digest: add issues for 2026-07-21

Author: github-actions[bot]

src/posts/2026-07-20_biomejs-biome.md

@@ -0,0 +1,30 @@
+---
+date: 2026-07-20
+repo: biomejs/biome
+size: L
+title: "YAML, CSS, and inference fixes land"
+excerpt: "Big linting and formatting improvements: incomplete type inference is suppressed, CSS comments are preserved, YAML docs format better, and daemon/LSP shutdown is fixed."
+commits: 8
+authors: [ematipico, ayaangazali, dyc3, Netail, denbezrukov]
+commit_authors: {"ab8c21b": ematipico, "edc0ed7": ayaangazali, "546e5ba": dyc3, "5039a1e": ematipico, "b7a9694": denbezrukov, "726fa14": ematipico}
+---
+
+### **Type inference now avoids incomplete-result false positives** (726fa14, ab8c21b)
+Biome tightened its JS/TS inference so partially resolved types no longer drive incorrect diagnostics in rules like `noMisusedPromises`, `useAwaitThenable`, `useExhaustiveSwitchCases`, `noBaseToString`, and `useNullishCoalescing`. The underlying inference work also improves member/Promise resolution and now handles generic defaults more faithfully, which should make several type-aware rules both more accurate and less noisy.
+
+### **CSS formatter preserves selector-boundary comments** (b7a9694)
+Comments around CSS selector combinators are now kept on the correct side of the boundary instead of being misplaced during formatting. The formatter also better handles escaped newlines in attribute selectors, which fixes a class of layout-stability and comment-placement regressions in CSS and SCSS output.
+
+### **YAML formatter now handles document markers and directives** (546e5ba)
+YAML formatting gained dedicated handling for `---`/`...` markers and directives, so comments stay attached to the right document element across multi-document streams. The verbatim formatter was also adjusted to avoid double-printing comments and to preserve source ranges more accurately.
+
+### **Daemon proxy no longer dies when one client disconnects** (5039a1e)
+The LSP proxy path was reworked so stdin/stdout forwarding stops cleanly when either side disconnects, instead of letting one editor close out a shared daemon for everyone else. That’s a significant reliability fix for users running Biome through long-lived editor integrations.
+
+### **HTML ARIA role inference now respects shorthand attributes** (edc0ed7)
+`useAriaPropsSupportedByRole` now accounts for shorthand attributes when computing an element’s implicit ARIA role in Astro, Svelte, and Vue-like templates. This removes false positives for patterns like `<a {href} aria-label="...">`, where the element should still be recognized as a link.
+
+### Other misc changes
+- Updated `globset` to 0.4.19
+- Added/adjusted Cargo audit ignore entries
+- Preview CI config tweak

src/posts/2026-07-20_denoland-deno.md

@@ -0,0 +1,76 @@
+---
+date: 2026-07-20
+repo: denoland/deno
+size: L
+title: "Deno hardens loaders, cache, and HTTP/2"
+excerpt: "JSON module mismatches, persistent web cache storage, inspector console bridging, and HTTP/2 backpressure got major fixes."
+commits: 21
+authors: [nathanwhit, bartlomieju, crowlbot, Hixie, wilkmaciej, divybot, akazwz]
+commit_authors: {"2652840": nathanwhit, "9049005": nathanwhit, "e0431ff": nathanwhit, "01c89b8": nathanwhit, "19c7442": nathanwhit, "e471f87": nathanwhit, "8fd04bc": bartlomieju, "5419c02": wilkmaciej, "13ce29b": Hixie, "191a0cb": bartlomieju, "f2ac97c": bartlomieju, "530c088": divybot, "57e67f1": akazwz, "4feb77b": crowlbot, "ac57574": crowlbot, "d7fbd3d": Hixie, "f9ea4e8": bartlomieju, "39f0c9d": crowlbot, "b939e9e": nathanwhit, "f6b2b65": bartlomieju}
+---
+
+### **JSON imports are now enforced in both directions** (e0431ff)
+`FsModuleLoader` now rejects files that don’t actually resolve to JSON when a JSON module is requested, closing the reverse mismatch that could previously return JavaScript for a JSON import. That makes loader behavior consistent and surfaces a clearer `TypeError` with the real module type and specifier.
+
+### **Resolver loader now blocks non-JSON sources for `type: "json"`** (9049005)
+The loader path now checks that modules requested with `type: "json"` really resolve to JSON media, including prepared modules and npm/BYONM loading. This fixes an inconsistency where JavaScript could slip through a JSON import and adds a targeted regression for that mismatch.
+
+### **Cache API storage moves under origin data** (01c89b8)
+Web Cache data is no longer stored in a temp directory; it now lives beneath Deno’s origin-data location with per-origin hashed subdirectories. That makes Cache API state persistent in the expected place and tightens the filesystem handling around redirected cache paths.
+
+### **HTTP/2 writes now apply real backpressure** (19c7442)
+Node-compatible HTTP/2 stream writes are now queued and completed only after nghttp2 actually frames the bytes, so `Http2Stream.write()` can correctly signal backpressure. The change also cancels queued writes when a stream is destroyed, preventing unbounded native buffering.
+
+### **N-API external string finalizers are synchronized** (e471f87)
+External string cleanup was reworked into a single synchronized registry that preserves the right callback/hint pair for each V8 resource and safely handles teardown races. This closes a class of use-after-free and wrong-finalizer issues for external strings.
+
+### **Local `.wasm` imports now type-check correctly** (8fd04bc)
+`deno check` and `sync-types` now include local `file://` wasm modules, generating declarations and wiring them into the temporary tsconfig so relative wasm imports resolve. This fixes the spurious “Cannot find module” error for typed local wasm exports.
+
+### **Late-opened inspectors now receive console output** (5419c02)
+The main runtime now always bridges `console` into the inspector, instead of only doing so when `--inspect*` was set at startup. That restores `Runtime.consoleAPICalled` events for sessions opened later via `node:inspector` or SIGUSR1, matching worker behavior and improving the debugger experience.
+
+### **`deno fmt` preserves embedded CSS indentation** (13ce29b)
+Formatting for multiline embedded CSS custom properties is now stable, preventing indentation churn in formatted output. This is a narrow but user-visible formatting fix.
+
+### **`jsr:` entrypoints now discover config files** (191a0cb)
+Entry-point resolution now finds the appropriate config file for `jsr:`-based runs, fixing cases where dependency-age and config discovery logic disagreed. That makes `deno run` behavior more predictable for JSR entrypoints.
+
+### **Outdated/npm updates stop downgrading on stale cache** (f2ac97c)
+The lockfile update flow now avoids downgrading packages when the npm cache is stale. That prevents a subtle but important regression in update behavior and keeps dependency resolution moving forward.
+
+### **The extensionless-CJS guard is now tested** (530c088)
+Added coverage for the resolver’s extensionless CommonJS binary guard. This is test-only validation of an existing internal rule.
+
+### **React Router desktop HMR is enabled** (57e67f1)
+The desktop framework path now enables `--hmr` for React Router. This is a small feature toggle change with limited surface area.
+
+### **DNS queries retry after per-attempt timeout** (4feb77b)
+The Node-compatible DNS layer now retries queries when an individual attempt times out. This improves reliability under transient resolver slowness.
+
+### **CI disk usage is reduced before deno_core tests** (ac57574)
+The CI workflow now frees disk space before the `deno_core` test job. This is a build/infrastructure tweak to reduce job failures from storage pressure.
+
+### **Type-only dependencies are retained in outdated lockfiles** (d7fbd3d)
+The outdated/update flow now keeps type-only dependencies in the lockfile instead of dropping them. This fixes an important dependency-graph edge case for projects that rely on type-only JSR packages.
+
+### **Hot internal hash maps switch to FxHash** (f9ea4e8)
+Several frequently used internal maps and sets were migrated to `FxHash`-based hashing for faster lookups. This is a performance-oriented refactor across resolver, checker, and npm-resolution code paths.
+
+### **N-API async sends are canceled after close** (2652840)
+Async `uv` work now stops dispatching once a handle is closed, preventing callbacks from racing teardown. That protects against late work running on already-closed native state.
+
+### **npm test registry tolerates malformed advisories bodies** (39f0c9d)
+The test npm registry now accepts a bad advisories request body without failing the test harness. This is a test-server robustness fix.
+
+### **Published source rewrites are more tightly constrained** (b939e9e)
+The publish/unfurl pipeline got a substantial rewrite to limit when generated source paths are rewritten. That reduces the risk of publishing incorrect or over-transformed source references.
+
+### **Per-file check tsconfigs now live in temp** (f6b2b65)
+`deno check` now writes its per-file tsconfig to the system temp directory instead of the project root. This avoids polluting repositories with generated config files.
+
+### Other misc changes
+- Dependency bumps and lockfile updates
+- CI/build tweaks and workflow edits
+- Test-only harness updates and new regression fixtures
+- Small internal refactors and helper cleanups

src/posts/2026-07-20_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-20
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-20_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-20
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-20_leanprover-lean4.md

@@ -0,0 +1,36 @@
+---
+date: 2026-07-20
+repo: leanprover/lean4
+size: L
+title: "VCGen fix, stateful linters, and grind cleanup"
+excerpt: "Lean4 adds stateful linter plumbing, fixes a vcgen annotation bug, improves grind homomorphism support, and tightens universe linting."
+commits: 16
+authors: [leodemoura, sgraf812, hargoniX, TwoFX, wkrozowski, eric-wieser]
+commit_authors: {"3259610": sgraf812, "f77ee21": leodemoura, "dc1498b": hargoniX, "8e7d074": hargoniX, "29f574e": leodemoura, "e300ebc": TwoFX, "9a61e83": wkrozowski, "e1832d7": wkrozowski, "1e207c4": TwoFX, "33ae929": eric-wieser, "5ea1d32": leodemoura}
+---
+
+### **Stateful linters land in command elaboration** (9a61e83)
+Lean now supports persistent, two-phase linters that can carry state across commands. The new API lets linters run an early phase and a late phase with shared state, opening the door to more powerful checks and cross-command analysis.
+
+### **vcgen now reads goal types through `have`/`let`/`suffices`** (3259610)
+This fixes a failure where `vcgen` could not determine the program type after tactic annotations desugared through `noImplicitLambda` metadata. In practice, `vcgen` now works in more common proof patterns instead of dropping through and emitting an unusable triple.
+
+### **`grind` homomorphism support is expanded and renamed** (f77ee21, 29f574e, 5ea1d32)
+The `grind` attribute modifiers are being migrated from `homo`/`homo_pred` to `hom`/`hom_pred`, with the new spellings wired through parsing and validation. At the same time, `grind` now records source types for homomorphism rules, which helps it track which terms should be treated as solver-relevant.
+
+### **`Sym.(D)Simp.evalGround` learns more BitVec and Bool operations** (dc1498b, 8e7d074)
+Ground evaluation now covers additional `BitVec` operations, and boolean equality/inequality cases are handled more directly. `Sym.dsimp` also gains an option to rewrite inside instances, which is useful when rewriting ground terms to make instance heads syntactically match.
+
+### **IO error decoding is fixed, then the fix is reverted for Windows** (33ae929, e300ebc)
+A runtime change made `lean_decode_io_error` use thread-safe error decoding and adjusted `IO.Error.osCode` semantics to better match POSIX-style errno handling. That was immediately reverted pending Windows follow-up work, so the day ends with the runtime change backed out.
+
+### **`checkUnivs` now accounts for mutual declarations and constructors** (e1832d7)
+The universe linter now considers related declarations in a mutual block, including constructors for inductives, when deciding whether universes only ever appear together. This reduces false positives for structures and inductive types whose self-references would otherwise skew the analysis.
+
+### **`Nat.nextPowerOfTwo` gets more lemmas** (1e207c4)
+Lean adds a batch of new lemmas around `Nat.nextPowerOfTwo`, along with some reshuffling of the surrounding `Power2` files. This broadens the library support for power-of-two reasoning.
+
+### Other misc changes
+- Stage0 updates (4 commits)
+- `repeatM` docstring/internal-lemma cleanup
+- Minor grind/core attribute and test adjustments

src/posts/2026-07-20_microsoft-typescript-go.md

@@ -0,0 +1,23 @@
+---
+date: 2026-07-20
+repo: microsoft/typescript-go
+size: M
+title: "API adds type parameter accessors; LS selection improves"
+excerpt: "New native-preview APIs expose type parameter constraints/defaults, while language service smart-selection and a diagnostic fix land."
+commits: 3
+authors: [navya9singh, weswigham]
+commit_authors: {"d1dc426": navya9singh, "7a831bd": weswigham}
+---
+
+### **TypeParameter now exposes constraint/default getters** (7f717c5)
+The native-preview API now lets clients query a type parameter’s constraint and default directly, with async and sync surfaces updated in lockstep. The checker logic distinguishes type parameters from substitution types so these getters can return `undefined` when appropriate instead of forcing a type, which makes the API safer and more accurate.
+
+### **Smart selection handles mapped types better** (d1dc426)
+Selection-range generation was expanded to build a more structured tree for mapped types, grouping modifiers and bracketed type-parameter sections so editor selection behaves more naturally inside these constructs. That should improve expand/shrink selection in mapped type declarations and reduce awkward jumps.
+
+### **Suppress diagnostics for context-sensitive parameter lookups** (7a831bd)
+The checker no longer emits extra diagnostics when it is only fetching parameter types for context-sensitive signatures, avoiding noise from temporary or soon-to-be-overridden inference states. This also fixes the related baseline instability seen in reverse-mapped type inference cases.
+
+### Other misc changes
+- API naming/wiring tweak in native-preview request payloads
+- Test baseline updates for smart selection and checker diagnostics

src/posts/2026-07-20_nodejs-node.md

@@ -0,0 +1,20 @@
+---
+date: 2026-07-20
+repo: nodejs/node
+size: M
+title: "FFI wrapper fix, docs cleanup, stale policy shortened"
+excerpt: "Node.js tightens FFI signature handling, refreshes key crypto/net docs, and reduces the stale issue window from 7 months to 3."
+commits: 4
+authors: [samuel871211, panva, avivkeller, trivikr]
+commit_authors: {"5b27fb9": panva, "00917ba": trivikr}
+---
+
+### **FFI wrappers now read signatures only once** (00917ba)
+`DynamicLibrary.getFunction()` and `getFunctions()` now build wrappers from metadata captured by native code instead of re-reading signature objects in JavaScript. That fixes cases where getters, proxies, or mutated signature objects could make the native and JS views disagree, and it adds coverage for the single-read behavior.
+
+### **Crypto/WebCrypto docs switched from dense tables to grouped lists** (5b27fb9)
+The crypto and WebCrypto API docs were reorganized to make algorithm support easier to scan, replacing large capability tables with grouped lists by supported formats/APIs. This is mostly documentation churn, but it materially improves readability for a complex part of the API surface.
+
+### Other misc changes
+- Clarified `socket.readyState` descriptions in `net.md` and added the `closed` state.
+- Lowered the stale workflow thresholds from 210/240 days to 90/120 days.

src/posts/2026-07-20_oven-sh-bun.md

@@ -0,0 +1,35 @@
+---
+date: 2026-07-20
+repo: oven-sh/bun
+size: L
+title: "Windows fixes, Node compat, and cleanup"
+excerpt: "Big day for Bun on Windows and HTTP compatibility: AppContainer/no-orphans support, timer precision, path/FS fixes, plus several security/compat fixes."
+commits: 42
+authors: [robobun, cirospaciari, dylan-conway, Jarred-Sumner]
+commit_authors: {"6062448": robobun, "a4c1ddd": robobun, "432ee31": cirospaciari, "cb1e825": robobun, "7b1fb7f": robobun, "3979cbe": dylan-conway, "9f4682d": robobun, "1f71ec3": robobun, "f6c9474": robobun, "0278471": robobun, "86fc072": robobun, "a3b82c4": robobun, "84452b8": robobun, "02fde87": robobun, "f64cade": Jarred-Sumner, "0b0d17a": robobun}
+---
+
+### **Run Bun inside Windows AppContainer** (3979cbe)
+Bun can now run inside Windows AppContainer / lowbox sandboxes, which is important for packaged apps and embedders that launch workers under restricted tokens. The change wires in the required Windows-side process, filesystem, resolver, and terminal handling plus a large test matrix.
+
+### **Implement `--no-orphans` on Windows** (f6c9474)
+`--no-orphans` / `BUN_FEATURE_FLAG_NO_ORPHANS` now works on Windows instead of being a stub. It uses a kill-on-close Job Object for descendants and a parent-process wait to exit when the launcher dies, matching the POSIX behavior closely enough to matter in supervisors and CI.
+
+### **Fix HTTP/2 request header validation** (6062448)
+Bun now rejects malformed HTTP/2 request blocks that Node/nghttp2 rejects, including empty `:path`, missing required pseudo-headers, and invalid CONNECT shapes. This closes a compat gap that could previously let invalid requests reach the handler.
+
+### **Reject forbidden trailer headers in `node:http`** (7b1fb7f)
+Request trailers can no longer smuggle `Content-Length` or `Transfer-Encoding` through Bun's HTTP parser. That brings Bun in line with Node's hard 400/clientError behavior and avoids accepting framed requests Node would reject.
+
+### **Windows path, file, and timer correctness fixes** (0278471, 86fc072, 84452b8)
+Several Windows-specific bugs were fixed: `path.resolve("C:foo")` now resolves drive-relative paths correctly, `NtCreateFile` disposition is derived from `O_TRUNC` instead of access mode, and timers now use a monotonic clock so wall-clock adjustments don't skew deadlines. Together these remove real cross-platform correctness issues in core APIs.
+
+### **Windows and Node compatibility polish** (a4c1ddd, 432ee31, cb1e825, 9f4682d, 02fde87, a3b82c4, f64cade, 1f71ec3, 0b0d17a)
+Bun picked up a batch of user-visible compatibility fixes: better `which` behavior for Windows reparse points, per-stream `console.inspectOptions`, Node-style `connect` error suffixes, `cd` semantics in shell, safer `process.dlopen` errors on Windows, and FFI support on Windows ARM64. Crash reports now record the running CLI command, and HTTP/3 client resets no longer trigger a use-after-free.
+
+### Other misc changes
+- High-resolution Windows event-loop timer accuracy via libuv update
+- Redis timer lifetime refactor to prevent UAFs
+- Multiple dead-code / redundant-guard cleanups across bundler, parser, HTTP, SQL, semver, shell, server, and JSC bindings
+- CI/build annotation improvements for early-failing steps
+- Dependency bumps and repo scaffolding cleanup (libuv, WebKit, TinyCC)