Node.js
Browse all articles, tutorials, and guides about Node.js
Posts
How Stripe Avoids Double-Charging Anyone
A payment request times out. Did the charge happen? Stripe answers that question with idempotency keys, and the design behind them is more than a cache of responses: locked key rows, recovery points, and a rule about which calls can be retried. Here is the design, a working Postgres implementation, the run where our own version double-created rides, and the constraint that caught it.
Stop Building Webhook Retries Yourself
We pointed a webhook sender at a receiver built to fail the common ways production fails: outages, 429s, timeouts, dead endpoints, bad signatures. Then we watched the retries, the schedule, the signature checks, and the replay happen without writing any of it. Here is the run, with the code and the attempt logs.
Running a Background Job That Must Not Be Lost
A queue gets your job to a worker, not to the finish line. What happens when the worker dies halfway, and a durable executor in 90 lines of TypeScript.
What It Actually Takes to Deliver a Webhook in Production
Sending a webhook is one HTTP POST. Delivering one is a retry schedule, a signature scheme, an idempotency story, and a way to answer "did you get it?" six hours later. Here is the whole problem, and a working Node implementation of both sides.
npm v12 Will Stop Running Install Scripts. We Audited Our Repos to See What Actually Breaks
Starting with npm v12 (estimated July 2026), dependency install scripts will not run unless you allowlist them. We ran the new audit tooling on our own production repos: 65 packages flagged, 4 that matter, and a surprising amount of nothing breaking.
node-postgres Silently Ignores Your TLS Config When the URL Says sslmode
If your connection string contains sslmode=require, the pg library throws away the ssl options object where you loaded your CA certificate, and verification fails with "self-signed certificate in certificate chain". Here is the trap, the fix, and the v9 changes coming.
CVE-2025-55182 React2Shell: 766 Next.js Hosts Breached in 24 Hours
A CVSS 10.0 RCE in React Server Components let attackers breach 766 Next.js hosts in a single day, stealing database credentials, SSH keys, and cloud secrets. Here is how it works, who is affected, and what to do right now.
The Axios Supply Chain Attack: What DevOps Teams Need to Know
A compromised npm maintainer account led to malicious axios versions deploying a RAT across macOS, Windows, and Linux. Here is what happened, how to check if you are affected, and how to prevent this in your pipeline.