chore: backfill pnpm, vite, biome digests for 2026-05-17–05-26

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: kt3k

src/posts/2026-05-17_biomejs-biome.md

@@ -0,0 +1,22 @@
+---
+date: 2026-05-17
+repo: biomejs/biome
+size: L
+title: "CSS, HTML, and Markdown fixes land"
+excerpt: "Big formatter/parser fixes for SCSS interpolation, invalid HTML from comments, and Markdown list boundary handling."
+commits: 4
+authors: [yanthomasdev, denbezrukov, jfmcdowell, dyc3]
+commit_authors: {"cf238f5": denbezrukov, "fcb1e48": jfmcdowell, "50aa415": dyc3}
+---
+
+### **Preserve raw SCSS string interpolation** (cf238f5)
+Biome’s SCSS formatter now handles raw string interpolation without normalizing away the original quoting/interpolation shape. This is a substantial formatter change that should reduce unwanted diffs and better preserve source intent in SCSS-heavy codebases.
+
+### **Fix invalid HTML formatting when comments split tags** (50aa415)
+The HTML formatter was updated to avoid producing syntactically invalid output when comments appear around closing tags. The fix also touches Svelte HTML handling and child-list comment ownership, which matters because it prevents the formatter from rewriting valid input into broken markup.
+
+### **Break Markdown paragraphs correctly at sibling list markers** (fcb1e48)
+The Markdown parser now recognizes additional list-marker boundary cases, including wide spacing and tab-related edge cases, so paragraphs terminate where CommonMark expects them to. This fixes list parsing/serialization bugs that could previously leak formatting across item boundaries.
+
+### Other misc changes
+- Renamed `FileExitsParams` to `FileExistsParams` across CLI, service, WASM, and backend JSON-RPC layers.

src/posts/2026-05-17_pnpm-pnpm.md

@@ -0,0 +1,43 @@
+---
+date: 2026-05-17
+repo: pnpm/pnpm
+size: L
+title: "Caching, runtime pins, and resolver speedups"
+excerpt: "Major install-path work: cached lockfile verification, faster minimum-release-age checks, runtime-pin fixes, plus several important config and bin-linker fixes."
+commits: 9
+authors: [zkochan, shiminshen, cyphercodes, Sean-Kenneth-Doherty]
+commit_authors: {"247d70b": cyphercodes, "f46757d": zkochan, "8df408c": shiminshen, "06d2d3d": shiminshen, "963861c": zkochan, "ba2c884": shiminshen, "5dc8be8": zkochan, "020ac45": Sean-Kenneth-Doherty, "fcf95c7": zkochan}
+---
+
+### **Cache lockfile verification and make it policy-aware** (fcf95c7)
+pnpm now memoizes post-resolution lockfile verification results on disk in JSON Lines, so repeat installs against an unchanged lockfile can skip per-package registry checks. The new verifier interface also sets up the install layer to fan out across multiple resolver-side policies instead of hard-coding a single gate.
+
+### **Speed up minimumReleaseAge with attestation-first lookups** (963861c)
+The `minimumReleaseAge` verifier now tries npm attestations before falling back to full metadata, which should cut cold-cache bandwidth dramatically for provenance-published packages. It also layers abbreviated metadata and local mirror hits ahead of the expensive full-document fetch.
+
+### **Fix graph hashing for packages that pin their own runtime** (5dc8be8)
+Dependencies with their own `engines.runtime` were still being hashed as if they used the install-wide Node version, which could produce the wrong side-effects cache key and stale reuse. This change resolves the engine portion per snapshot instead, matching how the bin linker already handles runtime-pinned deps.
+
+### **Warn when legacy `package.json` pnpm settings are ignored** (8df408c)
+pnpm now emits a warning if `package.json` still contains migrated settings under the old `pnpm` field, such as overrides or patched dependencies. That gives upgraders a clear signal that their old config is no longer being read.
+
+### **Fix `devEngines.packageManager` default onFail behavior** (ba2c884)
+The singular `devEngines.packageManager` form now inherits the documented `pmOnFail: "download"` default instead of forcing `error`. This restores the expected auto-download behavior when a project requests a different pnpm version.
+
+### **Stop auto-install output from leaking during `--silent exec` and `run`** (247d70b)
+When `verifyDepsBeforeRun: install` triggers an implicit install before `pnpm exec` or `pnpm run`, pnpm now forwards the caller’s reporter so silent mode stays silent. That prevents install chatter from being written to stdout and keeps command output clean.
+
+### **Fix `devEngines.packageManager` lockfile writes** (06d2d3d)
+When `devEngines.packageManager.pnpm` is set without `onFail: "download"`, pnpm now records the resolved package manager version in the lockfile as documented. Previously first installs could skip writing `packageManagerDependencies.pnpm` entirely.
+
+### **Fix auth parsing for padded base64 credentials** (020ac45)
+`.npmrc` auth values now tolerate redundant trailing base64 padding and return a proper pnpm error for invalid base64. This makes credential parsing more forgiving without hiding malformed input.
+
+### **Fix cmd-shim handling for the Node runtime binary** (f46757d)
+pacquet now links the Node runtime binary directly instead of wrapping it in a cmd shim. That matches pnpm’s behavior across platforms and avoids broken double-wrapped `node` entries from stale installs.
+
+### Other misc changes
+- Dependency/context plumbing for the new resolution-verifier API
+- Graph-hasher and runtime-version export refactors
+- Test coverage updates for the above fixes
+- Changelog/config metadata updates

src/posts/2026-05-17_vitejs-vite.md

@@ -0,0 +1,10 @@
+---
+date: 2026-05-17
+repo: vitejs/vite
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-05-18_biomejs-biome.md

@@ -0,0 +1,23 @@
+---
+date: 2026-05-18
+repo: biomejs/biome
+size: M
+title: "SCSS interpolation spacing and CLI transport shift"
+excerpt: "A CSS formatter fix and a CLI pending-request refactor headline a day otherwise dominated by dependency and debug-build cleanup."
+commits: 9
+authors: [dyc3, denbezrukov, ematipico]
+commit_authors: {"cb40ee0": dyc3, "bbcb3f5": denbezrukov, "ddcb445": ematipico}
+---
+
+### **Preserve SCSS identifier interpolation spacing** (bbcb3f5)
+The CSS formatter now preserves source gaps inside selector and property-name interpolations, so inputs like `.icon-#{ $name}` and `#{$name }` keep their spacing instead of being normalized away. This is a behavior fix for SCSS formatting that better matches existing source intent and reduces surprising churn.
+
+### **Replace dashmap in CLI pending request tracking** (ddcb445)
+The CLI transport layer swaps out `dashmap` for `papaya::HashMap` and wraps each pending sender in a `Mutex<Option<_>>` to coordinate removal and delivery more explicitly. That’s a meaningful internal refactor around request bookkeeping and shutdown behavior, and it removes `dashmap` from the project’s direct dependency set.
+
+### **Tighten HTML formatter debug-only helpers** (cb40ee0)
+Unused-code warnings in release builds were cleaned up by gating HTML child display/debug helpers behind `cfg(debug_assertions)`. This keeps the formatter internals leaner in release builds without changing formatting behavior.
+
+### Other misc changes
+- Dependency bumps: pnpm, `@types/node`, `tombi`.
+- Rust crate bumps: `dashmap`, `filetime`, `bpaf`.

src/posts/2026-05-18_pnpm-pnpm.md

@@ -0,0 +1,34 @@
+---
+date: 2026-05-18
+repo: pnpm/pnpm
+size: L
+title: "pnpm hardens config deps and lockfile gates"
+excerpt: "Platform-aware config deps, lockfile verification caching/progress, and pacquet Windows path fixes landed alongside release prep."
+commits: 14
+authors: [zkochan, KSXGitHub]
+commit_authors: {"c8d8fde": zkochan, "cddf522": zkochan, "e01d2bc": zkochan, "bfa861f": KSXGitHub, "2a9bd89": zkochan, "4a79336": zkochan}
+---
+
+### **Config dependencies can now install optional platform binaries** (c8d8fde)
+`configDependencies` now resolve one level of `optionalDependencies`, with `os`/`cpu`/`libc` filtering applied during install. That makes esbuild/swc-style platform-binary packages viable for config deps, so the matching native helper can be shipped and linked next to the config dependency when its platform matches.
+
+### **Pacquet gains lockfile verification at load time** (cddf522)
+The lockfile-verification gate was ported into pacquet and now reapplies `minimumReleaseAge` and `trustPolicy='no-downgrade'` immediately after `pnpm-lock.yaml` is loaded, before any fetch or resolution work. This blocks lockfiles sourced from caches or other machines from slipping through under a weaker policy.
+
+### **Install writes now feed the verification cache** (2a9bd89)
+When pnpm writes a fresh lockfile during install, that post-resolution lockfile is now recorded as verified right away. It avoids repeating the registry round-trip on a subsequent install against the same newly written lockfile, which makes the cached path actually stick.
+
+### **Lockfile verification now shows progress in the default reporter** (4a79336)
+The verifier emits started/done events and the default reporter renders them as a transient progress line with entry count and elapsed time. Users no longer sit through a silent cold-cache verification pass wondering whether pnpm is stuck.
+
+### **Pacquet fixes Windows symlink targets across drive roots** (e01d2bc)
+`symlink_dir` now detects when source and link parents are on different Windows drives or UNC roots and falls back to an absolute target instead of producing an invalid re-anchored relative path. That fixes the Windows CI failure mode where symlink creation was rejected with `ERROR_INVALID_PARAMETER`.
+
+### **Pacquet config defaults stop mutating process env in tests** (bfa861f)
+The config default-store logic was refactored to take env access and directory reads through dependency injection instead of touching global process state directly. That makes the existing branches testable without serializing on `env::set_var`/`current_dir`, and aligns the config code with the repo’s DI conventions.
+
+### Other misc changes
+- Release prep and version bumps, including pnpm 11.1.3.
+- Large lockfile refreshes and generated metadata updates.
+- Pacquet test coverage expansions and DI/style-guide documentation updates.
+- Dylint/perfectionist upgrade and assorted internal refactors.

src/posts/2026-05-18_vitejs-vite.md

@@ -0,0 +1,21 @@
+---
+date: 2026-05-18
+repo: vitejs/vite
+size: M
+title: "Glob import path handling tightened"
+excerpt: "Vite fixed absolute-base glob imports, refreshed glob-import tests, and bumped a couple of related deps."
+commits: 4
+authors: [shulaoda, cromanenslow]
+commit_authors: {"0ae2844": shulaoda, "95975e8": shulaoda}
+---
+
+### **Glob imports no longer rewrite paths for absolute base** (0ae2844)
+The glob import transformer stops rewriting `importPath` when `base` starts with `/`, which should prevent incorrect URL generation for apps served from an absolute base path. This is a targeted correctness fix for `import.meta.glob` behavior.
+
+### **Glob-import playground moved under a root subdirectory** (95975e8)
+The glob-import test fixtures were reorganized into a `root/` subdirectory and the Playwright tests were updated to match. This keeps the playground aligned with how Vite resolves roots and helps cover more realistic path handling.
+
+### Other misc changes
+- Dependency bumps: `rolldown-plugin-dts`, `oxc-minify`.
+- Docs: updated the pnpm overrides link.
+- Test/fixture maintenance for the glob-import playground.

src/posts/2026-05-19_biomejs-biome.md

@@ -0,0 +1,27 @@
+---
+date: 2026-05-19
+repo: biomejs/biome
+size: L
+title: "Plugins and language gating land"
+excerpt: "Feature-gating plugins, GraphQL/Markdown/YAML, plus improved CSS/SCSS parsing and formatting for unknown at-rules and binary edges."
+commits: 5
+authors: [ematipico, denbezrukov]
+commit_authors: {"1971055": ematipico, "dc73b6b": ematipico, "6c1f017": denbezrukov, "a67c220": denbezrukov, "005d28d": ematipico}
+---
+
+### **Plugins are now opt-in behind a feature gate** (dc73b6b)
+Biomes configuration, CLI, LSP, WASM, and service crates now only pull plugin support when the `plugins` feature is enabled. This reduces default surface area and makes plugin loading an explicit opt-in across the stack.
+
+### **CSS parser/formatter now handles unknown at-rules better** (6c1f017)
+The CSS pipeline gained support for parsing and formatting unknown CSS/SCSS at-rules, including dedicated syntax handling and formatter output for unknown at-rule names. The unknown-at-rule lint was also adjusted to compare against static names only, avoiding false matches on dynamic Sass-style names.
+
+### **SCSS binary expression formatting preserves tighter source edges** (a67c220)
+SCSS binary expression formatting was reworked to better preserve source-tight operator/operand edges and indentation behavior, especially around parenthesized expressions and control-flow conditions. This should reduce surprising whitespace changes in complex SCSS expressions and bring formatting closer to expected Prettier-like output.
+
+### **Markdown, YAML, GraphQL, and Grit become feature-gated in service code** (1971055)
+The service crate and its consumers now enable Markdown, YAML, GraphQL, and Grit support through explicit Rust features instead of always compiling them in. That makes builds more modular and avoids paying for language support that a given binary or test target does not use.
+
+### Other misc changes
+- Grit search CLI/search code was refactored to use a new `SearchLanguage` type and service-side search plumbing (005d28d)
+- Cargo feature wiring updated across CLI, LSP, formatter tests, and dev-dependencies for the new gating model (dc73b6b, 1971055)
+- Generated CSS syntax/factory updates and related test snapshot refreshes (6c1f017)

src/posts/2026-05-19_pnpm-pnpm.md

@@ -0,0 +1,41 @@
+---
+date: 2026-05-19
+repo: pnpm/pnpm
+size: L
+title: "Login scope support and install engine progress"
+excerpt: "pnpm adds scoped login mapping, runtime-aware outdated checks, pacquet install delegation, and several important config/fix regressions."
+commits: 16
+authors: [zkochan, KSXGitHub, shiminshen, timhaines, shbernal, Eyalm321, minijus, beaussan]
+commit_authors: {"1627943": zkochan, "ced20cb": zkochan, "3687b0e": shiminshen, "a620557": shbernal, "9cb48bb": Eyalm321, "d1b340f": minijus, "56f3851": shiminshen, "64afc92": beaussan, "b206a15": zkochan}
+---
+
+### **Scoped `pnpm login` now writes registry mapping** (56f3851)
+`pnpm login --scope <scope>` is now supported and persists an `@scope:registry=` entry alongside the auth token. That closes a long-standing gap where the documented flag existed only in help text, so scoped packages can be routed to a chosen registry without manual `.npmrc` edits.
+
+### **`pnpm outdated` now includes Node, Deno, and Bun runtimes** (1627943)
+Runtime dependencies installed via the `runtime:` protocol now show up in `pnpm outdated` and `pnpm update --interactive` instead of being silently skipped. This is a meaningful UX fix for projects that manage toolchain runtimes through pnpm, since updates are now visible and actionable.
+
+### **Install can delegate fetch/import/link work to pacquet** (b206a15)
+When `pacquet` is listed in `configDependencies`, pnpm now hands off the materialization phase of installs to the Rust binary while still keeping resolution in JS. This is an opt-in preview of the Rust install engine and lays the groundwork for faster or alternate install paths without changing behavior for users who don't enable it.
+
+### **`pnpm login`/logout registry sync is now workspace-aware** (d1b340f, ced20cb)
+pnpm now synchronizes the default registry from `pnpm-workspace.yaml` only when the workspace actually contributes it, avoiding accidental overwrites of `.npmrc` values like unnormalized registry URLs. This fixes registry handling for auth-related commands while preserving user-authored config.
+
+### **`pnpm publish` now honors `publishConfig.access`** (64afc92)
+Publish option resolution now respects package-level `publishConfig.access`, fixing cases where the intended access level was ignored. The change also replaces Verdaccio-dependent access coverage with direct unit tests, which makes the behavior more reliable to validate.
+
+### **Global add/update now handles minimum release-age policy violations** (a620557)
+Global install flows no longer trip an internal guardrail when a minimum-release-age policy is violated. Instead, they surface policy violations through the same handling path used elsewhere, so global add/update behaves consistently with regular installs.
+
+### **Workspace injection crash fixes** (9cb48bb)
+Two frozen-lockfile crashes were fixed for `injectWorkspacePackages` / injected deps, including a pruned-lockfile peer-variant resolution bug and a lifecycle re-import ENOENT issue. These are targeted but important stability fixes for workspace-heavy pipelines such as `turbo prune --docker`.
+
+### **`cafile` paths now resolve relative to the `.npmrc` file** (3687b0e)
+A relative `cafile=` entry in `.npmrc` is now resolved from the directory that contains that `.npmrc`, not from the current process working directory. That prevents silent CA loading failures in CI wrappers and `--dir` workflows that previously fell back to insecure/default TLS behavior.
+
+### Other misc changes
+- Regression test for `minimumReleaseAge` in outdated.
+- Pacquet config defaults aligned with pnpm v11 (`publicHoistPattern`, global config loading, refactors).
+- Config-reader registry sync and cafile tests.
+- Pacquet CI/workflow, clippy, and lockfile churn.
+- Misc pacquet refactors and internal test updates.

src/posts/2026-05-19_vitejs-vite.md

@@ -0,0 +1,15 @@
+---
+date: 2026-05-19
+repo: vitejs/vite
+size: S
+title: "Fix Sass package root resolution"
+excerpt: "Adds a regression test showing Sass should ignore package.json main and resolve index.scss at the package root."
+commits: 1
+authors: [sapphi-red]
+commit_authors: {"ebf39a0": sapphi-red}
+---
+
+### Other misc changes
+- Regression test for Sass package resolution around `main` vs `index.scss` (ebf39a0)
+- Exported CSS resolver helpers for test coverage/internal reuse (ebf39a0)
+- Added Sass fixture package and ignore rules for the new test (ebf39a0)

src/posts/2026-05-20_biomejs-biome.md

@@ -0,0 +1,22 @@
+---
+date: 2026-05-20
+repo: biomejs/biome
+size: M
+title: "Formatter upgrade and CI hardening"
+excerpt: "Biome tightened GitHub Actions permissions, fixed a build/config bug for featureful checks, and improved SCSS map formatting."
+commits: 4
+authors: [ematipico, MatteoGabriele, denbezrukov]
+commit_authors: {"4f1aaf2": ematipico, "b3840a2": denbezrukov}
+---
+
+### **Fix build and config handling for all-features checks** (4f1aaf2)
+Biome updated its workspace and CI commands to include `--all-features` for `cargo check` and `udeps`, which should catch feature-gated issues that were previously missed. The workspace also now declares `default-members`, and the configuration schema/workspace JSON were expanded alongside CLI help/docgen updates to keep generated config docs in sync.
+
+### **Align SCSS map pair formatting with Prettier-style wrapping** (b3840a2)
+The CSS formatter now has dedicated layout logic for SCSS map pairs, improving how broken keys and scalar or self-breaking values are wrapped around `:`. This should produce more consistent output for maps with long keys or parenthesized values, reducing surprising diffs in SCSS formatting.
+
+### Other misc changes
+- Added a new GitHub Actions security scanning workflow with zizmor.
+- Hardened several existing workflows by reducing permissions and removing unnecessary checkout steps.
+- Disabled the compromised `close-issue` workflow by commenting it out.
+- Dependency and snapshot updates across CLI/help and formatter tests.