Helpful GatsbyJS Tutorials
September 9, 2026 · StaticCraft Team
Static does not mean safe: how to ship security headers on a Gatsby 5 site, generate a Content-Security-Policy with inline-script hashes at build time, and roll it out report-only without breaking the deploy.
Read moreSeptember 9, 2026 · StaticCraft Team
A peer-dependency audit you can run in five minutes, the Node bump done first and on its own, the React 18-only blockers to clear (react-helmet, string refs, react-test-renderer), how to force React 19 with npm overrides, and the CI gates that prove it works.
Read moreSeptember 9, 2026 · StaticCraft Team
A practical measurement setup for Gatsby 5: load tags without blocking hydration, run a consent gate that actually withholds requests, wire Google Consent Mode v2 defaults, and attribute contact-form leads with first-party data only.
Read moreSeptember 9, 2026 · StaticCraft Team
Gatsby ships no server, so the attack surface is the build. A practical hardening pass: lockfile-only installs, disabled lifecycle scripts with an allow-list, release-age cooldowns, npm provenance, minimal build secrets, and SBOMs.
Read moreSeptember 9, 2026 · StaticCraft Team
Gatsby Cloud's Image CDN is gone, so image processing is back in your build. A practical setup for gatsby-plugin-image on Gatsby 5: sharp tuning, AVIF, cache persistence, and when to offload to an external image service instead.
Read more