Skip to content

Commit 278f91b

Browse files
github-actions[bot]github-actions[bot]
committed
digest: add issues for 2026-08-05
1 parent fb7e047 commit 278f91b

12 files changed

Lines changed: 313 additions & 0 deletions

‎src/posts/2026-08-04_biomejs-biome.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
date: 2026-08-04
3+
repo: biomejs/biome
4+
size: L
5+
title: "Type inference refactor, HTML/CSS fixes"
6+
excerpt: "Major type-inference cleanup plus HTML formatter/lint improvements, CSS-style parsing for HTML style attributes, and a new code-review skill."
7+
commits: 9
8+
authors: [ematipico, dyc3, Bishwas-py]
9+
commit_authors: {"6556ca3": ematipico, "12ce933": ematipico, "9c93f91": ematipico, "af16a0b": dyc3, "abfbb11": dyc3, "77035bb": dyc3, "4afd901": ematipico, "0e80610": Bishwas-py}
10+
---
11+
12+
**Prepare legacy type inference for removal** (6556ca3)
13+
Large internal refactor of `biome_js_type_info` to simplify the type-inference architecture and remove legacy machinery ahead of cleanup. The change rewires core type-data handling and updates snapshots, so it’s a meaningful step toward a leaner inference pipeline rather than a user-facing feature.
14+
15+
**Treat HTML `style` attributes as CSS** (af16a0b)
16+
Biome now parses HTML `style` attribute values as CSS and applies CSS lint rules to them, while intentionally avoiding treating component-style props in Svelte/Astro as CSS. This broadens lint coverage for real DOM styles and required coordinated updates across CSS parsing, formatting, syntax generation, and CLI behavior.
17+
18+
**Fix HTML blank-line preservation before text** (77035bb)
19+
The HTML formatter now preserves a blank line when text follows an element, matching the behavior already used for element-to-element spacing. That avoids collapsing intentional whitespace in formatted HTML and Svelte templates.
20+
21+
**Handle Svelte array-pattern holes in formatting** (abfbb11)
22+
The Svelte/HTML formatter no longer fails on `each` blocks that skip positions in destructuring patterns, such as `[, value]`. This is a targeted correctness fix for a previously unformattable Svelte syntax case.
23+
24+
**Make `noPositiveTabindex` suppression work on multiline tags** (0e80610)
25+
Suppression comments now correctly apply when an HTML element’s attributes span multiple lines. That closes a real linting gap for accessibility checks on multiline tags.
26+
27+
**Add a Biome code-review skill** (12ce933)
28+
Introduced a new Claude skill for reviewing Biome changes, along with a README entry and contributor guidance updates. This is tooling/docs work for maintainers, not a product change.
29+
30+
### Other misc changes
31+
- Performance work for several lint rules, including `noArguments`, `noGlobalAssign`, `noUndeclaredVariables`, `noRestrictedGlobals`, `noInvalidUseBeforeDeclaration`, `noShadow`, and `noRedeclare` (4afd901).
32+
- Fixed a merge-related issue in HTML formatter attribute handling (9c93f91).
33+
- Release/changeset cleanup from the publish workflow (191d051).

‎src/posts/2026-08-04_denoland-deno.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
date: 2026-08-04
3+
repo: denoland/deno
4+
size: L
5+
title: "QuickJS, permissions, and inspector hardening"
6+
excerpt: "Major runtime feature work plus fixes for publish, bundle permissions, DNS formatting, and inspector security."
7+
commits: 11
8+
authors: [nathanwhit, bartlomieju, crowlKats, rathodkunj2005]
9+
commit_authors: {"85a2842": nathanwhit, "736b50a": nathanwhit, "b82aa41": nathanwhit, "3a10142": nathanwhit, "610bdd6": nathanwhit, "76d48f6": crowlKats, "fa9ba06": nathanwhit, "9cfa6b7": bartlomieju, "49377a4": bartlomieju, "ecaa260": bartlomieju, "c347f34": rathodkunj2005}
10+
---
11+
12+
**Experimental QuickJS backend lands across compile and desktop** (fa9ba06)
13+
Deno now ships an experimental `quickjs` backend alongside the default V8 path, with new Cargo features and an `--engine v8|quickjs` selector for `deno compile` and `deno desktop`. The change also extends release CI to build and package QuickJS artifacts, making the alternate runtime a first-class option.
14+
15+
**Bundle() now honors filesystem permissions** (3a10142)
16+
`Deno.bundle()` previously bypassed the caller's file permissions in some HTML-loading and output-writing paths, making it inconsistent with other runtime file APIs. This fix threads the isolate's permissions through the bundling pipeline and checks reads/writes up front so permission failures happen correctly before filesystem access.
17+
18+
**Inspector requests now validate Host and WebSocket origin** (85a2842)
19+
Inspector discovery and WebSocket routing now reject invalid `Host` headers and enforce that browser-origin WebSocket upgrades match the request authority. That closes off a class of host-header confusion issues while still allowing localhost, IP-literal, and forwarded-port inspector connections.
20+
21+
**`deno publish` now reports rejected provenance attestations** (76d48f6)
22+
The publish flow now checks the registry response when submitting provenance, instead of assuming success. If a registry rejects the attestation, Deno warns clearly that the package published but won't get a provenance badge, instead of silently pretending the attestation was accepted.
23+
24+
**DNS record formatting handles malformed text safely** (b82aa41)
25+
Malformed CAA and NAPTR wire data is now decoded lossily instead of assuming UTF-8 and risking a panic. The DNS op also factors record formatting into a helper and adds coverage for malformed inputs, which makes `ANY` and typed queries resilient to bad byte sequences.
26+
27+
**Named-group Diffie-Hellman exponents now use the right bit sizes** (610bdd6)
28+
The Node crypto DH implementation switched from byte-sized exponent constants to explicit bit counts, matching Node/OpenSSL behavior for named MODP groups. This fixes the too-small private exponents produced before and adds regression tests for all supported groups.
29+
30+
**`task --members` is added for workspace-scoped runs** (49377a4)
31+
Tasks can now be restricted to workspace members only via a new `--members` flag. That gives monorepos a cleaner way to run member tasks without accidentally traversing unrelated packages.
32+
33+
### Other misc changes
34+
- `node:dns.getServers()` now requires `--allow-sys` to read host resolver config (ecaa260)
35+
- Desktop docs now specify `showContextMenu(x, y, menu)` uses window-relative CSS pixels (736b50a)
36+
- Fixed the desktop update signature-verification op staying exposed during bootstrap (c347f34)
37+
- Upgraded `deno_task_shell` to 0.33.3 (9cfa6b7)

‎src/posts/2026-08-04_denoland-std.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
date: 2026-08-04
3+
repo: denoland/std
4+
size: N
5+
title: "No changes"
6+
excerpt: ""
7+
commits: 0
8+
---
9+
10+

‎src/posts/2026-08-04_jsr-io-jsr.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
date: 2026-08-04
3+
repo: jsr-io/jsr
4+
size: M
5+
title: "Provenance fix and DB downsizing"
6+
excerpt: "Provenance verification now checks the published manifest digest, while production Cloud SQL is downsized to a zonal instance."
7+
commits: 2
8+
authors: [crowlKats]
9+
commit_authors: {"e35772e": crowlKats, "f581a13": crowlKats}
10+
---
11+
12+
### **Provenance now verifies against the published manifest** (f581a13)
13+
The provenance check was corrected to compare `subject.digest.sha256` against the SHA-256 of the stored `<version>_meta.json` manifest, not the uploaded tarball. This matches what the Deno CLI actually attests and closes a verification bug that could reject valid attestations or validate the wrong bytes.
14+
15+
### **Production Cloud SQL is moved to a smaller zonal tier** (e35772e)
16+
The main PostgreSQL instance drops from `db-custom-4-8192` to `db-custom-2-6144` and is forced to `ZONAL` rather than regional HA. That lowers capacity and removes automatic failover, so it’s an operational tradeoff with availability implications.
17+
18+
### Other misc changes
19+
- Provenance-related DB/query cleanup and test fixture updates (1 commit)
20+
- Terraform config tweak in `terraform/db.tf`

‎src/posts/2026-08-04_leanprover-lean4.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
date: 2026-08-04
3+
repo: leanprover/lean4
4+
size: L
5+
title: "Lean adds unified loop specs and bv tactics"
6+
excerpt: "New `forIn` specs cover effect-free containers, `bv_decide` now works in `sym` mode, and vcgen improves spec selection."
7+
commits: 4
8+
authors: [sgraf812, hargoniX]
9+
commit_authors: {"f2bcf2e": sgraf812, "8c72ff8": sgraf812, "1da5368": hargoniX, "6eaa2f8": sgraf812}
10+
---
11+
12+
### **Unified loop invariants for effect-free containers** (f2bcf2e)
13+
`vcgen` now gets one loop-spec story for any container whose iteration is effect-free, instead of requiring a bespoke spec per container. That brings `for ... invariant` support to hash/tree maps and sets, polymorphic ranges, slices, and iterators, including universe-polymorphic element types.
14+
15+
### **`bv_decide` is available inside `sym =>`** (1da5368)
16+
Bitvector automation can now be invoked from `sym =>` mode, expanding where `bv_decide`, `bv_decide?`, `bv_normalize`, and `bv_check` can be used. The change threads the new tactics through the interactive/grind parsers and the BVDecide elaborator so symbolic goals can use the same bitvector workflow.
17+
18+
### **`vcgen` now tries the next matching spec theorem** (6eaa2f8)
19+
When a `@[spec]` theorem doesn’t apply, `vcgen` will keep searching instead of letting that candidate shadow a more specific one. This makes spec dispatch more robust for instance-heavy programs and avoids false “missing spec” failures when an earlier candidate can’t be applied.
20+
21+
### **Loop-state universe bounds were relaxed in Do specs** (8c72ff8)
22+
Specification lemmas for `Std.Internal.Do` loops no longer force loop state and elements into the same combined universe bound. That removes a source of universe-constraint failures when writing container-generic specs, while preserving prior behavior through the updated instantiation.
23+
24+
### Other misc changes
25+
- `Range.size` gained a `grind` attribute.
26+
- New `PureForIn` instances and `ForIn.toList` simp lemmas for several map/set containers.
27+
- Documentation and error-message cleanup in `vcgen`.
28+
- Minor BVDecide and spec-lemma refactors/tests.

‎src/posts/2026-08-04_microsoft-typescript-go.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
date: 2026-08-04
3+
repo: microsoft/typescript-go
4+
size: M
5+
title: "Fix false symlink mapping in declaration emit"
6+
excerpt: "A targeted compiler fix prevents physical dependencies from being misclassified as symlinks, correcting JS declaration emit in JSDoc import cases."
7+
commits: 1
8+
authors: [platypii]
9+
commit_authors: {"12318e5": platypii}
10+
---
11+
12+
### **Avoid false symlink mappings for physical dependencies** (12318e5)
13+
The compiler now skips symlink-cache processing when a package resolution has no original path, preventing physical dependencies from being treated like symlinked ones. This fixes a declaration-emit bug where unrelated JSDoc imports could be reused and emitted under the wrong package path.
14+
15+
### Other misc changes
16+
- Added regression test coverage for JS declaration emit with JSDoc imports.
17+
- Updated compiler baseline output for the new test case.

‎src/posts/2026-08-04_nodejs-node.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
date: 2026-08-04
3+
repo: nodejs/node
4+
size: L
5+
title: "HTTP/2 gets faster; TLS, QUIC, FFI improve"
6+
excerpt: "Major HTTP/2 throughput boosts, TLS handshake hardening, QUIC STOP_SENDING support, and FFI fast-path and call-plan work landed."
7+
commits: 31
8+
authors: [nodejs-github-bot, pimterry, mcollina, trivikr, aduh95, Rawal27, npm-cli-bot, legendecas, hanityx, agape1225, ganjanggejang, islandryu, bitpshr, umuoy1, Archkon, panva, boneskull]
9+
commit_authors: {"2b350bb": trivikr, "1576cb8": mcollina, "31cde9f": umuoy1, "793a6ec": Archkon, "d18457b": pimterry, "5b940dd": pimterry, "3fc98b8": mcollina, "2ddade6": pimterry, "13e4e3d": pimterry}
10+
---
11+
12+
### **HTTP/2 defaults jump for throughput** (1576cb8)
13+
Node now defaults HTTP/2 stream flow control to 4MB and the connection window to 32MB, a big increase from the prior 64KB baseline. That should materially improve throughput on higher-latency links, while keeping existing apps compatible unless they override settings.
14+
15+
### **TLS handshake callbacks are deferred off the OpenSSL stack** (d18457b)
16+
`SNICallback` and `OCSPRequest` are now scheduled asynchronously instead of running directly from the TLS library stack, avoiding re-entrancy during handshake. This also tightens an error path in client hello handling so teardown scenarios don’t accidentally resume handshakes.
17+
18+
### **TLS client-hello parsing is replaced with native callback support** (5b940dd)
19+
Node drops the hand-rolled ClientHello parser and related plumbing in favor of modern OpenSSL/BoringSSL early ClientHello callbacks for resume-session flows. This is a substantial simplification of the TLS stack and removes a fragile internal subsystem.
20+
21+
### **QUIC gains explicit STOP_SENDING handling** (13e4e3d)
22+
A new `stream.onstopsending` callback exposes peer-initiated `STOP_SENDING` events separately from `RESET_STREAM`, making QUIC stream shutdown semantics clearer and more precise. The update also threads the new callback through docs, bindings, and tests.
23+
24+
### **HTTP response completion now matches Writable more closely** (2ddade6)
25+
`writableFinished` is now based on actual flush completion, and `end()` callbacks report success or the flush error instead of always hanging off `'finish'`. That fixes cases where HTTP responses could signal completion too early or lose the real failure reason after write errors.
26+
27+
### **FFI multi-arg fast calls accept pointer BigInts** (2b350bb)
28+
The multi-argument fast path now accepts BigInt pointer values the same way the single-argument path already did, instead of rejecting them during raw pointer extraction. This fixes a real compatibility gap for pointer-based FFI calls.
29+
30+
### **FFI reuses libffi call plans** (31cde9f)
31+
On x86-64 System V, fixed-signature FFI calls now reuse precomputed libffi call plans instead of rebuilding argument placement on every invocation. That trims per-call overhead in the generic path and is backed by a new benchmark.
32+
33+
### **ReadableStream pipeTo cuts per-chunk allocations** (3fc98b8)
34+
The webstreams pipe-to implementation was refactored to reuse write/read bookkeeping instead of allocating new promise records and closures for every chunk. This is a performance-focused internal rewrite that should reduce GC pressure in steady-state streaming.
35+
36+
### **Task runner paths are handled as UTF-8 on Windows** (793a6ec)
37+
Filesystem paths are now converted with UTF-8 instead of the active Windows code page when passed into Node and libuv interfaces. That prevents non-ASCII paths from being mangled or rejected on Windows.
38+
39+
### **Other misc changes**
40+
- npm updated to 11.19.0.
41+
- nghttp2, nghttp3, ngtcp2, simdjson, acorn, minimatch, and googletest dependency bumps.
42+
- SQLite test and close-behavior fixes; in-memory test database cleanup.
43+
- Misc build/tooling updates for perfetto and nix automation.
44+
- Documentation and grammar edits across HTTP/2, QUIC, CLI, dgram, addons, and test docs.
45+
- Smaller FFI, test runner, and SharedArrayBuffer pointer support fixes.

‎src/posts/2026-08-04_oven-sh-bun.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
date: 2026-08-04
3+
repo: oven-sh/bun
4+
size: L
5+
title: "HTTP compat, profiler fixes, and safety hardening"
6+
excerpt: "A big Bun day: Node compat work, native profilers, streaming/backpressure fixes, and several crash-to-error fixes across CLI, HTTP, and VM APIs."
7+
commits: 39
8+
authors: [robobun, Jarred-Sumner, cirospaciari]
9+
commit_authors: {"77d79f9": robobun, "a07354a": cirospaciari, "9a95458": robobun, "52ec9f2": robobun, "6a2c626": robobun, "ccf5efb": robobun, "ace8f42": robobun, "db5b68d": robobun, "b66764f": Jarred-Sumner, "b8d9477": robobun, "af63b8a": robobun, "5d70c96": robobun, "83c7055": robobun, "2190ef1": robobun, "7fab798": robobun, "10a986e": robobun, "6e13cb6": robobun, "5ad56ed": robobun, "87e168f": robobun, "d6302e9": robobun, "3f7144f": robobun, "0336d04": robobun, "c44df8b": Jarred-Sumner, "d6a03fc": robobun, "390e15c": Jarred-Sumner, "6fb3d65": robobun}
10+
---
11+
12+
### **Native V8 profiler APIs land for dd-trace/pprof** (7fab798)
13+
Bun now implements `v8::CpuProfiler` plus related V8 APIs needed by `@datadog/pprof`, removing a major blocker for native profiling integrations. This also adds `v8.isStringOneByteRepresentation` and exports the supporting V8 bindings/tests.
14+
15+
### **HTTP/2 server compat and crash fix for malformed headers** (a07354a, 83c7055, ace8f42)
16+
The HTTP/1/HTTP/2 compatibility work expands Node v26.3.0 coverage, including HTTP/1 fallback/upgrade handling, session error scoping, frame parsing, and additional upstream tests. Separately, malformed HEADERS blocks and delayed server-stream delivery no longer take down the process; protocol errors stay at the connection/session level instead.
17+
18+
### **HTMLRewriter now streams correctly under backpressure** (87e168f, 9a95458)
19+
`HTMLRewriter.transform()` was reworked to stream through `SinkHandle`/`SourceHandle` with proper suspension of async handlers instead of waiting the event loop. A follow-up fixes backpressured `RewriterPipe` consumers so native sinks and body collectors finish instead of hanging.
20+
21+
### **Filesystem and upload paths fix incorrect lengths/copies** (2190ef1, d6302e9)
22+
`Bun.write()` no longer over-copies or truncates caller-supplied destination fds, and file-slice uploads now send the slice’s actual `Content-Length` when the sendfile fast path is used. Both fixes prevent subtle data corruption and wrong request metadata.
23+
24+
### **`Bun.serve` gets stricter, safer HTTP parsing and TLS behavior** (af63b8a, b66764f, b8d9477)
25+
Server parsing now rejects invalid `Transfer-Encoding` lists instead of silently accepting bodies with unsupported codings, and FIFO/pipe file responses keep working as streaming bodies instead of being mislabeled as `Content-Length: 0`. Per-host TLS entries also now honor `requestCert` and `rejectUnauthorized` correctly.
26+
27+
### **More APIs now throw instead of aborting on bad input** (52ec9f2, 6a2c626, ccf5efb, db5b68d, 3f7144f, 10a986e, 5ad56ed, 77d79f9)
28+
Several previously fatal edge cases were turned into normal errors: `URL.revokeObjectURL()`, `node:vm` context option getters, `bun:test` title formatting, DNS callback argument validation, N-API external string/reference behavior, Redis `expire()`, native addon loading on musl, and overlong profiler output paths now report errors instead of crashing or panicking.
29+
30+
### **Spawn, SQL, timers, and install behavior improvements** (5d70c96, 6e13cb6, d6a03fc, 0336d04, 390e15c, 6fb3d65, c44df8b)
31+
`spawn()` now resolves relative `$PATH` entries against the requested `cwd`; `Bun.SQL` respects `PGSSLMODE`; timers reschedule correctly when `_idleStart` is rewritten; and install/binlink logic gained Windows and fallback fixes. Test runner timing/sharding support was also expanded and documented.
32+
33+
### Other misc changes
34+
- Dead-code removal across runtime, allocators, webcore, and HTTP subsystems (2 commits).
35+
- Test speedups and determinism cleanups in bundler/VM/install suites (4 commits).
36+
- Native inspector frontend/server reconnect handling fixed (1 commit).
37+
- JSON string quoting now uses valid `\u` escapes for BEL/VT (1 commit).
38+
- Native compression/decompression streams landed with a major internal rewrite (1 commit).

0 commit comments

Comments
 (0)