标签：#X

Managing payload cms lexical tables in a content-heavy site means enabling EXPERIMENTAL_TableFeature — but the real trap is the markdown import that strips tables without warning. We lost a whole batch of production blog posts to this exact hole before we found the fix. Here’s why it happens and the step-by-step configuration that keeps your tables intact. The Silent Table Eater: Payload CMS Lexical Tables and Markdown Conversion The default markdown-to-Lexical conversion helper completely ignores your editor’s feature list. So even when you’ve added the table feature to your editor config, every GFM table in imported markdown is silently dropped. Here’s the code that ate our data: import { editorConfigFactory , defaultFeatures } from ' @payloadcms/richtext-lexical ' // ❌ This uses a plain config that doesn’t know about tables const mdConverter = editorConfigFactory . default ({ features : defaultFeatures , }) const lexicalData = mdConverter . parse ( ' # Hello \n\n | A | B | \n |---|---| \n | 1 | 2 | ' ) // result: { root: … } — no table node anywhere The problem: editorConfigFactory.default builds a conversion pipeline from a static feature set, not from your actual editor config. Any experimental or custom feature you’ve wired into the editor simply isn’t there during markdown parsing. Fix It: Wire EXPERIMENTAL_TableFeature Into the Conversion Config Switch to editorConfigFactory.fromFeatures , which actually reads the feature array you provide. Include the table feature alongside the defaults, and the markdown converter will start producing proper Lexical table nodes. import { editorConfigFactory , defaultFeatures , EXPERIMENTAL_TableFeature , } from ' @payloadcms/richtext-lexical ' const mdConverter = editorConfigFactory . fromFeatures ({ features : [... defaultFeatures , EXPERIMENTAL_TableFeature ()], }) Takeaway: You must add EXPERIMENTAL_TableFeature() to both your editor’s features array and to every markdown conversion config. Missing one side silently eat

When you wire up a payload cms live preview , you’re not just plumbing a URL—you’re building a contract between the admin panel and your Next.js App Router. The goal is keystrokes-ago fidelity: editors click Preview, land on your front end, and see exactly what’s in the draft, even when the public site is cached to the hilt. Our implementation at techpotions settled on one preview route, one shared secret, and one shared URL builder. Here’s every decision that made it work. One /next/preview route for the entire site The admin panel’s preview button doesn’t need to know about your page structure. It calls a single /next/preview route with a secret query param and a slug search param that points to the document being previewed. // app/(payload)/next/preview/route.ts import { draftMode } from ' next/headers ' import { redirect } from ' next/navigation ' export async function GET ( request : Request ) { const { searchParams } = new URL ( request . url ) const secret = searchParams . get ( ' secret ' ) const slug = searchParams . get ( ' slug ' ) if ( secret !== process . env . PREVIEW_SECRET ) { return new Response ( ' Invalid token ' , { status : 401 }) } const draft = await draftMode () draft . enable () redirect ( slug ?? ' / ' ) } That’s the entire route. No collection-specific logic, no second-guessing which page type is involved. The redirect lands on the actual page, which reads draftMode().isEnabled and fetches accordingly. This is the pattern the Payload CMS preview documentation expects: a function that resolves to a string with additional URL parameters pointing to your app. The preview-URL builder lives in one shared lib Here’s where most implementations drift apart. The admin config, the preview route, and each page component all need to agree on how a preview URL is constructed. Store that logic in one place—a single getPreviewUrl utility imported everywhere—or you’ll be chasing 404s in production when someone renames a collection slug. // lib/getPreviewU

Gritt is coming out of stealth with $34 million and plan to automate the hardest tasks on construction sites.

I’m 14 and I got tired of spending hours (sometimes days) setting up new machines. Different distros, different package managers, fragile shell scripts, no rollback. So I built Nexus — a cross-platform environment provisioning engine. One command turns a fresh OS into a fully productive development machine. The Problem Setting up a dev machine is painful: Hundreds of Linux distros with different package managers (apt, pacman, dnf, apk). Shell scripts break easily with no rollback or state management. Tools like Ansible are overkill for laptops. Docker doesn’t configure your host. Dotfile managers don’t install dependencies. Result: Developers lose dozens of hours per year on setup issues. What Nexus Does One static Go binary. Detects your OS, chooses the right package manager, applies declarative YAML profiles, and handles everything with security gates and rollback. No scripts. No manual steps. Works on Linux and Windows (with WSL2 support). Standout Features Cross-distro support — apt, pacman, dnf, apk behind one interface. 7-step orchestrator with rollback — PreFlight → Refresh → Execute → Verify → Audit. Failed foundation packages trigger full rollback. Security gate (SanitizeAndExecute) — Allowlist, metacharacter rejection, timeouts. No raw shell execution. 10 built-in profiles — Go dev, Rust dev, Frontend, Data Science, Ethical Hacking, etc. WSL2 setup in ~60 seconds on Windows. Dotfiles + age-encrypted vault + Distrobox containers . Community profile registry . Optional Tauri GUI dashboard. Architecture Nexus is organized in bounded contexts: BRAIN — Cobra CLI + core engine (Go) DNA — YAML profiles with JSON Schema + struct validation + SHA256 integrity BRIDGE — WSL2 handling (cross-compiled) CONTAINER — Distrobox management VAULT — age encryption REGISTRY — Community profiles Every command goes through a strict security gate. State is crash-safe with atomic writes and append-only logs. Quick Start # Install go install github.com/Sumama-Jameel/nexus-engine/cm

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. I originally...

The de-extinction startup is looking to double or triple its previous valuation, according to the report.

The one-year-old startup aims to reinvent financial architecture for autonomous AI transactions.

Online retailer AliExpress says it's shocked by largest DSA fine yet.

Cursor's "Sand" project targets non-developers. Anthropic's Claude Cowork runs cross-device. OpenAI's ChatGPT Work delivers documents, spreadsheets, and presentations. When an agent produces a deliverable for someone who cannot read the code, the verification interface matters more than the output format. A download button is not verification. The problem When a developer reviews agent output, they can read the diff, run the tests, and check the types. When a non-developer receives an agent-produced spreadsheet or document, they have no equivalent verification path. They either trust it completely or reject it completely. Neither is useful. What a verification UI needs Element Purpose Implementation Source list Show what inputs the agent used Links to source documents with timestamps Confidence indicator Flag low-confidence outputs Per-section confidence derived from source coverage Change highlights Show what the agent generated vs. copied Diff view between source and output Audit trail Record who requested what and when Append-only log with request ID, timestamp, and result hash Rejection path Let the user say "this is wrong" without starting over Feedback record linked to specific output section A minimal verification component <!-- agent-output-verification.html --> <!DOCTYPE html> <html lang= "en" > <head> <meta charset= "UTF-8" > <title> Agent Output Verification </title> <style> .verification-card { border : 1px solid #ddd ; border-radius : 8px ; padding : 16px ; margin : 8px 0 ; font-family : system-ui , sans-serif ; } .source-list { list-style : none ; padding : 0 ; } .source-list li { padding : 4px 0 ; border-bottom : 1px solid #eee ; } .confidence-low { color : #c0392b ; font-weight : bold ; } .confidence-medium { color : #e67e22 ; } .confidence-high { color : #27ae60 ; } .reject-btn { background : #fff ; border : 1px solid #c0392b ; color : #c0392b ; padding : 4px 12px ; border-radius : 4px ; cursor : pointer ; } .reject-btn :hover { background : #c0392b

Part 2 of the Building create-notils series. In my previous article , I explained why I stopped copy-pasting repositories and started building my own project scaffolding tool. However, one major architectural problem remained: I wanted create-notils to support both of these primary project structures. A standalone Next.js application: my-app/ ├── src/ ├── public/ ├── package.json └── components.json And a Turborepo monorepo: my-app/ ├── apps/ │ └── app/ ├── packages/ │ ├── ui/ │ └── config/ ├── turbo.json └── package.json At first glance, the obvious solution is to maintain two separate templates—one for standalone and one for monorepo. Problem solved, right? Except... it isn't. The Hidden Cost of Multiple Templates Every starter template starts out identical. Then one day, you fix a subtle bug in one template and forget to update the other. A week later, you upgrade Next.js in one repository before getting around to the second. A month later, you improve your UI package and find yourself manually copying files back and forth between folders. Eventually, the templates slowly drift apart. The true cost isn't creating templates; the cost is maintaining them forever. What Actually Changes? When I sat down and compared the two project layouts side by side, surprisingly little was different. The actual application code, UI components, theming, and utility functions were 100% identical. The only real differences were the structural project boundaries: Concern Monorepo Standalone UI Package packages/ui src/components/ui Utilities @notils/ui/lib/utils @/lib/utils Configuration Shared workspace package Local configuration Package Manifests Multiple ( package.json files) Single root manifest Workspace Tooling Present ( turbo.json , workspaces) Removed entirely Everything else was effectively the exact same code. That single observation changed the entire architecture of create-notils . A Different Approach: The Canonical Source of Truth Instead of maintaining two templates, I

An accessible combobox can follow the correct ARIA pattern and still become unusable when two search responses arrive in the wrong order. Reproduce this sequence: Type ca , then quickly type cat . The cat response arrives first and highlights cat facts . The slower ca response arrives and replaces the list. aria-activedescendant now points to an option that no longer exists. IME input adds another boundary: searching during composition can send partial text the user has not committed. I would model the request generation explicitly: let generation = 0 ; let composing = false ; async function search ( query : string ) { const mine = ++ generation ; const options = await fetchOptions ( query ); if ( mine !== generation || composing ) return ; render ( options ); restoreActiveOptionByKey (); } The stable key matters. An array index cannot preserve the active option when ranking changes. Regression matrix Input Injected failure Expected evidence ca → cat first request delayed only cat results render Arrow Down result refresh active key survives or resets visibly Escape response arrives afterward popup stays closed IME composition network is fast no request until compositionend A Playwright test should assert focus remains on the input, every aria-activedescendant resolves to a live element, and Escape invalidates outstanding generations. A manual screen-reader pass should confirm result-count announcements are not emitted for discarded responses. The WAI-ARIA Authoring Practices combobox pattern defines the keyboard contract. The missing production step is testing that contract under asynchronous replacement, not only against static example data. Which stale-response failure has been hardest to reproduce in your search UI?

Netflix revealed that it paid $587 million in cash for InterPositive, a startup co-founded by Ben Affleck.

Web Accessibility for Startups: 5 Small Wins That Scale Palak jain Palak jain Palak jain Follow Oct 7 '25 Web Accessibility for Startups: 5 Small Wins That Scale # webaccessibility # webdev # frontend # startup 21 reactions 4 comments 4 min read

Some commands you can walk back. Terminating an EC2 instance is not one of them. Day 14 paired a recoverable problem, a web server knocked over by a rogue process, with an unrecoverable one, deleting a server on purpose, and the contrast is the whole lesson. One Linux task, one AWS task. Track down the process blocking Apache and restore the service, then terminate an EC2 instance and confirm it is gone. The tasks come from the KodeKloud Engineer platform. httpd: diagnose in order, then restore When httpd will not start, resist the urge to guess. Work in order. Start with what the service itself reports: # What does httpd think is wrong systemctl status httpd systemctl start httpd The status output usually names the problem, and a failed bind on the port is the classic one. Before assuming a rogue process, check that httpd's own config is sane, because a wrong port or hostname produces the same "won't start" symptom: # Check the configured listen port and server name grep -i listen /etc/httpd/conf/httpd.conf vi /etc/httpd/conf/httpd.conf # Fix the ServerName directive if it is wrong: ServerName hostname:<port> If the config is fine and the port is genuinely taken, then you go hunting for the process holding it: # Find the PID on the conflicting port sudo su - yum install -y net-tools netstat -tulpn # Clear it, then bring httpd back kill -9 <PID> systemctl enable httpd systemctl start httpd systemctl status httpd kill -9 is SIGKILL, the instant, no-cleanup kill. It is the right tool when a process is wedged and ignoring a polite request, but as a default habit, it is worth trying a plain kill first. The order that matters here is diagnostic: config before process, gentle signal before forceful one. Rushing to kill -9 at the first sign of trouble is how you mask the real cause instead of fixing it. Terminating EC2: the command with no undo Day 9 was about protecting an instance from termination. Day 14 is the other side of that lever, actually terminating one, on purp

GenPage is a generative AI system developed by Netflix to replace its traditional multi-stage recommendation pipeline by directly generating personalized user homepages. GenPage leverages user history and request context as a prompt to produce the entire page, resulting in improved user engagement and reduced serving latency. By Sergio De Simone

To learn how to analyze an error, we are going to use the error below as an example: nx run mobile : android ✔ 7 / 7 dependent project tasks succeeded [ 6 read from cache ] Hint : you can run the command with -- verbose to see the full dependent project outputs ————————————————————————————————————————————————————————————————————————————————————————————————————————————————————————————————— > nx run mobile : android > npx expo run : android › Opening emulator Medium_Phone › Building app ... Starting a Gradle Daemon ( subsequent builds will be faster ) Configuration on demand is an incubating feature . > Configure project : [ ExpoRootProject ] Using the following versions : - buildTools : 36.0 . 0 - minSdk : 24 - compileSdk : 36 - targetSdk : 36 - ndk : 27.1 . 12297006 - kotlin : 2.1 . 20 - ksp : 2.1 . 20 - 2.0 . 1 > Configure project : app ℹ️ Applying gradle plugin ' expo-max-sdk-override-plugin ' [ expo - max - sdk - override - plugin ] This plugin will find all permissions declared with `android:maxSdkVersion` . If there exists a declaration with the `android:maxSdkVer sion` annotation and another one without , the plugin will remove the annotation from the final merged manifest . In order to see a log with the changes run a clean build of the app . ℹ️ Applying gradle plugin ' expo-dev-launcher-gradle-plugin ' > Configure project : react - native - firebase_app : react - native - firebase_app package . json found at / home / user / projects / my - app / node_modules / @ react - native - firebase / app / package . json : react - native - firebase_app : firebase . bom using default value : 34.10 . 0 dencies of : app : debugRuntimeClasspath > : react - native - firebas : react - native - firebase_app : play . play - services - auth using default value : 21.5 . 0 : react - native - firebase_app package . json found at / home / user / projects / my - app / node_modules / @ react - native - firebase / app / package . json : react - native - firebase_app : version set from

You've got a Next.js app on one domain and your API on another. The login works, the dashboard fills up, everything looks fine. Then one day you open the Network tab and there it is: your access token, in plain text, in a request header the browser sent all by itself. At that point every line of JavaScript on the page can read it. Not just your code. The analytics snippet you added last week, the twelve transitive dependencies you've never opened, whatever an XSS bug manages to slip in. And you never really decided this. It just happened, because calling the API straight from the component was the path of least resistance, and nothing complained. The browser is not a trusted client The version that gets you here looks completely reasonable: // ❌ a Client Component talking to your API ' use client ' ; export function Profile () { useEffect (() => { fetch ( ' https://api.example.com/me ' , { headers : { authorization : `Bearer ${ token } ` }, }) . then (( r ) => r . json ()) . then ( setProfile ); }, []); } Look at what that actually signed you up for. The token is in JavaScript, so the protection an HttpOnly cookie would have given you is simply gone. The call is cross-origin, so you're now on the hook for CORS: preflight requests, an allowed-origins list to maintain, Access-Control-Allow-Credentials , and the quiet worry that you've opened it wider than you should. And because the request leaves from the browser, anyone with devtools can read your API's base URL, its routes, and how it expects to be authenticated. That's a decent map of your backend, handed out to every visitor. What makes this hard to catch is that none of it breaks. It works in the demo, it works in production, it reviews clean. It just sits there as a liability until the day it stops being quiet. The browser talks to your server. Your server talks to your API. The Backend-for-Frontend pattern draws one line: the browser only ever talks to your Next.js server. The Next.js server talks to your API.

Over the weekend, I participated in the OpenAI Build Week Hackathon with a simple goal: Build something I would actually use as a developer. By Friday evening, I had an idea. By Sunday, that idea became an open source project called Arcovia . It wasn't just another AI coding experiment. I wanted to solve a problem I've faced while working on large React applications for years. The Problem We have excellent tools for code quality. ESLint catches code smells. Prettier formats code. SonarQube reports issues. AI reviews code and suggests improvements. But none of them answer questions like: Is my architecture healthy? Which modules are becoming bottlenecks? Where is technical debt accumulating? Which files should I refactor first? Why did my project receive this score? Architecture is often something we discuss during code reviews or realize too late when the codebase becomes difficult to maintain. I wanted a tool that could measure architecture health before it became a problem. Introducing Arcovia Arcovia is an Architecture Intelligence tool for React and Next.js projects. Instead of generating hundreds of isolated warnings, it analyzes the project as a whole and produces an interactive HTML report. It includes: 📊 Architecture Health Score 🕸️ Dependency Graph 🎯 Architecture Hotspots 📈 Explainable Score Breakdown 🛠️ Rule-based Findings 📉 Maintenance Burden ✅ Actionable Recommendations The goal isn't to replace linting. The goal is to help developers understand the bigger picture. How It Works Internally, Arcovia follows a deterministic analysis pipeline. Project │ ▼ Scanner │ ▼ AST Parser │ ▼ Project Model │ ▼ Dependency Graph │ ▼ Rule Engine │ ▼ Score Engine │ ▼ Interactive HTML Report The analyzer currently detects things like: God Modules High Fan-In High Fan-Out Orphan Modules Large Components Deep JSX Nesting Oversized Modules Duplicate Imports Unused Exports Instead of simply reporting findings, Arcovia combines them into an explainable architecture score. Determ

Introduction Linux is the backbone of modern infrastructure. From cloud servers and firewalls to SIEM platforms and security tools, Linux runs silently behind most enterprise environments. For a Security Operations Center (SOC) analyst, understanding Linux is not optional — it is a core skill. One of the most critical security mechanisms in Linux is its file permission and ownership model. Attackers abuse permissions to execute malware, hide persistence, escalate privileges, and erase evidence. SOC analysts rely on permission analysis to detect anomalies, investigate incidents, and build accurate timelines. Become a Medium member This article covers Linux File Permissions and Ownership in deep detail from a SOC analyst’s perspective. It is designed to take you from absolute beginner to security-aware professional, with real-world examples, attack scenarios, and investigation insights. Why Linux File Permissions Matter in SOC In SOC operations, analysts constantly deal with: Authentication logs System logs Application logs Scripts and binaries Configuration files Evidence files during incident response Every one of these objects is protected by Linux permissions. From a SOC perspective: Incorrect permissions = security risk Permission changes = potential indicator of compromise Executable permissions = possible malware Ownership changes = possible log tampering Understanding permissions allows SOC analysts to: Detect unauthorized access Identify privilege escalation Spot malware execution Preserve forensic evidence Reconstruct attacker activity Understanding Linux File Permission Basics Linux follows a Discretionary Access Control (DAC) model. This means: The owner of a file controls who can access it Permissions define what actions are allowed Every file and directory in Linux has: A type Permissions An owner (user) A group These attributes decide: Who can read the file Who can modify it Who can execute it Viewing Permissions Using ls -l The most common command to i

The Great Migration: Moving Beyond the SPA If you have been building in the React ecosystem recently, you've likely started with Vite. It’s fast, the Developer Experience (DX) is unparalleled, and it just works. However, as projects scale, the requirements often evolve. You suddenly need better SEO, faster First Contentful Paint (FCP), or sophisticated server-side logic without managing a separate backend. This is usually when the conversation turns to Next.js. While the migration seems straightforward on paper—it's all just React, right?—the reality involves a fundamental shift in how you think about routing, data fetching, and the browser lifecycle. Here is everything I wish I knew before I made the jump from Vite to Next.js. 1. Routing: From Configuration to Convention In a Vite project, you probably used react-router-dom . You defined a <Routes> component, listed your paths, and mapped them to components. It was explicit and centralized. Next.js (specifically the App Router) uses file-system routing. Every folder in your app directory represents a route segment. The Shift in Thinking Vite: You decide where files live; the router links them. Next.js: The folder structure is the URL structure. You will spend your first few hours moving About.tsx to about/page.tsx . It feels tedious at first, but it eliminates a massive category of "broken link" bugs and makes code-splitting automatic. 2. The "use client" Directive This is perhaps the biggest stumbling block for Vite developers. In Vite, every component is a client component—it runs in the browser. In Next.js, components are Server Components by default. If you try to use useState , useEffect , or browser APIs like window or localStorage in a default Next.js component, your build will crash. You must add the 'use client' directive at the top of the file. Pro-Tip: Don't just add 'use client' to everything. The goal is to keep as much logic as possible on the server to reduce the JavaScript bundle sent to the client.