Przemysław Zalewski

Maintenance, upgrades and CI/CD

A DevOps developer who upgrades and migrates without downtime

Dependencies several majors behind, Postgres 14 out of support on 12 November 2026, and only one person who knows how to deploy? I upgrade in waves you can revert, migrate databases and hosting without a big bang, and set up CI/CD in GitHub Actions and Docker that anyone on your team can run. The suppression-list platform I led shipped blue/green with zero downtime at 300+ GB in Postgres. Paste your package.json below for a free upgrade plan.

Book a free 30‑min call Email me instead

Calls this week · work can start now · Wrocław, Poland (CET), remote

Przemysław Zalewski
15+years shipping software
8,000+commits on one product, close to half of all merges
300+ GBof production data on one platform I led
8platforms shipped for Sandtime.io as founding engineer

Sound familiar?

Maintenance and CI/CD problems I fix in 2026

npm audit shows hundreds of vulnerabilities. Where do we start?

Black Duck’s 2026 OSSRA report (25 February 2026) counted a mean of 581 open source vulnerabilities per audited codebase, up 107%. It also found that 92% of codebases carry components four or more years out of date (Black Duck).

I upgrade in waves you can revert: patch and minor batches first, then tooling, frameworks and the runtime. Each wave is a pull request gated by your tests. A typical app is often done in one evening, and the planner on this page shows your waves before we talk. From 2018 to 2026 I made about nine in ten of the dependency, runtime and security-update changes across more than a dozen repositories.

npm install broke: postinstall scripts no longer run

npm 12 became generally available on 8 July 2026. It blocks dependency install scripts and implicit node‑gyp builds unless the project allows them, and it stops resolving git and remote URL dependencies by default (GitHub changelog).

With npm approve-scripts I list every package that wants to run a script and allow only the ones that need a build step. Then I commit the allowlist to package.json and pin the npm version, so laptops and CI install the same way. In September 2026, when a degraded npm audit service stalled every install and pushed our CI past its 45‑minute timeout, I traced it the same day and turned off the audit call in every install, without touching a single dependency.

Sound like you? Book a free 30‑min call →

Can a fork pull request steal our GitHub Actions secrets?

Since 20 July 2026, actions/checkout refuses fork code in pull_request_target workflows. Workflows pinned to a SHA or an exact version did not get the backport and keep the old behavior until upgraded (GitHub changelog).

I move untrusted code to the pull_request event with a read‑only token, cut GITHUB_TOKEN permissions to what each job needs, and pin actions to SHAs that Dependabot keeps current. Each change lands in its own pull request your team can read. In autumn 2026 I set up a product’s GitHub Actions so pull request checks run read‑only with no secrets, production keys live only in a protected environment that dependency install scripts never see, and every action is pinned to a commit.

AI agents ship more code, and production breaks more often?

New Relic’s 2026 State of AI Coding report (10 June 2026) found that 94% of technology leaders rate AI‑generated code as higher quality than human-written code at review, yet 82% had at least one production failure tied to it in the past six months, and 78% report more incidents after it ships (New Relic).

In 2026 about two thirds of merged PRs across two products were built with coding agents, and nearly all went through my review or merge. I set up the same gate for you: lint, types, tests and a preview deploy on every PR, and a human does the merge. In May 2026 a sign‑in page went down while monitoring stayed green, because it only checked for HTTP 200; I fixed the cause and changed the monitors to check that the page actually works.

Facing one of these? Book a free 30‑min call →

Why me

Upgrades with a safety net

Tests first where the money paths are, then upgrades in waves: patch and minor batches, tooling, frameworks, runtime. Codemods where React, Next.js or ESLint ship them, manual diffs where they do not. Each wave is a pull request you can revert.

Migrations without a big bang

Dual‑write and backfill for databases, blue/green for hosting, a strangler for frameworks. Rehearsed on a copy, rolled back at least once on purpose, measured in PostHog after the cutover.

CI/CD you can read

GitHub Actions workflows that fit on one screen, reproducible Docker builds, secrets out of the repo, and a red build that says why it failed. Your team deploys without calling me.

Legacy kept alive, then moved

Old Node.js and React, jQuery, PHP sites, C# and .NET services. Keep them running, put tests around them, move them piece by piece when the business can afford it. More on C# on the .NET page.

Live demo

Plan your dependency upgrades

Paste a package.json. The planner reads the version ranges, compares them with the current majors of the common packages and groups the upgrades into four waves: safe batch, tooling, frameworks, runtime. Known breaking changes get a note. Everything runs in your browser, nothing is uploaded.

Demo loading…

Packages the table does not know are listed for a manual check, never guessed.

Ways to work together

Four shapes of engagement

Want a number first? The configurator shows hours, a price range and the start date. The call is free either way.

2 weeks

Dependency upgrade sprint

Every outdated package grouped by risk, upgraded in waves with the test suite as the gate, codemods where the framework ships them, a changelog your team can read. Node, React, Next.js, TypeScript, ESLint, Tailwind and the long tail.

Book a free call →

1 week + cutover

Migration plan and cutover

Database, hosting or framework. A written plan with dual‑write or blue/green, a rehearsal on a copy, a rollback that was tested, then the cutover at a time you choose. No weekend heroics.

Book a free call →

1 week

CI/CD setup

GitHub Actions with lint, test and build gates, Docker images that build the same way everywhere, preview deploys, a production deploy that is one approval away. Documented so nobody needs me to run it.

Book a free call →

monthly

Maintenance retainer

A fixed number of days a month: updates, same‑day patches for critical advisories (React2Shell was patched the day it was announced), alerts, the small fixes that pile up, and a monthly report of what changed and what you need to decide.

Book a free call →

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Same-day response to React2Shell and other advisories

The problem
Critical advisories in React, Node.js, WordPress and OpenSSH land without warning and proof‑of‑concept scanners follow within days.
What I did
A fixed pattern: official source, patch the same day, WAF mitigation, a regex sweep of our own code for the same vulnerability class, hardening flags for Node.js, reading material for the team.
Result
React2Shell patched the day the advisory went out, days before public scanners went live.

same‑day patch WAF code sweep

See also: TypeScript & Node.js · Next.js

Owning a software company’s infrastructure, email migration included

The problem
A software company needed one person to own what nobody else watched: domain reputation, certificates, container images, keys, and a move of the whole company’s email to a new domain without losing deliverability.
What I did
I moved the company’s email to the new domain in June 2026 and co‑wrote the post-mortem, moved container images to a new registry, ran key rotation and a certificate runbook across six hosts, and watched domain reputation across the product portfolio.
Result
About three quarters of all infrastructure commits were mine. When production certificates once expired, the service was back in about 90 minutes, including restoring my own VPN and SSH access. Since October 2026 a backup only counts once an automatic restore of it has succeeded.

~3/4 of infra commits email migration ~90 min recovery

See also: Email

Help center moved from WordPress into the repo as docs-as-code

The problem
An unmaintained WordPress help site: red in audits, no sitemap, expiring certificates, plugins nobody understood.
What I did
Markdown in the repo, versioned with the product, all languages generated automatically, interlinking, 301 redirects for every old address, help added to the Definition of Done.
Result
One machine less to break during holidays, docs that match the product, better SEO and GEO, context agents can read.

docs‑as‑code 301s i18n

See also: Cloudflare · Next.js

Offer: Your company site off WordPress, in a few hours

Facing something similar? Book a free call →

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Good to know

Maintenance dates and CI traps in 2026

Postgres 14 ends on 12 November 2026

Each Postgres major gets 5 years. 14 loses support on 12 November 2026 and 15 on 11 November 2027 (PostgreSQL versioning).

GitHub Actions dropped Node 20

Since 23 September 2026 JavaScript actions run on Node 24 and the opt‑out variable is gone. Self-hosted runners on macOS 13.4 or older and ARM32 are out (GitHub changelog).

Every job rounds up to a full minute

GitHub bills each job rounded up to the next whole minute, per runner type. macOS minutes cost about ten times Linux (GitHub billing).

Bot pull requests do not start CI

Events created with GITHUB_TOKEN do not trigger new workflow runs, except workflow_dispatch and repository_dispatch. That is why an automated PR shows no checks (GitHub docs).

Scheduled workflows drift and switch off

Cron runs are delayed at the top of each hour and can be dropped. In public repositories, schedules turn off after 60 days without activity (events docs, disabling workflows).

Dependabot stops at five pull requests

By default Dependabot keeps at most 5 version-update PRs open. Security updates have a separate limit of 10, and cooldown never delays them (Dependabot options).

FAQ

Questions people ask before they book

Which platforms and tools?
GitHub Actions, Docker, nginx, Cloudflare Workers and Pages, Postgres, PostHog for monitoring, Playwright for the gates. If your stack lives on a cloud I do not work with, I will say so on the call. Edge deployments are covered on the Cloudflare page.
Can you upgrade a Next.js app that nobody dares to touch?
Yes. Tests around the pages that earn money, then Next.js and React in separate waves with the official codemods, then the long tail. If the app would be better off without Next.js, the Next.js page explains the honest exit plan.
Database migration with no downtime?
Dual‑write, backfill, verify, switch reads, switch writes, remove the old path. Rehearsed on a copy with production-sized data, with a rollback tested before the real cutover. The suppression-list platform I led ran 300+ GB in Postgres with zero-downtime blue/green deploys.
Do you do security patches and vulnerability response?
Yes, the same day. Official advisory, patch, a WAF rule for the gap, a search of your code for the same mistake, notes for your team. React2Shell was patched the day it was announced, days before public scanners went live.
Can your coding agents do the boring updates?
They open the pull requests, under rules I wrote, and a human reviews every one. In 2026 about two thirds of merged PRs across two products were built with coding agents, and nearly all went through my review or merge. The rules are on the AI consultant page.
What does maintenance cost?
$36⁠–⁠54 an hour net, depending on how hard the work is. The pricing page has the full table, and you get the scope and price in writing within 24 hours of the call.
How soon can you start?
Now. Book the call and bring the upgrade plan from the planner above.
Why did my GitHub Actions break in September 2026?
Node 20 was removed from runners on 23 September 2026, together with the opt‑out variable (GitHub changelog). Update actions to versions that run on Node 24.
Why does CI fail with toomanyrequests from Docker Hub?
Anonymous pulls are limited to 100 per 6 hours per IP address, and shared runners share addresses (Docker docs). Log in to Docker Hub in CI or use a registry mirror. Over 10 GB, the Actions cache is billed too (GitHub docs).
npm audit shows hundreds of vulnerabilities. Where do we start?
Black Duck’s 2026 OSSRA report (25 February 2026) counted a mean of 581 open source vulnerabilities per audited codebase, up 107%. It also found that 92% of codebases carry components four or more years out of date (Black Duck). I upgrade in waves you can revert: patch and minor batches first, then tooling, frameworks and the runtime. Each wave is a pull request gated by your tests. A typical app is often done in one evening, and the planner on this page shows your waves before we talk. From 2018 to 2026 I made about nine in ten of the dependency, runtime and security-update changes across more than a dozen repositories.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

What does a DevOps engineer grow in the garden?Punchline

Pickles. In containers. Ba‑dum‑tss.

What does Git order at the bar?Punchline

Anything with a cherry-pick. Ba‑dum‑tss.

What do you call a deploy at 5 pm on a Friday?Punchline

Your weekend plans. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work can start now · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

CloudflareWorkers, Durable Objects, R2, Workers AI, with cost caps.Live demo C# & .NET (legacy)Keep the old system alive, then move it without a rewrite.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack