Programming

Критическое обновление безопасности PHP

graker — Wed, 21 Oct 2026 08:55:00 +0000

Today at 14:00 UTC (5 p.m. Moscow time) a critical PHP security update is coming out: https://www.php.net/archive/2026.php#2026-10-20-1

The update is so monstrously critical that no details are disclosed, so that nobody hacks absolutely everyone in advance.

So get your consoles ready, open your Docker configs and off we go, updating everything one by one.

But if vulnerabilities and updates keep pouring in like this, sooner or later we will really have to let robots loose on production and let them handle it themselves. Otherwise how is one supposed to keep up with all this?

PR на шиссот!

graker — Wed, 07 Oct 2026 18:30:00 +0000

The other day a PR of 610 files was finally defeated and merged! The result is a complete redesign of Docturist. The public part (the landing page and the blog) got a bit of it too, but first of all it is the whole inside: all the pages, forms and dialogs of the CRM itself.

This is one more example of how you can get carried away solving tasks with a neural network. Initially the idea was much more modest. The dashboard, also known as the desktop, also known as the home page inside the system, was made rather simple. This is what it looked like:

Of course, the travel agents reported that they did not use the widgets on this desktop at all. Only the links, to jump straight to the section they need. And I wanted it to be rather a quick access to important sections and information. So that some things could be done without leaving the dashboard at all.

That is what Claude Design and I took on. We rethought the contents of the dashboard to make it convenient and actually used, not just a place for links like the desktop in Win95. And the «before» above turned into a new «after»:

Now there are all kinds of metrics, and most importantly a smarter bookings feed. You can look at the latest bookings by date, or at the ones that need particular attention.

I did not hold back Claude's design impulses, so on top of that I got a new style at once. The previous style was built on the Color Admin theme, which I bought specially back in 2018. The theme has of course aged somewhat since then and lost some of its relevance.

Anyway, once there is a new look, you do not want to leave the other pages in the old one. And so, page by page, component by component, first with Claude Design and then with Claude Code, we brought the whole service to the new styles. And since just redrawing things is boring, we also rethought, improved and remade the components on the pages along the way.

That is how we got a PR of 610 files. Which of course wore me out with reviewing and testing. In the nutshell, the points of my talk (in Russian) on this topic still hold. You have to test, structure, decompose. But not looking at the generated code, as Robert Martin advises, does not work out for me just yet: I checked every screen, inspected the changes, the tests, the front end, and in each part I found something that was not done quite right, or did not work, or caused some new problems.

But in the end I checked everything, tried it by hand and shipped it. So now Docturist has not only a new, rethought, modern design, but also all kinds of usability bits, including:

— Docturist remembers and shows right away the set of tour operators the agent works with most often, no need to search through autocomplete every time.
— / or Ctrl+F immediately starts a search across all data (pressing Ctrl+F again starts the browser's native search).
— Booking documents can be generated and signed right from a popup on the desktop, without having to open the booking.
— The calendar works better on mobile devices (the mobile calendar is simply made anew).
— The profile page is finally split into 5 sections by the topics of the settings.

I am happy with the result, and now updates can be rolled out more often again, without reviewing such huge PRs. Overall the redesign took about a month and a half. Next up are the integration with an online cash register service (already done) and a dark theme (also done). Let's go!

Docturist, a smart planner for travel agents

Нейросети и анализ кода

graker — Wed, 22 Jul 2026 09:15:00 +0000

Yesterday I was estimating a group of ~40 tickets. All of them were created from an AI code analysis report on a large Drupal project. The project is about 10 years old, the codebase has evolved all this time, 20 subdomains, integrations, APIs, content synchronization — all in all, a cool project.

The report is structured, the neural network checked the project for all four horsemen of the apocalypse: Vulnerabilities, Bugs, Slowness and Dirty Code. Originally the report produced many more tasks, but I slapped won't fix on about 30% of them right away. There were glitches and misunderstandings of the context. But 40 tickets still remained.

Most of them are also tasks of the very lowest priority, like

a custom module doesn't declare a dependency on something like paragraphs;
somewhere in the code a brazen programmer called \Drupal::service() instead of using dependency injection;
somewhere deprecated Drupal versions haven't been removed from the supported versions, and so on.

There were also a few more serious issues:

a couple of N+1 problems;
several XSS vulnerabilities (only accessible to admins, but still);
several places lacking checks for whether a key exists in an array (spamming the log with warnings);
and even one timing oracle vulnerability.

Yes, dirty code is a sign of dirty thoughts :) Yes, it would be nice to clean it all up. But apart from 3–4 issues, it adds up to more than a hundred hours of work in total, and the payoff is slightly cleaner code, tidied-up legacy, a bit less tech debt and fewer warning/debug entries in the log. It's nice, of course, when the client doesn't mind such a spring cleaning. And all honor and glory to the account managers who can convince the client of the need for such cleaning when its value to the end user is roughly zero.

And these reports still leave a strange feeling. They do find something. But so far these reports bring much more fuss than benefit.

Виртуализация локальной разработки, docker-compose и traefik

graker — Thu, 25 Jun 2026 15:20:00 +0000

A long time ago I described a fairly simple way to virtualize the projects I work on, so it's easy to switch between them and they don't get in each other's way. 7 years have passed and of course the approach has evolved. Back then, using separate containers started with `docker run` was faster and more convenient, so I didn't write Dockerfiles and docker-compose files. But progress did catch up with me on this one and won. Now I use docker compose for local development too.

Still, I try not to use tools with all sorts of presets like lando or ddev. Mostly because when I ran into them, they worked fine — until I needed to change something in them or do something non-standard. After that the brain-melting began, sometimes so bad that it was easier to rebuild everything myself right away.
Besides, if you build "clean" environments, you have a chance to better understand how it all works, and if you use lando, forge, ddev and the like — the opposite.

So, why docker compose is better.

Код пишут роботы, но отвечать за него нам

graker — Wed, 08 Apr 2026 08:20:00 +0000

Lately I've been using generative neural networks in agent mode more and more in development; for simplicity, let's call it vibe coding, like everyone does. Why not? These days every toaster and its grandmother is vibe coding and telling everyone how great it has become. And in terms of opening up development to those who couldn't develop before, it really is great, by the way.

But those who could develop on their own before still look at the subject from a slightly different angle. So I decided to let my thoughts wander a bit, grumble, be a bit of a bore and reflect not on how to set up Codex or an MCP server, or how to unleash Claude Code on KWork. But on the effects, on the inevitable changes that neural networks have brought, are bringing and will bring into our daily work — into software development by living human people.

First, let's briefly define our place in space and time relative to the very phenomenon of neural networks (here and below — in software development). It's too late to discuss whether they are needed, whether they help, whether we should use them. That question is off the table. If you somehow haven't started yet, you should. The cat looks at the clock and says: it's time!

С Днём программиста!

graker — Sat, 13 Sep 2025 12:40:00 +0000

Happy Programmer's Day, programmers!

Today we can all bathe in torrents and smash up internet cafes!