Tech watch

Skullet automates loading states without hand-drawn placeholders: the npm package renders invisible sample data, measures the elements, then draws skeletons in their shape to avoid layout shift.

The demo shows several interfaces, from metrics to notifications, and also raises the question of server rendering.

The react-resizable-panels documentation introduces React components for building resizable interfaces: panels arranged in rows or columns, grids that resize in two dimensions, and workspaces with tab sets users can rearrange by dragging.

The workspace example shows how to provide an initial model with defaultModel and select tab content through renderTabContent. The package includes TypeScript definitions.

In Next.js, a localStorage value can make server-rendered HTML differ from the first client render. The article compares the trade-offs: waiting until mount avoids the error but leaves the real content out of the SSR HTML; using the same initial value for both renders preserves that content, though a later update can cause flicker.

To synchronize a sidebar without that flash, an inline script applies its saved state to the DOM before hydration and passes it to React, which uses the same classes. The article also distinguishes an isolated theme control from a mobile backdrop handled with CSS.

Decap CMS adds an editorial interface to static sites while keeping content in the Git repository. Teams can manage drafts, reviews, and publishing with version history and a live preview that supports non-technical contributors.

Its declarative setup lives in a config.yml file for defining collections, fields, and workflows, while custom widgets extend the editor. For teams needing centralized access or relief from Git API limits, Decap Turbo adds features including hosted authentication and a database proxy.

Taste Skill gives coding agents a system for building less generic company websites: palettes, hero layouts, UI fragments and real photographs, with art direction tailored to the type of business. The repository offers Claude Code and Codex integrations, plus installation through npx skills.

Its distinctive feature is automated checking in headless Chrome: pages render at four widths, from 390 to 1440 px, and are checked for empty visuals, contrast, alignment and images missing on slow networks. WebGL and scroll effects are limited to tech, gaming and software pages, with static fallbacks for phones and reduced motion.

Kiri replaces Docker Desktop and OrbStack with a lightweight container runtime for macOS, Windows, and Linux, compatible with the Docker CLI, Compose, and buildx. The repository also describes a native UI and support for Kubernetes clusters and Linux machines.

Its architecture uses a Linux VM and a Rust agent that starts containers through clone3, without runc, a shim, or dockerd. The project publishes startup-time benchmarks against Docker Desktop and OrbStack, along with instructions for reproducing them.

NewReleases tracks new project and package versions across platforms such as GitHub, npm, NuGet, and Docker Hub, then sends alerts by email, instant messaging, or webhook. It removes the need to check each dependency or tool manually.

Notifications can be instant or scheduled, and tracking can be configured from dependency files such as package.json, requirements.txt, or go.mod. Regular-expression and prerelease-status filters help narrow down which versions trigger alerts.

Papra brings document storage and management together in an open-source archiving platform. Full-text search, advanced filters, tags, and automatic imports from email or a folder help organize files and retrieve them later.

The project can be deployed with Docker and also provides a CLI, API, SDKs, and webhooks for integration with other tools. Its online demo runs entirely in browser-local storage, with no backend.

Pullboard coordinates development agents around approved specifications: each claims an item in its own worktree, passes a test gate, then another agent verifies the commit before it is accepted. Rules and activity stay in the repository, with a local board instead of a hosted service.

Its workflow puts concrete controls around agent work: approved requirements are frozen when an item is claimed, lanes restrict writable paths, and a state machine shared by the commands, interface, and documentation governs each transition.

Zerobyte brings scheduling, management, and monitoring of encrypted Restic backups into a web interface. It supports NFS, SMB, WebDAV, and SFTP sources as well as local directories, with destinations including S3, GCS, Azure, and rclone.

The Docker Compose setup can be pared down when backing up only already-mounted directories: removing SYS_ADMIN and the FUSE device reduces the container’s granted capabilities, but prevents direct mounting of remote shares.

A three-agent workflow aims to find exposed personal data, identify removal procedures, and draft GDPR requests. The document sets out each agent’s role and instructions, then explains how to have them collaborate in a Cue group chat.

The process keeps human approval before emails are sent and says never to share passwords. It also distinguishes sites that catalogue data breaches from the organizations responsible for them, helping avoid contacting the wrong party.

This skill turns a coding agent into a security auditor by orchestrating a six-phase repository audit, from reconnaissance to report generation. Findings are structured as machine-readable data and independently verified.

A separate agent tries to disprove each candidate; results distinguish confirmed findings, leads needing validation, and rejected candidates. Running target code requires an OS-enforced sandbox with external networking disabled and resource limits in place.

The four Fetch Metadata headers tell servers where a request came from and how its response will be used. Andrew Lock explains Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User to help distinguish, for example, a legitimate navigation from a suspicious cross-site request.

Examples contrast an image loaded from a CDN with a JavaScript fetch() call. Because JavaScript cannot modify these signals, servers can use them in a Resource Isolation Policy as an additional layer of defense against CSRF requests.

Finbuckle.MultiTenant provides ASP.NET Core with tenant resolution, per-tenant configuration, and data-isolation building blocks. A basic setup combines a host-based strategy, a configuration-backed store, and the UseMultiTenant() middleware.

The middleware must run before components that depend on the tenant, such as authentication and authorization. The library also includes integrations for per-tenant options, authentication, and Entity Framework Core data isolation.

This installment explains how to move a tenant from a shared database to a dedicated one without taking the application offline or disrupting other tenants. The catalog drives the switch, while the same EF Core model and query filter serve both isolation modes.

The migration uses an initial copy, a temporary read-only window, a delta copy, and verification before cutover. The runbook waits for the cache to expire before reopening writes, preventing instances that still hold the old connection from writing to the shared database after the switch.

With one database per tenant, EF Core no longer needs a global query filter, a TenantId column, or a tenant-specific model cache key: the tenant is selected through a connection string resolved from a catalog database.

This isolation simplifies the model but shifts complexity to operations: each migration must be applied to every database. The article also explains how IDesignTimeDbContextFactory lets dotnet ef create the context without an active request or tenant.