Karl Horky

1 Nov 2024

Replying to @gergely.pragmaticengineer.com

Hi, I'm Karl I design curricula to help people get into full stack programming, which often leads me to open source contributions I also help organize React and JS meetups in Amsterdam and Vienna - maybe we'll see you there!

Had a great time delivering my Full Stack Guardrails for AI Agents masterclass at The Geek Gathering 2026 (Osijek, Croatia) 🙌 Topics - ways AI can fail in software development - deterministic guardrails to help AI make fewer mistakes - exercise to build app feature with guardrails

Thanks to The Geek Gathering team and sponsors incl. Šimun, Iva, Sebastijan, Vlatko Vlahek, Ivan Rimac, Feđa Ivanšić and Marko Boras for putting everything together and speakers @driesdepoorter.be , @leichteckig.bsky.social @en.sitnik.es (and everyone else I didn't meet) 📸 WAU PRODUCTION

Finally, thanks to maintainers of tools I used as guardrails @typescript-eslint.io : @brad.zacher.com.au @joshuakgoldberg.com eloqnt: @amann.work konsistent: @felixarntz.bsky.social @vercel.com SafeQL: Eliya Cohen React Compiler / hooks: @no.lol @en-js.bsky.social I'm sure I missed many others

26 Aug

introducing the `code-comments` skill: clearer, more deterministic code comments why: AI mostly writes in horrible, unclear, twisted ways (esp Claude) and that slop is saved in your codebase code comments, w. human + AI comprehension costs npx skills add karlhorky/agent-skills

github.com/karlhorky/ag...

26 Aug

@philippeserhal.com would @netlify.com switch off Corepack for pnpm now that it's officially recommended against? x.com/karlhorky/st...

x.comKarl Horky (@karlhorky) on XOfficial recommendation from the pnpm team to avoid Corepack

x.comKarl Horky (@karlhorky) on X@zkochan @imjcmartin @pnpmjs @theoklitosBam7 @eduardoboucas would @Netlify switch off Corepack for pnpm now that it's officially recommended against? https://t.co/ryETEOhSc2

20 Aug

Also asked @eduardoboucas.com over here: x.com/karlhorky/st...

19 Aug

still trying to get Claude Code (Opus 5, but all Anthropic models are like this) to be more grounded in reality and less persuasive / rhetoric-heavy the responses are by default so unstructured and void of proof / verification push a little bit against the rhetoric and "You're absolutely right!"

18 Aug

TypeScript overlays in MDX files 😍 Using TS 7.x Content Mappers by @andrewbran.ch 🙌

Remco Haszing@remcohaszing.nl

My editor using mdx-content-mapper is now showing TypeScript info for frontmatter and code blocks.

ahh @github.com is removing "Close" notifications?? 😬 notifications are already bad enough, making them worse? submit your feedback here: github.com/orgs/communi...

github.comNotification subscriptions cannot be customised anymore. · community · Discussion #204563🏷️ Discussion Type Bug 💬 Feature/Topic Area Issues Body This is a recurrence of what discussions/132506#discussioncomment-11294250 resolved: To summarise, I am unable to utilise the "Custom" featur...

16 Aug

Community feedback worked! GitHub is pausing the deprecation github.com/orgs/communi...

ahh @github.com is removing "Close" notifications?? 😬 notifications are already bad enough, making them worse? submit your feedback here: github.com/orgs/communi...

github.blogCustom thread subscriptions are being deprecated - GitHub ChangelogYou’ll no longer be able to configure custom thread subscriptions for GitHub notifications. What’s changing As part of this rollout, GitHub will remove support for custom thread subscription settings....

blog post github.blog/changelog/20...

new proof of concept script: diagnostics from Next.js TypeScript language service plugin on the command line 😍 (also in CI) like `astro check` or `vue-tsc` or `mdx-tsc`

github.comNext.js TypeScript plugin diagnostics not reported by CLI / CI type checking with `tsc` or `next` subcommand · Issue #97229 · vercel/next.jsLink to the code that reproduces this issue https://github.com/karlhorky/repro-next-js-typescript-plugin-diagnostics-no-cli To Reproduce Open the reproduction sandbox at https://codesandbox.io/p/de...

I also created a Next.js issue to possibly get this into a 1st-party CLI github.com/vercel/next....

10 Aug

another of my weird code review habits check PR changes (even for your PRs) - if not self-explanatory in PR context, make line comments on what/why benefits: 1. finds many logic errors + overengineering 2. returning to PRs later offers extra context both for AI and people

7 Aug

that kind of day ... where a React key warning in your app leads you to discover a bug in React 🤯 github.com/react/react/...

lore.kernel.orgMaking sure you're not a bot!

7 Aug

Even with all of these new code review tools lately, we still have diffs like this on GitHub (even SemanticDiff can't ignore the {' '} diff) Wonder if these belong in Git as semantic diff drivers per language/framework 👀 so diffs everywhere can ignore these 🤔

Kind of related: Michael Montalbo has a recent Git RFC for external "hunk providers", eg. for tools like Difftastic 👀 This isn't about built-in 1st-party semantic diff drivers though lore.kernel.org/git/pull.212...

github.comTreat equivalent JSX whitespace expressions as unchanged · Issue #1026 · Wilfred/difftasticSomewhat related to #72 First of all, thanks for Difftastic! These foundational tools which reduce unnecessary work are invaluable, especially now with the high number of PRs created by AI agents. ...

7 Aug

hmm, maybe someone has already explored first-party semantic diff drivers for Git? (per language and framework) has anyone seen anything like this?

Reported to Difftastic too github.com/Wilfred/diff...

5 Aug

Naming is hard So try to avoid naming things as much as possible - use existing names, from the language, framework, external APIs, etc One of my latest additions to AGENTS . md github.com/karlhorky/do...

30 July

Lightweight AI planning (avoiding a "plan" or "spec" which easily gets out of date): Start PRs with an empty commit + include all of the planned tasks in PR title and description (using checkboxes) Then keep this up to date and check off the points as you / AI implement github.com/karlhorky/do...

3. AI and humans can quickly look up the spec / plan details in PRs and see them in the context of the repository history

github.comAdd endpoint sync with OpenAPI contract by karlhorky · Pull Request #2 · upleveled/youtube-private-invitationsDepends on PR #1 Manual sync in PR #1 lets channel owners paste add/remove invitees in YouTube Studio, so it works without a backend. Some teams already decide private-video invite changes outside ...

30 July

Example PR: github.com/upleveled/yo...

Benefits: 1. Avoids the double work of creating the spec / plan and also the PR title and description (since you need the PR details anyway) 2. Keeps the spec / plan close to the proposed change (the PR), rather than in separate, disconnected specs/plans folder

Karl Horky reposted

TypeScript

@typescriptlang.org

8 July

📣 The moment is here. 📣 TypeScript 7 is officially released! 7️⃣ devblogs.microsoft.com/typescript/a...

devblogs.microsoft.comAnnouncing TypeScript 7.0 - TypeScriptToday we are proud to announce the availability of TypeScript 7, a 10x faster native port of TypeScript! Since its early days, TypeScript has promised to

Karl Horky reposted

Node.js

@nodejs.org

18 June

⚠️ Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues. More information here: https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

nodejs.orgNode.js — Thursday, June 18, 2026 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Security: VS Code 1.125 finally has a delay for auto-updates of extensions 👍 // Delay extension updates for 7 days "extensions.autoUpdateDelay": 168, Prompted by the recent security breaches and over 300 upvotes on my feature suggestion code.visualstudio.com/updates/v1_1...

github.comSecurity: minimumReleaseAge setting for mitigating supply chain attacks on extensions · Issue #316867 · microsoft/vscodeIn the last years, supply chain attacks have increased dramatically. A few examples in the VS Code extension ecosystem: AI-Slop ransomware test sneaks on to VS Code marketplace - BleepingComputer M...

My VS Code feature issue github.com/microsoft/vs...

Had a great time MCing at @jsnation.gitnation.org 2026 in Amsterdam! Great to see all the friends and make new connections Thanks to the organizers at @gitnation.bsky.social , and everyone else who helped organize, spoke and otherwise joined the event! #JSNation

Thanks for letting me intro and grill you afterwards with questions too 😃 Noah Yamamoto, @paolo.ricciuti.me, @joyeecheung.bsky.social, @erickwendel.bsky.social, @tkdodo.eu, David Mark Clements

vite.devCloudflare supports Vite's missionThe VoidZero team is joining Cloudflare. Vite remains MIT, vendor-neutral and stewarded by the same wider team.

And thanks to my co-MCs @jessiebellehooks.bsky.social @tolin.ski @w3cj.com for helping entertain 🙌

Karl Horky reposted

Vite

@vite.dev

4 June

Today, VoidZero joins Cloudflare. Vite remains MIT, vendor-neutral, and stewarded by the same wider team. The same goes for Vitest, Rolldown, and Oxc. Cloudflare is also committing $1M to an OSS fund to support independent development in the Vite ecosystem.

2 June

Looking forward to MCing at JSNation Conf 2026 in Amsterdam next week 🚀 As a preview, here's multiple badly-generated AI photos of me on stage, which don't look like me at all hint: I like talking about AI slop / AI fails ✨ and how we can do better See you all there!

Karl Horky reposted

Jiahan Chen

@chenjiahan.bsky.social

26 May

Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks? It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts. This is what happened in the recent Nx supply-chain compromise, which led to GitHub’s source code being leaked.

19 May

Come and join us at Jetbrains for the next AmsterdamJS, with some TC39 members 🙌

JSNation@jsnation.gitnation.org

Special Edition Meetup with TC39 members on May 21! Meet the speakers 👀 • @mikbar.bsky.social & Alberto Tontoni - IDE for Reading and Navigating the ECMAScript Specification • @nicr.dev - Topic TBA • TC39 Panel 👉 Register now: guild.host/events/amste... 🙌 Thanks to @jetbrains.com for hosting

17 May

VS Code extension Security: I proposed a setting in VS Code to limit extension installs to versions older than X days This is to mitigate supply chain attacks, similar to pnpm's minimumReleaseAge github.com/microsoft/vs...

27 Apr

Great research into the changing team dynamics of AI, and how a lot of tools and processes are built for: 1. slow, pre-AI ways of collaboration 2. multiplying singular AI users and siloing the AI interactions, instead of making it team-first

Maggie Appleton@maggieappleton.com

Got to talk at @aidotengineer.bsky.social conf last week about the need for collaborative AI engineering. All our current coding agents are single player. We're trying to scale up individual productivity, but creating tons of alignment problems in the process. We have no good tools for...

16 Apr

VS Code: I suggested an "edit mode" for the integrated browser, for WYSWYG-style workflows of changing text copy If you also want this: it is a backlog candidate now, needs 20 👍 reactions to move it to backlog github.com/microsoft/vs...

guild.hostReact Amsterdam Meetup: React Server Components & more! | GuildApr 7th 6:30PM: Hey, React Amsterdam Community! We’re excited to kick off our next React meetup on April 7! Join us for an evening of practical insights, great conversations, and community vibes — fr...

6 Apr

Tomorrow: React Amsterdam ⚛️ April edition, at Picnic - Kirill Voloshin and Masoud Alali: Evolving the Picnic Page Platform with React Server Components - Leon Liefting: Building Flexible Breadcrumbs in Next.js With the App Router Hope to see you there! guild.host/events/react...

31 Mar

The axios breach is a good opportunity to review your package manager settings I recommend pnpm @pnpm.io Default: postinstall scripts are blocked, protects against axios vector Also try: - minimumReleaseAge: 10080 (pkgs must be min 7 days old) - trustPolicy - blockExoticSubdeps

pnpm.ioConfig Dependencies | pnpmConfig dependencies allow you to share and centralize configuration files, settings, and hooks across multiple projects. They are installed before all regular dependencies ("dependencies", "devDepende...

31 Mar

Example pnpm-workspace.yaml config github.com/upleveled/es...

To bundle all of your security settings, use "configurational dependencies": pnpm.io/config-depen... Also, you can set these globally for defense in depth of unconfigured projects: pnpm config set minimumReleaseAge 10080 --global