A client's internal utility package started as a convenience. Two years later, it had 47 dependents, undocumented side effects, and a change to one date formatter broke invoice generation for three services.
- Published On
dependencies
- The Axios supply chain attack reminded me of a dependency audit I ran at a client last year. What I found was worse than any vulnerability scanner could flag.
- Published On
Tags
consulting (70)architecture (28)debugging (28)developer-experience (22)reliability (20)devops (14)ai (11)performance (10)observability (8)code-quality (7)technical-debt (6)database (6)engineering-culture (5)microservices (5)security (5)testing (4)productivity (4)kubernetes (4)postgres (4)ci-cd (3)databases (3)postgresql (3)infrastructure (3)tooling (3)refactoring (2)configuration (2)resilience (2)cost-optimization (2)dependencies (2)nodejs (2)code-review (2)deployment (2)opentelemetry (2)monitoring (2)javascript (2)goals (2)data (1)websockets (1)project-management (1)mcp (1)finops (1)multi-tenant (1)authorization (1)terraform (1)dns (1)opinion (1)api-design (1)memory (1)error-handling (1)secrets-management (1)webhooks (1)containers (1)environments (1)queues (1)cloud (1)orm (1)on-call (1)alerting (1)incident-management (1)typescript (1)distributed-systems (1)caching (1)platform-engineering (1)feature-flags (1)api (1)contracts (1)logging (1)mongodb (1)migration (1)workflow (1)nestjs (1)angular (1)sandbox (1)sonarcube (1)learning (1)journey (1)mdx (1)