Adding an npm dependency isn't just installing code — it's taking on its maintenance, its attack surface, and its transitive deps. Here's the checklist I run before adding any package to a serious TypeScript project.
pnpm workspaces is the best option for TypeScript monorepos in 2026. But the happy path in the docs hides three traps that only show up in CI with real deployments: phantom dependencies, broken hoisting on Railway, and script filtering that doesn't filter what you think it does.
Before you install any rate limiting middleware in Next.js, you need to define what asset you're protecting, what abuse you're expecting, and what a false positive actually costs you. The library is the last decision. The policy is the first.
32 years in the dev trenches. Here I write what I learned, what I broke, and what nobody tells you in the tutorials.
No spam. Unsubscribe anytime.