Karl Horky

@karlhorky

Technical Founder, Curriculum Engineer @upleveled.io Org Team React Amsterdam, AmsterdamJS, @reactvienna.com Canadian, Austrian, he/him 📍Amsterdam

2400 Siguiendo2808 Seguidores463 Publicaciones

Bluesky

gamer

¿Es tu perfil?Reclámalo y karlhorky.dirty.social es tuyo.Reclamar perfil

Karl Horky@karlhorky· 8h

still trying to get Claude Code (Opus 5, but all Anthropic models are like this) to be more grounded in reality and less persuasive / rhetoric-heavy the responses are by default so unstructured and void of proof / verification push a little bit against the rhetoric and "You're absolutely right!"

https://github.com/karlhorky/dotfiles/blob/393f4d4149db43af38f04210d9d80a0de1c88cb4/settings/.codex/agents.md?plain=1#L49-L56

# Reasoning

- avoid rhetoric in your reasoning: report like a lab notebook, not an argument
- show the command / code and its output for every factual claim
- tables or other illustrative instruments which summarize data are nice, but they never replace the data behind them - show both the summary and the cited data
- when you haven't verified something, mention:
- you haven't verified yet
- you're guessing / inferring
- the next steps for verifying
- drop persuasive language in headlines and body text: `Verdict:`, `Why X is wrong`, conclusions with no accompanying data

Karl Horky@karlhorky· 7d

ahh @github.com is removing "Close" notifications?? 😬 notifications are already bad enough, making them worse? submit your feedback here: github.com/orgs/communi...

August 10, 2026 • 1 minute read
Custom thread subscriptions are being deprecated

You’ll no longer be able to configure custom thread subscriptions for GitHub notifications.

Karl Horky@karlhorky· 7d

new proof of concept script: diagnostics from Next.js TypeScript language service plugin on the command line 😍 (also in CI) like `astro check` or `vue-tsc` or `mdx-tsc`

https://github.com/karlhorky/next-js-tricks#check-nextjs-typescript-plugin-diagnostics-in-terminal

Check Next.js TypeScript Plugin Diagnostics in Terminal
Next.js includes a custom TypeScript plugin for diagnostics such as missing types on metadata exports. However, the plugin diagnostics are not reported by tsc or a next CLI subcommand.

The TypeScript team have up until now (August 2026) rejected the feature request that tsc execute TypeScript language-service plugins:

microsoft/TypeScript#16607
To report the Next.js plugin diagnostics in the terminal and CI, install @typescript-eslint/project-service:

pnpm add --save-dev @typescript-eslint/project-service
Make sure the existing tsconfig.json enables the Next.js plugin:

{
"compilerOptions": {
"plugins": [{ "name": "next" }]
}
}
Add the following script:

scripts/next-tsc.ts

...

VS Code showing the Next.js metadata TS71008 warning and next-tsc exit code 1

GitHub Actions failing on the Next.js metadata TS71008 warning from next-tsc

Karl Horky@karlhorky· 9d

another of my weird code review habits check PR changes (even for your PRs) - if not self-explanatory in PR context, make line comments on what/why benefits: 1. finds many logic errors + overengineering 2. returning to PRs later offers extra context both for AI and people

playwright/leadSeesMatchingDesignAndContent.spec.ts

```diff
// after Reach UI Tabs hides some images
// - https://github.com/microsoft/playwright/issues/31737#issuecomment-2233775909
- await expect(lazyImagesLocator).toHaveCount(23);
+ await expect(lazyImagesLocator).toHaveCount(26);
```

@karlhorky
add 3 lazy-loaded SVG <Image /> (next/image) on homepage

packages/database/tables/0150-quizzes.ts

```diff
- typeId: QuizType['id'];
+ curriculumVersionId: CurriculumVersion['id'];
+ quizTypeId: QuizType['id'];
```

@karlhorky

switch from `type_id` to `quiz_type_id` to match existing foreign key naming patterns

Karl Horky@karlhorky· 12d

that kind of day ... where a React key warning in your app leads you to discover a bug in React 🤯 github.com/react/react/...

https://github.com/react/react/issues/37240

Bug: False-positive missing key warning when Flight outlines a static child

#37240
Open
Description
@karlhorky
karlhorky
opened 5m ago
Contributor
React version: 19.2.8

Steps To Reproduce
Open /repro and observe the Each child in a list should have a unique "key" prop. error message in the browser console.
Compare with /control, which reduces the preceding serialized prop from 4000 to 2500 characters.

Karl Horky@karlhorky· 12d

Even with all of these new code review tools lately, we still have diffs like this on GitHub (even SemanticDiff can't ignore the {' '} diff) Wonder if these belong in Git as semantic diff drivers per language/framework 👀 so diffs everywhere can ignore these 🤔

- {formField.label} {formField.required && <Asterisk />}
+ {formField.label}{' '}
+ {formField.required && <Asterisk />}

- <option key={`option-${option}`} value={option}>
+ <option
+ key={`option-${option}`}
+ value={option}
+ >

Karl Horky@karlhorky· 14d

Naming is hard So try to avoid naming things as much as possible - use existing names, from the language, framework, external APIs, etc One of my latest additions to AGENTS . md github.com/karlhorky/do...

Karl Horky@karlhorky· 20d

Lightweight AI planning (avoiding a "plan" or "spec" which easily gets out of date): Start PRs with an empty commit + include all of the planned tasks in PR title and description (using checkboxes) Then keep this up to date and check off the points as you / AI implement github.com/karlhorky/do...

https://github.com/karlhorky/dotfiles/blob/main/settings/.codex/agents.md?plain=1#L4-L12

# GitHub

- opening PRs
- always make user review title and description before starting work
- as usual: create a branch
- create an empty commit with a title with the prefix `Add initial empty commit`
- as usual: push the branch to GitHub
- propose 3 possible PR titles along with 1 possible PR description, following your PR title and description rules
- ask the user for approval
- after any iteration and approval, create a PR with the approved title and description
- once you're ready to commit the first time, amend the empty commit and force push

Karl Horky@karlhorky· Jun 17

Security: VS Code 1.125 finally has a delay for auto-updates of extensions 👍 // Delay extension updates for 7 days "extensions.autoUpdateDelay": 168, Prompted by the recent security breaches and over 300 upvotes on my feature suggestion code.visualstudio.com/updates/v1_1...

VS Code release notes blog post showing a new setting:

Configurable extension auto-update delay
Setting:
extensions.autoUpdateDelay
This setting is managed at the organization level. Contact your administrator to change it.ORG
To give you more control over when extension updates are installed, you can now configure a delay for automatic extension updates. This builds on the delayed extension auto-updates feature introduced in the previous release.

Use the
extensions.autoUpdateDelay
This setting is managed at the organization level. Contact your administrator to change it.ORG setting to configure the delay in hours. By default, VS Code waits two hours before installing extension updates. The delay only applies when auto-update is enabled.

issue on GitHub:

"Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions" by @karlhorky

which received 334 upvotes

Karl Horky@karlhorky· Jun 17

Had a great time MCing at @jsnation.gitnation.org 2026 in Amsterdam! Great to see all the friends and make new connections Thanks to the organizers at @gitnation.bsky.social , and everyone else who helped organize, spoke and otherwise joined the event! #JSNation

Hall full of people at JSNation 2026 in Amsterdam

Karl Horky MCing on stage at JSNation 2026 in Amsterdam

Karl Horky asking questions to Erick Wendel on stage at JSNation 2026 in Amsterdam

Karl Horky@karlhorky· Jun 2

Looking forward to MCing at JSNation Conf 2026 in Amsterdam next week 🚀 As a preview, here's multiple badly-generated AI photos of me on stage, which don't look like me at all hint: I like talking about AI slop / AI fails ✨ and how we can do better See you all there!

bad AI-generated photo of Karl, wrong eyes, wrong face

bad AI-generated photos of Karl on stage as a giant, pointing down at people

bad AI-generated photos of Karl on stage as a giant, sitting in the air on nothing, with spotlights shining down on him

Karl Horky@karlhorky· May 17

VS Code extension Security: I proposed a setting in VS Code to limit extension installs to versions older than X days This is to mitigate supply chain attacks, similar to pnpm's minimumReleaseAge github.com/microsoft/vs...

Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions #316867

In the last years, supply chain attacks have increased dramatically. A few examples in the VS Code extension ecosystem:

- AI-Slop ransomware test sneaks on to VS Code marketplace - BleepingComputer
- Malicious VS Code AI Extensions With 1.5M Installs Found Exfiltrating Code - The Hacker News
- Fake Clawdbot VS Code Extension Installs ScreenConnect RAT - Aikido
- Solidity Devs Targeted Again: Malicious VS Code Extension Drops ScreenConnect RAT - Checkmarx
- VS Code extensions contain trojan-laden image - ReversingLabs
- Malicious VSCode extensions on Microsoft's registry drop infostealers - BleepingComputer
- Malicious VSCode extensions infect Windows with cryptominers - BleepingComputer
- Nx Compromised to Steal Wallets and Credentials - Semgrep
- Supply Chain Risk in VS Code Extension Marketplaces - Wiz

Allow for minimumReleaseAge-style...

Karl Horky@karlhorky· Apr 16

VS Code: I suggested an "edit mode" for the integrated browser, for WYSWYG-style workflows of changing text copy If you also want this: it is a backlog candidate now, needs 20 👍 reactions to move it to backlog github.com/microsoft/vs...

Integrated browser "edit mode": use inline text edits as a signal for Copilot edits #310710

karlhorky
opened 5 hours ago · edited by karlhorky
When performing marketing copy edits, it is often faster to just change text copy directly in the integrated browser than to describe the change in chat and wait for Copilot to make the change and the dev server to update the integrated browser (especially true with slower dev servers).

In the integrated browser, introduce a mode where DOM elements/nodes containing text are temporarily editable (eg. the behavior of contenteditable attribute). The user can then edit text inline and click on a "Save" button, upon which Copilot should use the diff of the edited text (plus nearby DOM context and innerHTML, as necessary) as a signal to propose source edits in the backing tsx / jsx / html / svelte / vue / etc file.

This proposal is NOT about persisting DOM edits deterministically to files. The browser would only be the interaction surface, while Copilot still generates normal source edits for review, based on the diff.

This could be extended to other non-text edits in future, such as image paths.

Alternatives considered
Full WYSIWYG editor, mapping changes to source files deterministically

cc @meganrogge @jruales @kycutler

Karl Horky@karlhorky· Jan 13

🔒Node.js v22.22.0, v24.13.0, v25.3.0 fix 3 high, 4 med, 1 low severity security vulnerabilities (+ dependencies) Upgrade now: Windows: choco upgrade nodejs # or nodejs-lts macOS: brew upgrade node # or node@24 Ubuntu: sudo apt-get --only-upgrade install nodejs

Security releases available

Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines to address:

- 3 high severity issues.
- 4 medium severity issues.
- 1 low severity issue.

This security release includes the following dependency updates to address public vulnerabilities:

- c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x
- undici (6.23.0, 7.18.0) on 20.x, 22.x, 24.x, 25.x

Karl Horky@karlhorky· Nov 29

Petition in Germany recognizing open source as volunteering for the common good 🤩 Seems like a good step towards recognition and a healthier open source ecosystem www.openpetition.de/petition/onl...

openPetition

Recognition of Work on Open-Source as Volunteering in Germany
Henning Lammert
Petition is addressed to
German Bundestag, Petition Committee
3,256 Signatures

3,134 from 30,000 for quorum in Germany

Karl Horky@karlhorky· Oct 16

npx-safe by @rafaelgss.dev : Use the Node.js permissions model to make running npx on untrusted packages safer 🔥 github.com/RafaelGSS/do...

$alias npx-safe='function _npx_safe() { local node_opts="--permission --allow-fs-read=$(npm prefix -g) --allow-fs-read=$(npm config get cache)" local package="" local package_args=() while [[ $# -gt 0 ]]; do if [[ "$1" == --* ]]; then # Anything starting with `--` goes into node_opts node_opts+=" $1" else # The first non-`--` argument is the package; the rest are package args if [[ -z "$package" ]]; then package="$1" else package_args+=("$1") fi fi shift done echo "=============================" echo " npx-safe Log " echo "=============================" echo "Node.js options:" echo " $node_opts" echo echo "Package:" echo " $package" echo if [[ ${#package_args[@]} -gt 0 ]]; then echo "Arguments:" for arg in "${package_args[@]}"; do echo " $arg" done echo fi echo "=============================" npx --node-options="$node_opts" "$package" "${package_args[@]}" }; _npx_safe'$

Karl Horky@karlhorky· Sep 25

Why? Dependabot security alert appears and update generated -> fails because the update is for a pnpm transitive dependency with the error: Dependabot doesn't support the 'updating transitive dependencies' feature for pnpm package_manager

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball #1

Error: Dependabot doesn't support the 'updating transitive dependencies' feature for pnpm package_manager

Dependabot attempted to update your dependencies but encountered an unsupported feature: 'updating transitive dependencies' for pnpm package_manager. Currently, this feature is not supported by Dependabot.

Karl Horky@karlhorky· Sep 25

My request for Dependabot: Full support for @pnpm.io (updates to transitive deps fail currently) Voice support in the issue 🙌 github.com/dependabot/d...

pnpm transitive dependency updates support #13177

Dependabot doesn't support transitive dependency updates for pnpm, a very popular package manager (31M downloads / week as of writing).

Karl Horky@karlhorky· Aug 30

Codemods for Node.js 😍 Looking great, thanks to all contributors!

npx codemod search scope:nodejs
Found 8 packages:

╭─────────────────────────────────────────┬──────────────┬──────────┬──────────────────╮
│ 📦 Name │ 📊 Downloads │ ⭐ Stars │ 👤 Author │
├─────────────────────────────────────────┼──────────────┼──────────┼──────────────────┤
│ @nodejs/fs-access-mode-constants │ 8 │ 4 │ nekojanai (Jana) │
│ @nodejs/util-log-to-console-log │ 8 │ 3 │ Bruno Rodrigues │
│ @nodejs/process-main-module │ 5 │ 4 │ Bruno Rodrigues │
│ @nodejs/tmpDir-to-tmpdir │ 4 │ 4 │ nekojanai (Jana) │
│ @nodejs/rmdir │ 7 │ 6 │ Augustin Mauroy │
│ @nodejs/create-require-from-path │ 5 │ 4 │ Augustin Mauroy │
│ @nodejs/import-assertions-to-attributes │ 7 │ 5 │ Augustin Mauroy │
│ @nodejs/correct-ts-specifiers │ 0 │ 0 │ nodejs │
╰─────────────────────────────────────────┴──────────────┴──────────┴──────────────────╯

Karl Horky@karlhorky· Aug 11

@netlify.com multiple users reporting Netlify edge functions being down, in case you didn't know yet Maybe you can update the status page with the outage? answers.netlify.com/t/the-site-s...

My site https://fincaguarumo.com (hosted by Netlify via fincaguarumo.netlify.app, a next.js app) suddenly returns a 500 error.

In the logs, I can see only this:

Error handling request: TypeError: functions is not a function
at file:///root/src/bootstrap/server.ts:53:45
at mapped (ext:deno_http/00_serve.ts:407:24)
at mapped (ext:deno_http/00_serve.ts:513:16)
at ext:deno_http/00_serve.ts:729:29
at eventLoopTick (ext:core/01_core.js:178:7)
at async netlify:bootstrap-stage1:4:1

I have not changed anything recently, I do not have any custom functions. I have no idea how to debug this error as it seems to stem from Netlify itself and not something on my end.

Just to be sure, I triggered a manual deploy without cache, updated the @netlify/plugin-nextjs to 5.12.0, but to no avail.

The app uses next.js 15.

Is there anything else that can be done on my end?

Karl Horky@karlhorky· Aug 9

VS Code 1.103 (Jul 2025) finally has expandable hovers in JavaScript and TypeScript 😍 for when the hover info is showing the type name instead of the object / array / etc code.visualstudio.com/updates/v1_1...

Karl Horky@karlhorky· Jul 17

Looks like `experimental.typedRoutes` is coming to Next.js Turbopack, thanks to Ben Gubler 🚀 🎉 github.com/vercel/next....

Screenshot of PR, showing that `experimental.typedRoutes` is no longer marked as "unsupported"

Karl Horky@karlhorky· May 21

My work in open source, from fixing papercuts to support students to discussing standards 🚀 Thanks so much to the Open Source Initiative @opensource.org for featuring me as a maintainer for Maintainer Month 2025! opensource.org/maintainers/...

Screenshot of Open Source Initiative blog post by Karl Horky:

Karl Horky: From Papercuts to Standards

Hi, I’m Karl Horky (GitHub, LinkedIn), Technical Founder at UpLeveled – tech education programs for all skill levels.

In an educational landscape of AI-generated solutions, disconnected islands of knowledge and barriers to entry, I focus on helping students level up by designing accessible curricula and contributing to open source.

Then and Now

I’ve been in open source for over 13 years, and in tech for more than 20, through which I have used a range of languages and technologies, from QBasic and C to...

Karl Horky@karlhorky· May 8

AI-generated image alt text in HTML and Markdown in VS Code April 2025 (1.100) 😍 code.visualstudio.com/updates/v1_1...

Generate alt text in HTML or Markdown

You can now generate or update existing alt text in HTML and Markdown files. Navigate to any line containing an embedded image and trigger the quick fix via ⌘. or by selecting the lightbulb icon.

[Screenshot that shows generating alt text for an image html element.]

Karl Horky@karlhorky· May 7

Oh nice, looks like the 2019 idea I had to "skip parameters in function parameter lists" may come to life in @chronicles.org's proposal "void Discard Bindings for ECMAScript" 😍

Parameters

void discard bindings in parameter declarations help to avoid needing to give a name to parameters that might be unused by a callback or an overridden method of a subclass:

```
// project an array values into an array of indices
const indices = array.map((void, i) => i);

// passing a callback to `Map.prototype.forEach` that only cares about keys
map.forEach((void, key) => { });

// watching a specific known file for events
fs.watchFile(fileName, (void, kind) => { });
```

Tweet from @karlhorky

ECMAScript spec people 👇

Is / was there a proposal to skip parameters in function parameter lists like this?

function mapper(, key) { /* use only the key */ }

Karl Horky@karlhorky· Mar 24

GritQL Biome plugins looking great 🔥 More options for simpler linting plugins 👍 ESLint `no-restricted-syntax` is almost there, but esquery can get pretty verbose...

$Here is an example of a plugin that reports on all usages of Object.assign(): // ./path-to-plugin.grit `$fn($args)` where { $fn <: `Object.assign`, register_diagnostic( span = $fn, message = "Prefer object spread instead of `Object.assign()`" ) } output: $ biome lint /packages/tailwindcss-config-analyzer/src/introspect.ts:12:17 plugin ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ✖ Prefer object spread instead of `Object.assign()` 10 │ function createContextFromConfig(config: Partial<Config>) { 11 │ return createContext( > 12 │ resolveConfig(Object.assign({}, DEFAULT_CONFIG, config)), │ ^^^^^^^^^^^^^ 13 │ ); 14 │ }$

Karl Horky@karlhorky· Feb 11

`Cannot find matching keyid` error with latest pnpm? Upgrade to Node.js v22.14.0, which updates to the fixed Corepack 0.31.0 version: Windows: choco upgrade nodejs # or nodejs-lts macOS: brew upgrade node # or node@22 Ubuntu: sudo apt-get --only-upgrade install nodejs

$Deploy log showing "Cannot find matching keyid" error: 3:29:43 PM: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-10.2.1.tgz 3:29:43 PM: /opt/buildhome/.nvm/versions/node/v22.13.1/lib/node_modules/corepack/dist/lib/corepack.cjs:21535 3:29:43 PM: if (key == null || signature == null) throw new Error(`Cannot find matching keyid: ${JSON.stringify({ signatures, keys })}`); 3:29:43 PM: ^ 3:29:43 PM: Error: Cannot find matching keyid: {"signatures":[{"sig":"MEYCIQDkZyZZmBzkRcQowEEFiEcGp4/xV8GBLXxTEzz9QstrsAIhAPx6tvZixjTub6GPqJa82vcWFhUU39JCtoJvcoRK/K39","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"keys":[{"expires":null,"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="}]} 3:29:43 PM: at verifySignature (/opt/buildhome/.nvm/versions/node/v22.13.1/lib/node_modules/corepack/dist/lib/corepack.cjs:21535:47) 3:29:43 PM: at installVersion (/opt/buildhome/.nvm/versions/node/v22.13.1/lib/node_modules/corepack/dist/lib/corepack.cjs:21882:7) 3:29:43 PM: at process.processTicksAndRejections (node:internal/process/task_queues:105:5) 3:29:43 PM: at async Engine.ensurePackageManager (/opt/buildhome/.nvm/versions/node/v22.13.1/lib/node_modules/corepack/dist/lib/corepack.cjs:22316:32) 3:29:43 PM: at async Engine.executePackageManagerRequest (/opt/buildhome/.nvm/versions/node/v22.13.1/lib/node_modules/corepack/dist/lib/corepack.cjs:22416:25) 3:29:43 PM: at async Object.runMain (/opt/buildhome/.nvm/versions/node/v22.13.1/lib/node_modules/corepack/dist/lib/corepack.cjs:23102:5) 3:29:43 PM: Node.js v22.13.1$

Karl Horky@karlhorky· Jan 24

Thanks for the great talk at React Amsterdam @mickey.studio 🎉 Great to see more about this topic in design systems creation: - Drawbacks of rigid, highly-coupled components - Patterns of fine-grained component factoring and composition to counter these drawbacks

Mickey presenting at React Amsterdam, with the slide listing out problems with rigid, highly-coupled components:

- Lacks context
- Complex to maintain
- Complex to modify
- High cognitive load
- Slow iterations
- Prop-drilling
- Lack of control

Karl Horky@karlhorky· Jan 13

> if you use the demo code and print `.get('a[]')` you get the value, right? you get a string - that was the point there is no way to receive an array value, which was the vulnerability forked sandbox: codesandbox.io/p/devbox/pen...

Go to /?a=1&a=2
Go to /?a[]=1&a[]=2
Go to /?a=1,2

Search param for a: null
typeof search param for a: object

Search param for a[]: 1
typeof search param for a[]: string

Karl Horky@karlhorky· Jan 13

This is what we teach to students in the first lecture about TypeScript, that narrowing with runtime code is sometimes required