---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [The JavaScript Ecosystem is Delightfully Weird](https://yomu.fyi/post/the-javascript-ecosystem-is-delightfully-weird.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: May 11, 2023
- Type: Explainer

The post explains why the JavaScript ecosystem is “delightfully weird,” arguing that its defining feature is not JavaScript’s oddness but the layers of transformation surrounding it. Bundlers first changed source boundaries by minimizing, tree-shaking, code-splitting, and producing executable files different from those developers wrote; CoffeeScript, Babel, TypeScript, JSX, Svelte, and esbuild extended that pattern. Frameworks and tools also make the ecosystem a “Big Tent,” allowing imports of CSS or PNG files and adding semantics outside ECMAScript, such as Svelte’s reactive labels and TypeScript annotations. React Server Components push this further: “use server” and “use client” are valid no-op statements whose placement changes code meaning, while RSC compiles into a stream of tagged JSON and depends on bundlers. The post presents this cooperation among languages, frameworks, routers, and bundlers—including the server/client interaction demonstrated in Dan Abramov’s React talk—as profound and beneficial, especially for geographically distributed application styles.


### [Supabase Beta April 2023](https://yomu.fyi/post/supabase-beta-april-2023.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: ant\_wilson
- Published: May 9, 2023
- Type: Announcement

Supabase’s April 2023 Beta Update reports on Launch Week 7 and a broad set of product, ecosystem, and community announcements. It open-sources Logflare as Supabase Logs, adds a self-hostable Edge Runtime for Deno Functions, and presents Storage v3’s resumable uploads for files up to 50GB, with quality filters, Next.js support, and WebP support. Auth additions include SAML 2.0 SSO, PKCE, Sign in with Apple for iOS, and server-side support, while Studio 2.0 brings redesigns, developer-experience improvements, and new AI features. The update also announces dbdev, a PostgreSQL package manager, Trusted Language Extensions for Postgres, pg\_graphql v1.2, search using GitHub Discussions, API report improvements, and a storage permission change, while noting Page Assist as the hackathon winner and Firecrawl’s move from Pinecone to Supabase for PostgreSQL vector embeddings.


### [Deploying LangChain to Fly.io](https://yomu.fyi/post/deploying-langchain-to-fly-io.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: May 8, 2023
- Type: Tutorial

Deploying a minimal LangChain application to Fly.io, using Flask, requires a small Python project that accepts a place and asks an OpenAI-backed model for three places to eat there. The example uses LangChain’s OpenAI wrapper, PromptTemplate, temperature 0.9, and a default Berlin value, while Flask routes requests at / or / and renders the model’s split response in HTML. Local setup includes a virtual environment, pinned Flask, gunicorn, langchain, openai, and python-dotenv dependencies, with OPENAI\_API\_KEY stored in a local .env file; production uses gunicorn rather than Flask’s development server. Fly launch configures the app name, organization, and deployment region, and fly deploy builds and publishes an image before provisioning machines. The article concludes that more complex, user-dependent requests require LangChain agents and tools, such as Google Places API, because language models lack real-time data and internet browsing.


### [Securing your Flutter apps with Multi-Factor Authentication](https://yomu.fyi/post/securing-your-flutter-apps-with-multi-factor-authentication.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: tyler\_shukert
- Published: May 4, 2023
- Type: Tutorial

The tutorial presents a Flutter app that requires multi-factor authentication before users can view its content, using email and password login followed by authenticator-app verification. It uses Supabase for authentication, supabase\_flutter for client integration, go\_router for routes and redirects, and flutter\_svg to display a QR code for authenticator enrollment. During signup, users confirm their email through a deep link, enroll MFA, and then verify a code; login applies a similar second step. iOS and Android deep-link configuration directs the confirmation callback to the enrollment route, while routing checks the session and authenticator assurance level to send users to registration, enrollment, or verification as appropriate. The stated outcome is that only users who have signed in via MFA can access the home page, while optional MFA is identified as a possible future variation.


### [Securing Diversity in Cybersecurity](https://yomu.fyi/post/securing-diversity-in-cybersecurity.md)
- Company: [Nextdoor](https://yomu.fyi/company/nextdoor.md)
- Author: Kristen Beneduce
- Published: May 2, 2023
- Type: Announcement

Securing global community platforms requires diverse engineering and security teams, yet hiring and retaining female talent remains a significant challenge across the cybersecurity sector. Industry figures indicate that women represent twenty-five percent of the cybersecurity workforce and hold sixteen percent of CISO positions, frequently encountering limited growth opportunities and lack of respect. To address these representation gaps, Nextdoor partnered with the Women in Cybersecurity Silicon Valley chapter to host a panel event at its headquarters alongside RSAC 2023. Security leaders and CISOs addressed subjects spanning modern technical threats including artificial intelligence, professional imposter syndrome, and the strategic value diverse viewpoints bring to organizational problem-solving. The gathering brought together students, industry practitioners, and executives from academia and government to support community mentorship and career advancement.


### [Safer deployment of streaming applications](https://yomu.fyi/post/safer-deployment-of-streaming-applications.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Shi Kai Ng
- Published: May 2, 2023
- Type: Problem & solution

Stateful stream processing frameworks like Apache Flink present unique deployment challenges because conventional canary and blue-green strategies can cause data inaccuracies or state divergence. Grab's real-time data platform team encountered risks of state loss, manual rollback overhead, and absent health checks in their Kubernetes and Spinnaker deployment pipeline. To resolve these operational issues, the team redesigned the deployment workflow around automated Flink savepointing and programmatic health monitoring. The new pipeline halts existing applications after capturing state snapshots and Kafka offsets, monitors target deployments via API health probes, and executes automated rollbacks using versioned ConfigMaps and replica metadata annotations. This automated process ensures state consistency during upgrades and eliminates manual intervention during deployment failures.


### [Next steps for Postgres pluggable storage](https://yomu.fyi/post/next-steps-for-postgres-pluggable-storage.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: paul\_copplestone
- Published: May 1, 2023
- Type: Explainer

PostgreSQL pluggable storage would let different tables in one database use storage engines optimized for transactional, analytical, or archival workloads, while allowing developers to build engines in an extensions-like model. PostgreSQL 12 added basic support through refactoring and expanding table access method APIs, initially to enable ZHeap, whose undo log showed promising results and addressed long-term table bloat, but work on ZHeap and TAM appears stalled. The current API has important gaps, including limited index flexibility, all-or-nothing index updates, and row-version identifiers tied to block and offset numbers; available options such as Citus Columnar Storage remain constrained by these limits. OrioleDB's upstreaming has reduced its fork's patchset from about 5,000 lines in PostgreSQL 14 to about 2,000 for PostgreSQL 16, raising the possibility that required changes could land in PostgreSQL 17.


### [Launch Week 7 Hackathon Winners](https://yomu.fyi/post/launch-week-7-hackathon-winners.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: tyler\_shukert
- Published: Apr 24, 2023
- Type: Announcement

Supabase Launch Week 7 announces the winners of its hackathon, which introduced an AI theme and recognized projects across five categories. Page Assist won Best Overall for an open-source Chrome extension that lets users chat with webpages through the ChatGPT API, while other winners included Rect, Supathreads, Replay.ai, Supa0SQL, and Generation: Hotdog. The projects apply AI to educational content, blog-to-thread conversion, browsing-history search with cosine similarity, natural-language chart creation, and hotdog-image generation using OpenAI and Stable Diffusion APIs; runner-ups included tools for video chat, drum patterns, tweet scheduling, and music guessing. Members of the Best Overall winning team receive a limited-edition Launch Week 7 Keyboard, while winners and runner-ups in other categories receive Launch Week 7 swag kits, alongside guides for getting started with Supabase resources.


### [Fly.io ❤️  JS](https://yomu.fyi/post/fly-io-js.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Apr 24, 2023
- Type: Announcement

Fly.io proposes a general-purpose way to deploy JavaScript and Node.js applications despite the ecosystem’s many frameworks, package managers, runtimes, and TypeScript conventions. Its dockerfile-node project uses package.json, lockfiles, and dependency metadata to generate a baseline Dockerfile, .dockerignore, and optionally a docker-entrypoint script; users can invoke it with npx @flydotio/dockerfile. Conditional EJS templates accommodate framework-specific requirements, with initial templates for Express, Fastify, Gatsby, Nest, Next, Nuxt, and Remix, though current support may extend only to a splash screen. Future plans include replacing Fly.io’s existing flyctl scanners, integrating deployment-time secrets, volumes, databases, and health checks, and adding customization such as build caching, swap, Docker Compose generation, browser setup, and non-root execution.


### [What's New in pg\_graphql v1.2](https://yomu.fyi/post/what-s-new-in-pg-graphql-v1-2.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: oli\_rice
- Published: Apr 21, 2023
- Type: Announcement

pg\_graphql v1.2 introduces several API features for projects using PostgreSQL 15.1.0.63 or higher, including reflection of views, materialized views, and foreign tables. Reflected views require a primary-key constraint supplied through a comment directive, while simple views also support insert and update mutation events. Filtering gains null and non-null checks plus like, ilike, and startsWith options; startsWith can use simple B-Tree indexes, while citext and PGroonga address scalability concerns for text filtering. The release adds functional @skip and @include directives and lets users define GraphQL descriptions for tables, views, and columns through comments. Planned work includes user-defined functions, nested inserts, and an alternative computed-relationships approach based on SQL functions returning SET OF.


### [Identifying vulnerabilities in GitHub Actions & AWS OIDC Configurations](https://yomu.fyi/post/identifying-vulnerabilities-in-github-actions-aws-oidc-configurations.md)
- Company: [Tinder](https://yomu.fyi/company/tinder.md)
- Author: Tinder
- Published: Apr 18, 2023
- Type: Explainer

In 2021, GitHub released OpenID Connect support for GitHub Actions to let workflows retrieve short-lived cloud session tokens instead of storing static secrets. Tinder Security Labs discovered widespread IAM role misconfigurations that allow external repositories to assume target roles and access AWS resources. The primary issue stems from IAM trust policies that authenticate the GitHub identity provider but omit strict validation on the subject claim. Researchers located exposed role identifiers via public workflow searches and confirmed that arbitrary external GitHub Actions workflows could assume them, including roles within AWS official repositories. Remediation requires configuring trust policies to restrict the audience and validate repository namespaces, while unauthorized assumptions can be detected in CloudTrail logs.


### [Message Center - Redesigning the messaging experience on the Grab superapp](https://yomu.fyi/post/message-center-redesigning-the-messaging-experience-on-the-grab-supera.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Jonathan Lee
- Published: Apr 17, 2023
- Type: Problem & solution

Grab redesigned its messaging infrastructure from GrabChat to Message Center to overcome two-party chat limitations and support complex superapp requirements like group conversations and varied user roles. The architecture separates core processing logic from message delivery by splitting the system into a backend processor and an independently scalable postman service. Communication relies on an in-house TCP gateway named Hermes that proxies client payloads via gRPC, alongside Apache Kafka streams and Amazon SQS delay queues. Custom client-server acknowledgements and a DynamoDB event store ensure reliable message delivery even across dropped mobile TCP connections and offline reconnects.


### [dbdev: PostgreSQL Package Manager](https://yomu.fyi/post/dbdev-postgresql-package-manager.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: oli\_rice,daltjoh-aws
- Published: Apr 14, 2023
- Type: Announcement

database.dev is a public preview of dbdev, a PostgreSQL package manager whose registry is currently read-only and preloaded with packages demonstrating packaging and discovery possibilities. It aims to provide repeatable deployment of libraries and applications, with third-party publishing tools planned after community feedback, and uses organization- or user-namespaced package names to address name and typo squatting. The in-database client installs packages, which PostgreSQL then exposes as native extensions; dbdev adds major.minor.patch version constraints, while compatibility currently requires Supabase new projects or PostgreSQL with pg\_tle and pgsql-http. Examples include a hybrid document-search backend, an index advisor that reports a sample total-cost reduction from 25.88 to 6.40, and administration views for database diagnostics. The preview depends on Trusted Language Extensions, and the post invites reports, feature ideas, and contributions while noting that pl/rust had not yet reached Supabase.


### [Launch Week 7 Community Highlights](https://yomu.fyi/post/launch-week-7-community-highlights.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: paul\_copplestone
- Published: Apr 14, 2023
- Type: Announcement

Supabase reports community highlights from the past three months, covering ecosystem partnerships, self-hosting, Postgres extensions, client libraries, utilities, upstream work, and contributors. New collaborations include AWS RDS work on pg\_tle and Trusted Language PL/Rust, Clickhouse bidirectional Postgres integration, LangChain vector-store and hybrid-search contributions, a Vercel and OpenAI GPT-search template, Doppler secret syncing, Redwood’s Prisma Quick Start, Dart Edge, and T3 Turbo. The update also describes self-hosting support for Logs and Edge Functions, new Digital Ocean and Stackgres entrants, and extensions including pgvector, HypoPG, pg\_tle, PGroonga v3.0, LZ4 compression, and ICU support. It records new Swift, Python, and C# client libraries, cache helpers, Firebase-to-Supabase supashim, Postgres and OrioleDB patches, and recognition for contributors, while noting more than 48,000 GitHub stars.


### [Trusted Language Extensions for Postgres](https://yomu.fyi/post/trusted-language-extensions-for-postgres.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: michel,daltjoh-aws
- Published: Apr 14, 2023
- Type: Explainer

Cloud Postgres providers often restrict extension installation until extensions are vetted, leaving some useful functionality unavailable on hosted databases. A Trusted Language Extension (TLE) is a Postgres extension written in a trusted language, allowing installation through pg\_tle without placing code on the server filesystem. The source explains that conventional extensions may include SQL and functions implemented in languages such as C, while trusted languages follow PostgreSQL's security rules and cannot access raw process memory or system functions. AWS developed pg\_tle, and collaboration with Supabase makes it available on Supabase and Amazon RDS for PostgreSQL 14.5 and higher; the dbdev registry can install packages such as langchain-embedding\_search through SQL migrations. TLEs are presented as a way to distribute and iterate on trusted extensions without waiting for each cloud provider to preinstall them.


### [Supabase Studio 2.0: help when you need it most](https://yomu.fyi/post/supabase-studio-2-0-help-when-you-need-it-most.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: alaister,joshenlim,jonny,saltcod
- Published: Apr 14, 2023
- Type: Announcement

Supabase Studio 2.0 adds AI-assisted database development alongside a set of Postgres, GraphQL, and Table Editor improvements. The ⌘K menu can use AI to create tables, views, indexes, functions, and triggers, while also providing Studio navigation and Docs search; a future opt-in will send table schemas to OpenAI to help fine-tune queries. The release adds integrated GraphiQL, cascade-delete configuration, a Query Performance tool for investigating slow queries, foreign-key row selection, revised Postgres role management, editable database webhooks that can call Edge Functions, SQL definitions, API autodocs, and downloadable TypeScript types. It also improves responsiveness with many tables, expands JSON editing, and permits text and boolean cells to be null or empty, while the announcement says future work will focus on RLS policy assistance.


### [Supabase Auth: SSO,  Mobile, and Server-side support](https://yomu.fyi/post/supabase-auth-sso-mobile-and-server-side-support.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: stojan,joel,kangmingtay
- Published: Apr 13, 2023
- Type: Announcement

Supabase Auth announces SAML 2.0 Single Sign-On, PKCE support for server-side rendering and mobile authentication, and native Sign in with Apple on iOS. SSO lets users authenticate through a company identity provider, with dashboard configuration, Supabase CLI commands, a \`signInWithSSO()\` call, and PostgreSQL Row Level Security support using the provider identifier in a user JWT. PKCE addresses implicit-flow risks with a code verifier, code challenge, authorization code, and server-side exchange for a session, enabling same-domain cookies, protected server-rendered pages, and downstream actions after authentication. The release also allows an iOS Bundle ID to be configured for Apple provider access and supports \`supabase.auth.signInWithApple()\` in supabase-flutter without deep links or parameters. SSO is available on the Pro Plan and above and self-hosted, while server-side Auth using PKCE is now available on all projects.


### [Creating a Flexible Order Routing System with Shopify Functions](https://yomu.fyi/post/creating-a-flexible-order-routing-system-with-shopify-functions.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Apr 13, 2023
- Type: Explainer

Shopify’s smart order routing replaces a one-size-fits-all approach to choosing which inventory location fulfills an order with configurable routing rules. Rules can rank eligible locations by proximity to the destination, staying within the destination market, or merchant-defined location priorities, and merchants can arrange them in an order in the admin. Each rule is a Shopify Function written in Rust, receives data shaped through a GraphQL query, and returns location rankings; a reducer resolves ties by applying later rules to locations tied at rank 0. The rebuilt process uses the pipeline pattern to separate input preparation, rule execution, reduction, and final location selection, improving readability and debugging compared with the earlier tightly coupled implementation. This first stage dogfooded Shopify Functions on its own merchant stores, with a later stage planned to let developers add more complex rules.


### [Supabase Storage v3: Resumable Uploads with support for 50GB files](https://yomu.fyi/post/supabase-storage-v3-resumable-uploads-with-support-for-50gb-files.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: fabrizio,inian
- Published: Apr 12, 2023
- Type: Announcement

Storage v3 adds resumable uploads, quality and format filters, a Next.js loader, WebP rendering, presigned upload URLs, and per-bucket size and file-type limits. Resumable uploads divide files into chunks, emit progress events, and allow interrupted transfers to continue; Pro Plan and higher users can upload files up to 50GB, up from 5GB. Rather than expose S3’s proprietary protocol, the implementation uses the open TUS protocol over HTTP through the Node.js Storage-API service and tus-node-server, with Postgres RLS integration. To support multiple TUS instances behind a load balancer, transactional Postgres Advisory locks serialize access to each S3 object and help address concurrent uploads, while the release rolls out gradually over the next month.


### [More Predictable Shared Dyno Performance](https://yomu.fyi/post/more-predictable-shared-dyno-performance.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Michael Friis
- Published: Apr 11, 2023
- Type: Announcement

Heroku describes a year-long effort to make CPU access more predictable for shared dynos in the Common Runtime. Previously, individual dynos could burst CPU use relatively freely when capacity was available, improving utilization but sometimes allowing misconfigured or malicious “noisy neighbors” to cause response-time spikes or H12 timeouts. The platform introduced improved resource isolation for eco, basic, standard-1X, and standard-2X Dynos, limiting bursts while preserving the ability to burst and aiming for fairer access to shared CPU resources. The change does not alter the number of dynos per instance, and Performance, Private, and Shield type Dynos are excluded because they run on dedicated instances.


[Newer posts](https://yomu.fyi/posts/page/195.md) · [Older posts](https://yomu.fyi/posts/page/197.md)