Adding an npm dependency isn't just installing code — it's taking on its maintenance, its attack surface, and its transitive deps. Here's the checklist I run before adding any package to a serious TypeScript project.
pnpm workspaces is the best option for TypeScript monorepos in 2026. But the happy path in the docs hides three traps that only show up in CI with real deployments: phantom dependencies, broken hoisting on Railway, and script filtering that doesn't filter what you think it does.
Before you install any rate limiting middleware in Next.js, you need to define what asset you're protecting, what abuse you're expecting, and what a false positive actually costs you. The library is the last decision. The policy is the first.
I write about architecture, real systems, product decisions, and technical lessons reviewed with professional judgment.
No spam. Unsubscribe anytime.