RENOVATE_SCHEDULE loses to repo config; RENOVATE_FORCE wins
Self-hosted Renovate parses RENOVATE_* env vars for almost every option, but repository config is merged over env values; only the bot-admin force object overrides the merged result.
Blog
10⁻¹X Engineer stuff.
Daily runs, weekly batches: splitting Renovate's trigger from its policy on self-hosted GitLab
A single daily GitLab schedule keeps Renovate's vulnerability detection fast while a repository-level schedule window collapses routine dependency churn into one weekly review batch.
A Deploy Script Was Silently Rolling Back Our Let's Encrypt Renewals
An unconditional S3 snapshot restore on every deploy rolled back Let's Encrypt renewals until an expired certificate wedged CertMagic at boot.
Antigravity CLI discovers global skills in ~/.gemini/config/skills, not ~/.gemini/skills
Antigravity CLI's TUI displays global and shared skill paths that the engine ignores, but linking ~/.agents/skills into ~/.gemini/config/skills makes them machine-wide.
Next.js 16.3 writes CLAUDE.md unless you commit AGENTS.md
Next.js auto-generates agent files when it detects an AI agent, but a committed AGENTS.md with its managed block stops CLAUDE.md from ever being scaffolded.
Renewing Proton Pass CLI PAT Sessions with macOS Keychain
Proton Pass PAT sessions expire after two hours, but a scoped PAT in the macOS login Keychain can renew them without exposing it in shell history.
Where to put git worktrees when you have many repos
Comparing three git worktree layouts for many local repos, and why I settled on ~/worktrees/<repo>/<slug>.
How I split a shared Bash and Zsh configuration without changing startup behavior
I reorganized a shared shell configuration into XDG-aligned domain modules while preserving startup order, behavior, and warm-shell performance.
Building an fzf Git worktree switcher for Bash and Zsh
I built a shell-native Git worktree selector with safe removal, optional pull-request previews, and behavior shared by Bash and Zsh.
Check pnpm view and advisory ranges before forcing a security override
Two commands, `pnpm view <pkg> dist-tags` and a GitHub advisory's affected ranges, show whether a security fix is backported to the major your consumers use, so an override stays patch-level instead of forcing a major bump.
Why pnpm audit --fix=update kept a vulnerable nanoid behind an auto-installed peer
A pnpm peer-resolution path dropped the update depth, retained nanoid 3.3.16, and made a full lockfile and node_modules refresh the clean no-override fix.
How pnpm deploy --legacy left dangling workspace symlinks in our Docker image
Starting with pnpm 11.19 in our build, `pnpm deploy --legacy` left workspace dependencies linked to source directories that the runtime image did not contain.
Why Kitty's SSH kitten fails in multi-client zmx sessions
zmx preserves one Kitty window ID and broadcasts the SSH kitten handshake to every attached client, causing rejected or interleaved responses.
Dagger in a GitLab CI pipeline: assessment
I evaluated Dagger against a monorepo running 2,000 CI jobs a month, separating pipeline changes from the runner, cache, and hardware constraints that remain.
PMD's ExceptionAsFlowControl flagged a throw that was never caught
A PMD violation appeared on a clean checkout because the pmd task lacked compiled classes for type resolution. The review also exposed an HTTP contract change behind a passing gate.