Long-form notes on debugging, dev tools, and privacy-respecting workflows. Each post links the tools that solve the problem.
Spreading an array into a function call passes every element as a separate argument. Past roughly 125,000 elements Node 26 throws 'Maximum call stack size exceeded', which breaks Math.max, push(...items) and String.fromCharCode-based base64.
Number() and unary plus turn an empty or whitespace-only string into 0, not NaN, so isNaN checks, Zod's coerce.number() and an empty PORT= line all accept blank as zero. Check for empty before converting.
Inside an async function, return fetchUser() in a try block hands the promise back before it settles, so catch never sees the rejection and finally runs before the work is done. return await fixes both, and it is not slower.
Destructuring defaults and default parameters only kick in for undefined. JSON has no undefined, so an API that sends null walks straight past your default and the code runs with null. Read optional fields with ?? or drop nulls where the JSON comes in.
parseFloat reads digits until the first character it does not understand and quietly drops the rest, so a thousands separator cuts the number short with no error. Number() fails loudly instead, and Intl.NumberFormat can tell you which separators a locale uses so you can parse strictly.
An async predicate returns a Promise, and every Promise is truthy, so array.filter(async ...) keeps the whole array. find(), some() and every() break the same way, and TypeScript --strict accepts all four. Resolve the checks first, then filter.
Array.prototype.sort compares UTF-16 code units, so every accented letter lands after z. localeCompare() fixes the accents but uses the runtime's locale, and English collation files ñ under n. Sort Spanish with Intl.Collator('es').
Node.js 26.13.0 "Lithium" became LTS on October 28, 2026. The removals that fail an upgrade from 24 (writeHeader, the _stream_* modules, --experimental-transform-types), the new runtime deprecations, and the libatomic surprise on Linux.
Array.prototype.fill stores the exact value you pass in every slot, so fill([]) or fill({}) puts one shared object in the whole array and a write to one row shows up in all of them. Build each element with Array.from's callback instead.
parseInt converts its argument to a string before parsing, and nonzero numbers smaller than 1e-6 or at least 1e21 in magnitude stringify in exponent notation, so parseInt(0.0000005) returns 5. Use Math.trunc for numbers and a strict check for strings.
Logging an error body with res.text() and then calling res.json() throws TypeError: Body is unusable in Node. A Response body is a one-shot stream: read it once into a variable, or clone the response before the first read.
In JavaScript, 'a:b:c'.split(':', 2) returns ['a', 'b'], not ['a', 'b:c']. The limit caps the output and discards everything after it, which truncates Basic-auth passwords and .env values that contain an equals sign.
Starting every request up front and then reading the results with for await...of looks like concurrency with in-order results. If a later promise rejects before the loop reaches it, Node exits with code 1, and your try/catch never runs.
The default passed to getOrInsert() is an ordinary argument, so it is built before the call and thrown away on every hit — a regression from the get/set code it replaces. getOrInsertComputed() fixes that, with two traps of its own.
createReadStream(path).pipe(res) crashes Node when the file is missing, hangs the client once you add an error listener, and leaves the file open when a client disconnects. pipeline() from node:stream/promises fixes all three, as long as you open the file before you answer.
new URL('users', 'https://api.example.com/v1') resolves to /users, not /v1/users. The base needs a trailing slash, the path must not start with one, and inputs like //host, ../ or %2e%2e can move the result to another host or out of your API prefix.
A string cut through a surrogate pair makes encodeURIComponent throw URIError: URI malformed, while URL, URLSearchParams and TextEncoder quietly turn the same input into U+FFFD. Which one you hit decides whether you get a crash or corrupted data.
Temporal.PlainDate.from() with a property bag, add() and with() all default to overflow: "constrain", so an impossible date silently becomes a different real one. ISO strings and the constructor throw instead.
Node.js 26.10.0 added util.debounce() and util.throttle(). The throttle is a queueing rate limiter with a different signature, both return promises, and cancelling a fire-and-forget call that is still waiting exits the process.
The standard `err.name === "AbortError"` check misses every timeout, because AbortSignal.timeout() aborts with a TimeoutError DOMException instead. A custom abort reason breaks the same check a second way.
Set-Cookie is the one header a fetch Headers object keeps un-combined, so a Map or plain-object round-trip drops all but the last cookie — and get() hands back a string you cannot split on commas.
Decoding a fetch stream chunk by chunk with decoder.decode(chunk) flushes the decoder on every call. A two-byte character straddling a chunk boundary comes back as two replacement characters, and ASCII test data never shows it.
Content-Disposition filename= is effectively ASCII. Put café.csv in it and the browser saves café.csv. The fix is filename*, and the usual encodeURIComponent advice produces a malformed header.
The moment a package ships an "exports" field, every subpath not listed in it stops resolving — including package.json itself. TypeScript will not warn you, because the default moduleResolution ignores exports entirely.
Safari 27 turns safaridriver into an MCP server so a coding agent can drive your browser. The server makes no network calls of its own — but your DOM and screenshots still leave the machine. Setup, the toggle everyone misses, and where the privacy line actually sits.
Node.js moves to one major release a year and every release becomes LTS. Here is what changes for your engines field, your CI matrix and your upgrade planning.
path.join("/srv/uploads", userPath) keeps you inside the folder. path.resolve() with the same arguments does not — an absolute second argument discards the first one entirely, and both calls return a clean-looking path with no ".." to grep for.
Reaching for timingSafeEqual to fix a timing leak gives you a RangeError on attacker-controlled input. The length guard people add to stop the crash puts the leak back. Hash both sides first.
Adding the u flag to a case-insensitive regex switches it to Unicode simple case folding, which pulls the Kelvin sign and the long s into [a-z]. Your ASCII-only validator stops being ASCII-only, and toLowerCase does not agree with it.
Object.freeze locks the own properties of one object and stops there. Nested objects stay mutable, and a frozen Map, Set or Date ignores freeze entirely because their data lives in internal slots, not properties.
Promise.all rejects the moment one input rejects. It does not cancel the rest — they run to completion after your catch block has already returned, and a second failure is swallowed without a trace.
A return, break or continue in a finally block replaces whatever the try block was doing, including a thrown error. The function succeeds, the error vanishes, and nothing logs it.
Setting DEBUG=false does not turn the flag off — process.env holds strings, and the string "false" is truthy. The same coercion turns an assignment of undefined into the string "undefined", which is also truthy.
The Fetch standard gives fetch() no timeout option, so a server that accepts your connection and goes quiet keeps the promise pending. Node only backstops it with undici transport timeouts that default to 300 seconds.
sort((a, b) => a > b) looks like a comparator but returns a boolean, so it never returns a negative number. In V8 the array comes back untouched — and an already-sorted test fixture hides it.
An async callback passed to forEach returns a promise that forEach throws away. The loop finishes instantly, the work is still running, and errors inside it become unhandled rejections instead of failures you can catch.
Node has been able to read HTTP_PROXY since v24, but only when NODE_USE_ENV_PROXY is set. Without it, fetch and http.request go straight to the host and the failure blames the host, not the missing proxy.
JavaScript reports UTC-6 as +360, not -360, because the method measures UTC minus local. Add it where you meant to subtract and you are off by twice the offset.
Array holes are not undefined. map, forEach, filter and reduce skip them silently, while spread, for...of and JSON.stringify materialise them as undefined — so the same array gives you two different answers depending on which method you reach for.
Node kills the process before pending stdout writes flush. Your CLI prints every line in a terminal and silently loses some in CI, because pipes are asynchronous on Linux and macOS and terminals are asynchronous on Windows.
setTimeout stores its delay in a signed 32-bit integer. Anything over 2147483647 ms overflows, and your "run this in 30 days" timer runs right now — or at some arbitrary wrong time.
Serialising a Map or a Set with JSON.stringify gives you an empty object — no error, no warning, exit code 0. Why it happens, what else silently disappears, and the two fixes that survive a round trip.
Intl.NumberFormat with currencyDisplay narrowSymbol renders USD, MXN, CAD and ARS all as "$1,439.00" in es-MX. The default symbol setting disambiguates them on purpose — here is why, and how to check any locale/currency pair yourself.
RegExp.prototype.test on a global or sticky regex advances lastIndex, so a shared regex silently skips half the strings you check. Why the state exists, and the four ways out.
String.replace() treats $&, $`, $' and $1 in the replacement as commands, not text. User data or a price string in that slot corrupts the output with no error.
Dropping dotenv for the built-in --env-file flag changes one thing that matters in production: a missing file is now a fatal startup error, not a warning. Plus the three parsing traps both share.
JavaScript objects keep string keys in insertion order — except keys that look like array indices, which are sorted numerically and moved to the front. Why an id-keyed object reorders itself, and what to use instead.
Grouping with Object.groupBy gives you an object with no prototype, so hasOwnProperty throws, template literals throw, and `toString` in result is false. Why the spec does that, and what to call instead.
The modern deep-copy API throws DataCloneError on functions and silently turns class instances into plain objects. What it clones, what it refuses, and when JSON round-tripping is still wrong.
Node 22.18+ executes .ts files with no build step, but enums, namespaces, parameter properties and extensionless imports still throw. What type stripping actually does.
The fetch promise only rejects on network failure. A 404 or 500 is a successful fetch, so error handling built around try/catch silently treats failures as data.
Most of Mexico has been on a fixed UTC-6 since October 2022, but two border zones still follow US DST. Stale tzdata and hardcoded offsets turn that into a silent one-hour error every summer.
Your app works on localhost and throws crypto.randomUUID is not a function when you open it on your phone at http://192.168.1.20:5173. randomUUID is secure-context only, and a private LAN IP over http is not a secure context.
npm v12 blocks dependency lifecycle scripts, git dependencies and remote tarballs by default. What breaks, how to read the skipped list, and how to write an allowlist you can commit.
The same JSON file parses over HTTP and throws when read from disk. The three invisible bytes at the front, why one path strips them and the other does not, and the one-line fix.
A family emoji is one character to a user, seven code points to a spread, and eleven to .length. Counters, limits and truncation all disagree unless you count graphemes.
A date-only string parses as UTC, the same string with a time parses as local, and the difference is a whole calendar day west of Greenwich. Why the off-by-one happens and what to use instead.
The same JavaScript number formatted two ways gives 1.00 and 1.01. toFixed rounds the exact binary value; Intl.NumberFormat rounds the printed decimal. Pick one deliberately, especially for money.
YAML 1.1 parsers turn no, off and yes into booleans, so a country code becomes false and an "on:" key becomes true. Which parser you use decides whether your config survives.
DMARCbis shipped in May 2026 as RFC 9989, 9990 and 9991, obsoleting RFC 7489. Most of your record survives — but pct, rf and ri are gone, and the Organizational Domain is now found by a DNS tree walk instead of the Public Suffix List.
Redirect a POST with 301, 302 or 303 and clients are allowed to drop the method and the body. The request still returns 200, so the bug looks like the server ignoring your payload.
The same + is a literal in a URL path and a space in a query string. That split silently corrupts base64, signatures, and any value you pasted straight into a URL.
A 19-digit ID goes into JSON.parse and a different 19-digit ID comes out. No error, no warning. Why it happens, how to detect it, and the three ways to fix it.
The same accented word has more than one legal encoding. If one comes from a macOS filename and the other from a form field, equality checks, uniqueness constraints and search all quietly break.
Backtracking engines can take exponential time on inputs a few dozen characters long. Here is how to spot the shape that does it, and what each language actually gives you to stop it.
no-cache stores the response and revalidates it. no-store is the one that refuses to write anything down. Getting them backwards either leaks private data into a shared cache or throws away every conditional request you could have had.
SVG is XML that can carry <script> and onload. If your users upload avatars or logos and you serve them from your own origin, you are hosting stored XSS. Here is what actually stops it and what only looks like it does.
A cell that starts with =, +, -, @, tab, or carriage return is a formula, not text. If your export contains user-supplied strings, someone else opens your CSV and runs their code. Here is the fix and why the obvious one is wrong.
OpenAI cut its cheapest GPT-5.6 tier by 80% on July 30. Your bill will not drop 80%, because output tokens cost 6x input and retries and resent context are billed in full. Here is the arithmetic that actually predicts your invoice.
A single as unknown as turned a working library call into a feature that failed on every input — and typecheck, unit tests and the build all stayed green. Here is why the double cast disables the one guardrail that would have caught it, and what to write instead.
Introspection lets any client download your entire schema — every type, field, argument, and deprecation note — with one query. Great in development, a reconnaissance gift in production. What __schema returns, how it is abused, and the right way to lock it down.
A .har export from your browser Network panel captures every request and response — Authorization headers, session cookies, CSRF tokens, full request bodies. Here is what is inside, why support keeps asking for one, and how to redact it safely.
The three base64url segments of a JWT are readable by anyone — decoding tells you what a token claims, not whether the claim is true. The structure, the decode-versus-verify gap, and the alg:none and RS256-to-HS256 attacks that turn that gap into account takeover.
The Unix epoch is simple until it is not. Milliseconds versus seconds, signed 32-bit overflow in 2038, leap-second smearing, and timezone assumptions cause real production bugs. The field guide with the conversions that actually matter.
Base64 is a reversible text encoding with no key. Anyone can decode it in one line. Here is why it keeps getting mistaken for protection — in Basic Auth, JWTs, and Kubernetes Secrets — and what each of those actually relies on.
PDFs carry an Info dictionary and an XMP stream that record author name, the exact software and version that made the file, timestamps, and sometimes earlier revisions. Here is what is in there and how to remove it without uploading the file anywhere.
Random UUID v4 primary keys scatter inserts across a B-tree, causing page splits and cache churn. UUID v7 is time-ordered and inserts append to the right edge. Here is the mechanism, per database engine.
A practical look at ffmpeg compiled to WebAssembly — what video work it does well in a browser tab, where it stalls, the COOP/COEP headers it needs to run multithreaded, and the size cost of shipping a video editor with no backend.
iPhones record 4K HEVC at 16:9 by default. YouTube Shorts wants 9:16 vertical MP4 under 60 seconds. The mismatch causes silent upload failures, letterboxed playback, and quality loss. Here is the conversion in two browser-only steps, with no upload to a third-party service.
A 4-word EFF diceware passphrase has more entropy than a 12-character random password and is dramatically easier to remember. NIST has recommended length over complexity since 2017. Here is the math, the standards, and why memorable-sentence generators are the right default in 2026.
Sunday is 0 in POSIX cron, 1 in Quartz, and 1 in AWS EventBridge — and the difference silently shifts your job by a day. A field-by-field guide to the four dialects you will actually encounter, with a side-by-side comparison and the conversion rules.
Decoding the most common JSON.parse error in JavaScript: how to find the byte offset, what each variant of the message means in Chrome / Firefox / Safari, and the five mistakes that trigger it.
A fast browser-only workflow for syntax-checking a YAML manifest, converting it to JSON for tooling that does not speak YAML, and avoiding the silent type coercions that bite production deploys.
