`GitHub App` Installation Tokens Add Per-Request Override Header

// related

• #0001

  #0001Infra & SaaSGeekNews2 days ago

  Is Google Turning Into IBM?

  50radar

  Vertical integration turned from strength into operational drag. The Railway incident makes blind reliance on Google Cloud support hard to justify.

  • —Google owns silicon, TPU, data centers, models, and search; that stack now carries product and org overhead.
  • —Railway reportedly had its GCP account blocked, exposing a trust problem around automated deletions and missing support paths.
  • —The practical move is boring: keep backups, billing alerts, and provider exit plans ready before cloud lock-in bites.

  Source: news.hada.io/topic?id=29817Read original →
• #0002

  #0002Infra & SaaSGeekNews2 days ago

  10-Year Blog Moves From Ubuntu 16.04 VPS to FreeBSD

  40radar

  A long-running VPS hit OS support and security limits, then moved to cheaper Hetzner hardware. Useful as a reminder to budget migration time before uptime turns into liability.

  • —The old DigitalOcean VPS ran 1,491 days on Ubuntu 16.04 LTS; impressive uptime also means delayed patch and support risk.
  • —The new Hetzner VPS costs under 6 euros/month, below the previous $13/month server while offering stronger specs.
  • —FreeBSD 14.3 plus Jails points to a lean isolation model; practical for low-traffic services, but operational familiarity matters.

  Source: news.hada.io/topic?id=29801Read original →
• #0003

  #0003Infra & SaaSGitHub Changelog3 days ago

  Staged publishing and new install-time controls for npm

  70radar

  npm enhances supply-chain security with staged publishing and new --allow-* install flags. These features provide granular control over package sources, mitigating dependency attacks.

  • —staged publishing: Publish with npm publish --stage <name> and later promote with npm stage promote. This prevents accidentally tagging a pre-release as `latest`.
  • —--allow-* flags: New flags like --allow-file and --allow-remote let you explicitly whitelist installation sources during npm install, expanding on the existing --allow-git.
  • —Both features focus on hardening defenses against supply-chain attacks. It's a good practice to configure them in .npmrc even for solo projects with many dependencies.

  Source: github.blog/changelog/2026-05-22-staged-publishing-and-nRead original →