Which of my Home Assistant integrations are about to break?
Of 4,009 HACS integrations crawled today against core 2026.10, 825 use an API that is going away and 2,411 are clean. The next 10 break in Home Assistant 2026.10.
Answers
Can I upgrade to ESLint 10 yet?
46 of 54 plugins run clean on ESLint 10.10.0, measured by actually executing them rather than reading a peer range. 6 worked on 9.39.5 and no longer do.
What actually runs when I npm install?
Of 3,192 packages audited from a download-ranked sample today, 28 run an install script and 17 of those score HIGH risk. The biggest is esbuild at 255M installs a week.
What I ship
18 published packages. 1,361 installs a week between them. Download counts include CI and mirrors, so read them as reach rather than as people.
| Package | Install | Weekly |
|---|---|---|
| runner-driftDetect, attribute and report GitHub Actions runner-image tool drift. Locks the tool versions your CI actually uses and names the runner-images commit that changed them. | npm i runner-drift | 285 |
| eslint10-matrixCan you upgrade to ESLint 10 yet? A nightly matrix of ESLint plugins actually executed against real ESLint 9 and 10 installs, plus a CLI that answers it for your repo. | npm i eslint10-matrix | 181 |
| gemcatchFire-and-forget CLI for Gemini's Interactions API background execution. Submit long-running research prompts, close your laptop, collect results later. | npm i gemcatch | 175 |
| mcp-app-debugLocal debug host for MCP Apps. Renders your server's app in a real browser with full postMessage protocol visibility and 5 automated diagnostics. | npm i mcp-app-debug | 155 |
| ts7-compat-guardTypeScript 7.0 / tsgo readiness scanner. Compiler-API deps and removed tsconfig options with line numbers, plus advisories. Config-only, so no false positives. CLI, GitHub Action, SARIF. | npm i ts7-compat-guard | 142 |
| npm-script-lensSee what an install script actually does before you approve it: behavioral analysis, binding.gyp inspection and resolved provenance identity for npm 12 allowScripts, pnpm allowBuilds, yarn and bun | npm i npm-script-lens | 136 |
| mcp-vetScan MCP server source for patterns that break under the 2026-07-28 Model Context Protocol spec. | npm i @booyaka/mcp-vet | 94 |
| wow-secret-lintFind WoW retail addon Secret Value violations in Lua before they ship. CLI plus GitHub Action. | npm i wow-secret-lint | 65 |
| cargo-witnessDetect Rust supply-chain attacks by diffing published crate artifacts against their git source (attested/exact-commit). CLI + daemon + GitHub Action. | npm i cargo-witness | 30 |
| actions-atticArchive workflow runs, checks and statuses into your repo before GitHub deletes them from 2026-10-01 | npm i actions-attic | 27 |
| agent-plugins-conformance-kitConformance test suite for Agent Plugins 1.0.0 client loaders: 133 real plugin fixtures, a runner, and an adapter contract. | npm i agent-plugins-conformance-kit | 18 |
| cse-bridgeSelf-hosted drop-in for Google's Custom Search JSON API (shutting down 2027-01-01), backed by your own SearXNG. Change one base URL, keep your code. | npm i cse-bridge | 14 |
| grokscopeReal-time developer community intelligence from X, powered by Grok 4.5's native x_search - cited, clickable, in your terminal. | npm i grokscope | 10 |
| studio-osSelf-hosted studio management for yoga/pilates/gyms - booking, class packs, memberships, waivers. Payments on YOUR OWN Stripe account: no processing markup, no per-booking fees, no contracts. The Mindbody escape hatch. | npm i studio-os | 7 |
| grok-loop-kitAutomatic Grok 4.5 context compaction for xAI Responses API agent loops. Node, Python, and a LangChain/LangGraph adapter. | npm i grok-loop-kit | 6 |
| pnpm11-ci-guardDetect and fix pnpm v11 silent-failure patterns in Dockerfiles and GitHub Actions workflows, the half of the migration pnpm's own codemod does not reach. | npm i pnpm11-ci-guard | 6 |
| pal-schema-collectpalsc validates PalSchema Schema Generator output and submits it to palschema-hub as an automated GitHub PR. | npm i pal-schema-collect | 5 |
| pmpt-ejectRescue your OpenAI reusable prompt objects before v1/prompts shuts down on 2026-11-30, then keep hot-fixing prompts with no redeploy. Zero dependencies. | npm i pmpt-eject | 5 |
Upstream
When I depend on something and hit a real bug, I send the fix back. 49 merged pull requests across 29 projects, including core, koreader, nvim-lspconfig, gh-dash, ai-toolkit, sqlfluff, lualine.nvim, awesome-nodejs-security. 34 more open. Every PR I've opened.
Elsewhere
The Daily Fable is one brand-new generative piece every day, made end to end by an AI. Latest: Day 51 — Couplet, a board game found by search, 2026-09-16.