...
Safari 26 is here!!! Anchor Positioning, Scroll-driven animations, High Dynamic Range images, the new HTML <model> element, the all-new Digital Credentials API, SVG icon support, WebGPU, WebKit in SwiftUI, every site can be a web app on iOS and iPadOS, and much more. webkit.org/blog/17333/w...
WebKit Features in Safari 26.0
We’re happy to share with you what’s arriving in Safari 26.0!
webkit.org
React Advanced meetup coming Toronto 🇨🇦 Any speakers interested: apply to the CFP at the link below 🙌
React Advanced London@reactadvanced.gitnation.org · 11mo agoHey Toronto! This September we’re bringing React Advanced Meetup to your city! 🎉 Right now we’re looking for speakers who’d love to share a project you’re passionate about, a React tip, or any industry insights. 👉Submit your talk via our CFP form https://forms.gle/9NpNHtyRcAixAFmR8 Know
Codemods for Node.js 😍 Looking great, thanks to all contributors!
Augustin Mauroy@augustin-mauroy.bsky.social · 11mo agoWant to find out what the userland migrations initiative has done? Try this little command:
