digest: add issues for 2026-06-11

Author: github-actions[bot]

src/posts/2026-06-10_biomejs-biome.md

@@ -0,0 +1,29 @@
+---
+date: 2026-06-10
+repo: biomejs/biome
+size: L
+title: "Biome lands CSS, Markdown, and Svelte fixes"
+excerpt: "Major parser and formatter improvements across CSS Modules, Markdown lists/quotes, and Svelte-aware HTML linting."
+commits: 7
+authors: [jfmcdowell, Mokto, ematipico, ShaharAviram1, mvanhorn, xsourabhsharma]
+commit_authors: {"263c7cc": Mokto, "ac4944f": ematipico, "84b43c5": ShaharAviram1, "311c2b2": mvanhorn, "6e8557b": xsourabhsharma, "fe03ff9": jfmcdowell, "8ac6e4a": jfmcdowell}
+---
+
+### **CSS Modules `composes` now accepts comma-separated values** (6e8557b)
+Biome’s CSS parser/formatter now handles `composes: classA from "./a.css", classB from "./b.css";` instead of rejecting or misformatting it. This closes a real CSS Modules parsing gap and updates the syntax model so downstream tooling sees a proper separated list.
+
+### **Markdown list formatting is overhauled to match Prettier more closely** (ac4944f)
+The Markdown formatter got a substantial rewrite focused on bullet/ordered list behavior, continuation indents, and quote/list edge cases. This is the kind of change that affects day-to-day output quality across a core formatter.
+
+### **Markdown parser fixes block quotes with link-reference definitions** (fe03ff9)
+A block quote now resets link-reference-definition continuation state so quoted content like `> 2. q` is parsed correctly after a definition. That fixes a subtle CommonMark interruption bug that could demote valid lists to paragraphs.
+
+### **Svelte interpolations are now understood inside quoted HTML attributes** (263c7cc)
+HTML linting and formatting were updated to recognize Svelte template chunks inside quoted attribute values, reducing false positives in `noRedundantAlt`, `useButtonType`, and `noScriptUrl`. This matters for Svelte users because dynamic quoted attributes are now treated more like real values instead of static text.
+
+### **`noProcessEnv` now catches imported `env` usage** (84b43c5)
+The JS lint rule was expanded beyond `process.env` member access to also flag `env` when imported or destructured from `process`/`node:process`. That closes a common bypass path and makes the rule materially more effective.
+
+### Other misc changes
+- Markdown syntax cleanup: removed dead syntax kinds and bogus-node handling (8ac6e4a)
+- Configuration schema docs: avoided Markdown links in JSON schema descriptions (311c2b2)

src/posts/2026-06-10_denoland-deno.md

@@ -0,0 +1,40 @@
+---
+date: 2026-06-10
+repo: denoland/deno
+size: L
+title: "Permissions, HTTP, and Node fixes land"
+excerpt: "Notable fixes for permission checks, HTTP semantics, node:vm lifetime safety, and npm metadata fetching, plus test coverage updates."
+commits: 13
+authors: [divybot, crowlbot, bartlomieju, nathanwhit, lowlighter]
+commit_authors: {"2655d44": bartlomieju, "2a9b192": bartlomieju, "48a9cfc": lowlighter, "46ac9d3": divybot, "ea65f25": crowlbot, "ee59874": crowlbot, "43e8962": crowlbot, "84a6342": crowlbot, "63d8687": divybot, "caf69f8": divybot, "1e9e951": divybot, "fd8f9dc": nathanwhit, "eb44004": nathanwhit}
+---
+
+### **Fix permission checks for non-recursive path ops** (2655d44)
+Deno now allows single-path reads and writes like `stat`, `open`, `readFile`, `writeFile`, and `readDir` even when a denied subtree exists underneath the queried path. The change keeps recursive deletes strict so `remove(..., { recursive: true })` still fails if it would descend into a denied descendant.
+
+### **Keep `node:vm` context wrappers alive with their contexts** (2a9b192)
+This fixes a GC/lifetime bug where a contextified wrapper could be collected while the underlying `v8::Context` was still live, leaving a dangling pointer behind. The wrapper is now anchored on the context’s global object, preventing use-after-free in interceptors and wasm code-gen callbacks.
+
+### **Forward shebang permissions into `deno test --doc`** (48a9cfc)
+Doc tests now inherit permissions from shebangs, matching the behavior users expect from normal script execution. That closes a gap where `--doc` could ignore permission requirements embedded in the source.
+
+### **Make `deno outdated` send npm’s metadata Accept header** (46ac9d3)
+Metadata fetches now use the same npm-style `Accept` header as install resolution, which fixes private/self-hosted registries that content-negotiate or redirect non-npm clients. The update also preserves `minimumDependencyAge` behavior by avoiding the abbreviated packument when a date filter is configured.
+
+### **Prefer Brotli when compression quality ties** (1e9e951)
+HTTP compression selection now breaks equal q-value ties in favor of Brotli instead of whichever encoding appeared first. That better matches modern client expectations and improves response compression decisions for headers that advertise multiple encodings, including zstd.
+
+### **Preserve empty multipart filenames as files** (63d8687)
+Multipart parsing now treats `filename=""` as a file part rather than falling back to a text field. This aligns Deno with browser behavior for unselected file inputs and fixes empty-file uploads in `FormData`.
+
+### **Join split request headers consistently** (eb44004)
+HTTP header merging now uses `; ` for `Cookie` everywhere, including single-header getters, instead of mixing in comma-joining for one code path. That keeps `req.headers.get("cookie")`, iteration, and framework cookie parsing consistent.
+
+### Other misc changes
+- Re-enable flaky Windows fetch tests (ea65f25)
+- Export `runMain` from `node:module` (ee59874)
+- Suppress misleading `only` notices when a test already fails (43e8962)
+- Improve lint plugin load errors to name the offending plugin (84a6342)
+- Fix Windows trailing-space path normalization in `deno info`/`deno run` (caf69f8)
+- Add focused HTTP/2 serve request coverage (fd8f9dc)
+- HTTP compression test/support refactors and coverage updates (1e9e951, eb44004, 46ac9d3, 48a9cfc, 2655d44, 2a9b192, 63d8687, caf69f8)

src/posts/2026-06-10_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-10
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-10_jsr-io-jsr.md

@@ -0,0 +1,18 @@
+---
+date: 2026-06-10
+repo: jsr-io/jsr
+size: M
+title: "Stuck publish tasks now self-heal"
+excerpt: "Adds a reaper for stale publishing tasks so stranded publishes can regenerate package metadata and unblock versions."
+commits: 1
+authors: [crowlKats]
+commit_authors: {"d768249": crowlKats}
+---
+
+### **Self-heal stranded publishing tasks (d768249)**
+The publish system now detects tasks stuck in `processing` or `processed` and requeues them after they’ve been stale too long. This fixes cases where a publish was interrupted mid-flight, leaving version metadata incomplete or package-level `meta.json` never regenerated, which could hide versions from the resolver and block republishing.
+
+### Other misc changes
+- Database query added for stale publishing-task lookup
+- Tests added for the stale-task requeue path
+- Scheduler/task wiring and S3/db plumbing updates to support the reaper

src/posts/2026-06-10_leanprover-lean4.md

@@ -0,0 +1,30 @@
+---
+date: 2026-06-10
+repo: leanprover/lean4
+size: L
+title: "Lean4 adds mvcgen until patterns"
+excerpt: "New `mvcgen'` syntax and VC flow control, plus a compacted-region refactor and a Bool constant-folding fix."
+commits: 8
+authors: [hargoniX, sgraf812, Kha, Garmelon, algebraic-dev]
+commit_authors: {"f0ef737": algebraic-dev, "5f9b669": sgraf812, "d757be5": sgraf812, "118ed15": Kha, "ccfc89f": hargoniX}
+---
+
+### **`mvcgen'` gains an `until` clause** (5f9b669)
+`mvcgen'` can now stop VC generation when the current program matches a conv-style pattern, leaving the goal as a VC instead of applying a spec. The pattern is elaborated lazily against the first program monad it sees, which helps overloaded heads resolve correctly and keeps editor hovers working.
+
+### **`mvcgen'` syntax is consolidated across tactic and grind modes** (d757be5)
+The tactic and `sym =>` forms now share a more consistent syntax model, and the old grind-mode `with` clause is removed in favor of `<;>`. The tactic entry point was also reshaped so leftover `Grind.Goal`s flow back out as tactic goals, changing how unsolved VCs are surfaced.
+
+### **`CompactedRegion` is now serializable** (118ed15)
+`CompactedRegion` was converted from a bare pointer into a Lean structure carrying ordinary metadata plus private pointer fields, making it embeddable in compacted data. The runtime and module-loading code were updated to reconstruct region views from that structured representation, which is a substantial change to Lean's compacted-object machinery.
+
+### **Bool constant folding now handles `false` correctly** (ccfc89f)
+The compiler's LCNF constant folder no longer treats every foldable 0-ary Bool value as `true`; it now distinguishes `Bool.true` and `Bool.false` explicitly. This fixes a real miscompile and adds a regression test.
+
+### **OpenSSL initialization is made lazier** (f0ef737)
+`OPENSSL_init_ssl` was removed from Lean's OpenSSL initialization path. That reduces eager side effects and should make lazy loading of OpenSSL work more reliably.
+
+### Other misc changes
+- CI workflow action updates and sha pinning (1 commit)
+- Dev-release preset no longer enables `WFAIL` (1 commit)
+- Claude workflow docs/skills cleanup (1 commit)

src/posts/2026-06-10_microsoft-typescript-go.md

@@ -0,0 +1,24 @@
+---
+date: 2026-06-10
+repo: microsoft/typescript-go
+size: L
+title: "Unicode fixes and declaration emit cleanup"
+excerpt: "Big Unicode correctness work plus improved declaration emit for expando properties and better tsconfig error reporting."
+commits: 4
+authors: [Andarist, weswigham, jakebailey]
+commit_authors: {"7d5b8f5": Andarist, "f157e78": weswigham}
+---
+
+**Unicode handling now matches JS semantics across the compiler** (7d5b8f5)
+The checker and scanner now use JS-compatible casing and identifier tables instead of Go/UTF-8 defaults, fixing intrinsic string mappings, identifier classification, and surrogate-pair behavior. This is a broad correctness change that affects how the language service and compiler treat non-ASCII text.
+
+**Declaration emit now walks expando properties through nested members** (f157e78)
+The declaration transformer was updated to retain and emit expando members discovered anywhere in the file, not just at the host node. This should fix missing or incomplete `.d.ts` output for JS patterns that attach properties after function declarations, especially in isolated declarations workflows.
+
+**Extended tsconfig parsing now reports JSON syntax errors from inherited configs** (cda7baf)
+Parsing of `extends` chains now stops and surfaces read/parse errors from the extended file instead of silently continuing when the child config is malformed. That makes config failures much easier to diagnose and prevents downstream parsing from masking the real problem.
+
+### Other misc changes
+- UTF-8/UTF-16 correctness fixes and related baseline updates (1 commit)
+- Code action deduping cleanup in the language service
+- Misc test and baseline updates for the above changes

src/posts/2026-06-10_nodejs-node.md

@@ -0,0 +1,22 @@
+---
+date: 2026-06-10
+repo: nodejs/node
+size: M
+title: "QUIC gets app-settings callback"
+excerpt: "Node adds a QUIC hook for delayed HTTP/3 app settings, tightens snapshot argv behavior, and hardens internal default objects."
+commits: 4
+authors: [sxa, martenrichter, aduh95, watilde]
+commit_authors: {"4241d0d": sxa, "e6a8d06": martenrichter, "1778eeb": aduh95, "19c46ab": watilde}
+---
+
+### **QUIC: add callback for HTTP/3 application settings** (e6a8d06)
+Node now exposes `session.onapplication`, letting apps react when HTTP/3/application options arrive after connection setup. This is important for protocols like WebTransport where settings can arrive later than the transport handshake, and the change is wired through docs, diagnostics, native QUIC session code, and tests.
+
+### **Startup snapshots now insert `argv[0]` for deserialize main** (19c46ab)
+`setDeserializeMainFunction()` now splices `process.argv[0]` into `process.argv[1]`, so user arguments start at `argv[2]` just like normal `run_main_module` behavior. That fixes embedding/snapshot entrypoints and aligns the docs and snapshot tests with the new argument layout.
+
+### **Prototype-pollution lint rule expanded across core** (1778eeb)
+A new lint rule enforces use of `kEmptyObject` in many public/internal entry points that accept options, reducing accidental prototype-pollution risk from default option objects. The commit also updates the rule implementation and adds coverage for the new lint check.
+
+### Other misc changes
+- libffi semi-colon cleanup for riscv64 and other arches (4241d0d)

src/posts/2026-06-10_oven-sh-bun.md

@@ -0,0 +1,25 @@
+---
+date: 2026-06-10
+repo: oven-sh/bun
+size: L
+title: "Bun decouples bake, hardens SQL and CI"
+excerpt: "Bake inspector code is split out, SQL pools now retry startup races, and CI gains smarter Docker coordination plus auto-retries."
+commits: 5
+authors: [alii, robobun]
+commit_authors: {"1c90e5a": alii, "8df5916": alii, "6ed88a5": alii, "2ad4199": robobun, "09703da": robobun}
+---
+
+### **Bake dev-server inspector agent is split out of JSC** (1c90e5a)
+The bake-specific `BunFrontendDevServerAgent` was moved out of `jsc/Debugger.rs` into `src/runtime/bake/dev_server/inspector_agent.rs`, replacing the inline debugger-owned state with an erased per-debugger slot. This lowers the coupling between bake and the core runtime/JSC layers and makes the bake dev-server integration easier to rework without touching debugger internals.
+
+### **SQL connections now retry startup failures while queries wait** (8df5916)
+MySQL and PostgreSQL pool logic now distinguishes refused connections from “accepted then closed before handshake” failures, and retries the latter with backoff until `connectionTimeout` as long as queries are waiting. This fixes the common container-startup race where a database is up but not yet accepting handshakes, while still failing fast for true refusal cases.
+
+### **CI now auto-retries infra deaths once** (6ed88a5)
+Buildkite jobs that die from agent loss or timeout now get one automatic retry instead of failing until a human clicks retry. That should recover transient infra blips faster without masking deliberate cancellations.
+
+### **Docker service startup is serialized per shard** (2ad4199)
+The test runner now launches a shard-local Docker coordinator and routes `ensure()` calls through it, so only one process owns `docker compose` for a shard. This avoids container-name conflicts during concurrent service startup and makes Docker-backed tests much less flaky in CI.
+
+### Other misc changes
+- Skipped `test/cli/install/bunx.test.ts` in CI until Bun reports a newer Node version (09703da).

src/posts/2026-06-10_pnpm-pnpm.md

@@ -0,0 +1,36 @@
+---
+date: 2026-06-10
+repo: pnpm/pnpm
+size: L
+title: "Platform fixes, faster installs, safer builds"
+excerpt: "Notable changes improved install correctness/perf, hardened build approvals, and added musl binaries plus safer tarball handling."
+commits: 11
+authors: [zkochan, KSXGitHub, scarab-systems, dasa]
+commit_authors: {"ac367fc": KSXGitHub, "9cd8070": zkochan, "52be454": zkochan, "d976edf": zkochan, "5aed120": zkochan, "d2125b8": zkochan, "b7195db": zkochan, "65443f4": zkochan, "bf1b731": zkochan, "2c0b91d": scarab-systems, "46fd26a": dasa}
+---
+
+**Fix optional deps when platform metadata is missing** (52be454)
+Optional dependencies now infer missing `os`/`cpu`/`libc` fields from the package name, so registries that strip platform metadata no longer cause pnpm to install foreign-platform binaries or write broken lockfile entries. This fixes a real cross-platform install bug for packages whose metadata was incomplete.
+
+**Speed up cold metadata fetches by parsing off the reactor** (9cd8070)
+Packument parsing is now moved off the tokio worker and the network permit is released before the CPU-heavy JSON work starts. That avoids pinning reactor threads on multi-megabyte metadata responses and should noticeably reduce stalls during resolution-heavy installs.
+
+**Make repeat installs restore a missing lockfile from node_modules** (d976edf)
+If `pnpm-lock.yaml` is missing but `node_modules` is intact, install now treats `node_modules/.pnpm/lock.yaml` as the current truth, verifies manifests against it, restores the lockfile, and finishes with "Already up to date." That removes an unnecessary full re-resolve on a common fast-path recovery case.
+
+**Add musl binaries for pacquet and pnpr** (5aed120)
+The release pipelines now build and publish `linux-x64-musl` and `linux-arm64-musl` variants, and the shims choose the right native package for glibc vs musl Linux. This broadens support for Alpine and other musl-based environments.
+
+**Harden build approvals around artifact identity** (bf1b731)
+`allowBuilds` approvals now key off the lockfile depPath/identity instead of just package name and version, which closes a loophole for git, tarball, and local-directory dependencies. It also tightens lockfile verification so registry-shaped depPaths can’t masquerade as non-registry artifacts.
+
+**Validate staged tarball filenames before writing them** (65443f4)
+`pnpm stage download` now rejects invalid package names/versions and refuses filenames that would escape the target download directory. This closes a traversal-style risk in staged tarball handling.
+
+**Show deprecation and bin info in `view`** (46fd26a)
+The package inspector now surfaces deprecation warnings and lists available binaries in `pnpm view` output. That makes package metadata more useful at a glance.
+
+### Other misc changes
+- Clippy/lint cleanup and small Rust style fixes (ac367fc)
+- Release/version/lockfile and changeset housekeeping (d2125b8, b7195db)
+- Skip deps auto-install when running without a manifest (2c0b91d)

src/posts/2026-06-10_tc39-ecma262.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-10
+repo: tc39/ecma262
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+