digest: add issues for 2026-08-06

Author: github-actions[bot]

src/posts/2026-08-05_biomejs-biome.md

@@ -0,0 +1,23 @@
+---
+date: 2026-08-05
+repo: biomejs/biome
+size: L
+title: "React compiler rule lands; inference and fixes"
+excerpt: "Adds a new React Compiler lint rule, improves promise type inference performance, and fixes a JSX fragment autofix panic."
+commits: 6
+authors: [dyc3, ematipico, saberoueslati]
+commit_authors: {"bd0b68d": ematipico, "0a0fbc1": dyc3, "4a0bc5c": saberoueslati}
+---
+
+### **New nursery rule `useReactCompiler` for React Compiler lint mode** (0a0fbc1)
+Biome now ships a nursery lint rule that reports diagnostics from React Compiler lint mode. The change also wires the rule into configuration, docs, generated rule metadata, and test coverage, making it available for users to opt into immediately.
+
+### **Improve `noMisusedPromises` inference performance** (bd0b68d)
+This optimizes type inference for async class methods that call other methods through `this`, reducing the work needed to analyze those promise flows. That matters for large TypeScript codebases where this rule can otherwise become expensive.
+
+### **Fix `noUselessFragments` unsafe autofix panic on JSX attributes** (4a0bc5c)
+Biome no longer panics when the unsafe fix removes a fragment used as a JSX attribute value. The fix preserves the shape of the attribute expression, preventing a crash during `check --write --unsafe`.
+
+### Other misc changes
+- CI updates for Windows long paths and build reliability (3 commits)
+- Codspeed benchmark crate version bumps (1 commit)

src/posts/2026-08-05_denoland-deno.md

@@ -0,0 +1,24 @@
+---
+date: 2026-08-05
+repo: denoland/deno
+size: L
+title: "Security fixes and a base64url speedup"
+excerpt: "Control-character escaping, invalid npm bin target filtering, and simdutf-backed base64url ops headline a busy day."
+commits: 5
+authors: [nathanwhit, tomas-zijdemans]
+commit_authors: {"fdda8b7": nathanwhit, "f048172": nathanwhit, "e0523a5": tomas-zijdemans}
+---
+
+### **Escape terminal control characters in CLI metadata** (fdda8b7)
+Deno now sanitizes externally sourced registry and package metadata before printing it to terminal UIs and error messages. That closes a class of output-injection issues in places like lifecycle script approval, audit advisories, and registry API errors.
+
+### **Reject invalid npm bin targets** (f048172)
+The npm installer now ignores bin entries that are empty, absolute, or escape the package directory via `..` segments. This prevents packages from creating or mutating executables outside their own install tree on both Unix and Windows.
+
+### **Implement base64url encode/decode in Rust for speed** (e0523a5)
+Deno replaced the JS base64url shim with Rust ops backed by simdutf, bringing `node:buffer` base64url paths to parity with Node and cutting common encode/decode cases by multiple times. This also tightens the Buffer API implementation around native encode/decode behavior.
+
+### Other misc changes
+- Test isolation for `pkg_json_imports` specs
+- CI/build fixes for QuickJS Windows and parser lint
+- Dependency bumps and internal workflow/test adjustments

src/posts/2026-08-05_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-08-05
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-08-05_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-08-05
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-08-05_leanprover-lean4.md

@@ -0,0 +1,34 @@
+---
+date: 2026-08-05
+repo: leanprover/lean4
+size: L
+title: "Lean 4 adds BVDecide type filtering, fixes SymM bugs"
+excerpt: "New BVDecide type restrictions and several SymM/unifier fixes land alongside safer String.extract and contract/invariant elaboration improvements."
+commits: 9
+authors: [sgraf812, hargoniX, leodemoura]
+commit_authors: {"c4e6b62": leodemoura, "16fafca": leodemoura, "4c29de6": hargoniX, "6c50efd": sgraf812, "e5a38df": sgraf812, "82a131b": sgraf812, "752b791": hargoniX, "42a1d76": sgraf812, "3a47eb5": hargoniX}
+---
+
+### **BVDecide now accepts explicit type filters** (3a47eb5)
+`bv_decide`, `bv_normalize`, `bv_decide?`, and `bv_check` can now take `types [T₁, ..., Tₙ]` to restrict enum/structure analysis to selected inductives. This gives users a way to rein in preprocessing on large goals where only a few complex types matter.
+
+### **SymM discrimination trees now see assigned metavariables and `mdata`** (c4e6b62, 16fafca)
+The SymM matching/rewrite pipeline was taught to resolve assigned metavariables during discrimination-tree lookup, and to ignore `Expr.mdata` wrappers in both matching and unification. This fixes missed matches and confusing failures in simp/rewrite-style workflows when goals contain metadata or metavariables assigned after goal creation.
+
+### **`bv_decide` embedded constraints now handle negated booleans** (752b791)
+The preprocessing pass for embedded constraints now recognizes hypotheses of the form `(!a) = true` as well as `a = true`, and rewrites them through a dedicated boolean lemma. That lets `bv_decide` simplify a slightly larger class of boolean constraints before SAT solving.
+
+### **Contract and loop-invariant elaboration accepts clearer binder forms** (6c50efd, 82a131b)
+`requires`/`ensures` clauses now preserve type ascriptions on their binders, and `for ... invariant` now supports destructuring binders while giving better errors when the container lacks the needed `PureForIn` instance. This makes verification scripts more expressive and moves diagnostics to the clause that actually needs fixing.
+
+### **`String.extract` no longer hits a use-after-free on gigantic slices** (4c29de6)
+A runtime bug in `String.Pos.Raw.extract` was fixed for very large slice limits. The patch addresses the memory-safety issue behind the reported crash, though the separate semantic divergence noted in the PR remains.
+
+### **Separation-logic VCGen tests grew an in-place append and allocator-backed stack** (42a1d76, e5a38df)
+The `vcgenSepLogic` demo was extended with an in-place append proof and a stack model with an explicit allocator/free-store resource. These additions exercise more demanding frame inference and ramified specs, but they are test-only changes.
+
+### Other misc changes
+- Separation-logic demo documentation and helper lemmas expanded.
+- BVDecide normalization/interactive plumbing updated to thread the new `types` syntax.
+- Small SymM/Do VCGen internal refactors to use the current metavariable context.
+- Additional regression tests for metadata handling, assigned mvars, embedded constraints, and intrinsic verification.

src/posts/2026-08-05_microsoft-typescript-go.md

@@ -0,0 +1,15 @@
+---
+date: 2026-08-05
+repo: microsoft/typescript-go
+size: M
+title: "Variance computation now handles circular types"
+excerpt: "TypeScript Go updates variance inference to track work by associated symbol, improving circular generic analysis and related tests."
+commits: 1
+authors: [ahejlsberg]
+commit_authors: {"86cc476": ahejlsberg}
+---
+
+### **Variance computation ordered by associated type symbol** (86cc476)
+The checker now tracks variance computation on a stack keyed by the associated symbol instead of a single global in-progress flag. This lets it restart safely around circularities and avoid recomputing work incorrectly, which matters for generic variance inference on self-referential types.
+
+The change also adds focused regressions for circular variance cases, so the new ordering behavior is exercised and locked in.

src/posts/2026-08-05_nodejs-node.md

@@ -0,0 +1,41 @@
+---
+date: 2026-08-05
+repo: nodejs/node
+size: L
+title: "FIPS fixes and API additions land"
+excerpt: "Node.js adds non-throwing MIME parsing, broadens SQLite/Buffer inputs, and fixes FIPS startup and crypto behavior."
+commits: 22
+authors: [panva, aduh95, jasnell, Archkon, Renegade334, mike-git374, hyemimi, dario-piotrowicz, nodejs-github-bot, RafaelGSS, kyungrae2002, mcollina, umuoy1]
+commit_authors: {"62acd48": mike-git374, "6b8a454": panva, "dc7838c": panva, "b79dcdf": panva, "9e59c1a": jasnell, "3e6cca0": RafaelGSS, "b33cc0e": mcollina, "6bab948": Archkon}
+---
+
+### **New non-throwing MIME parsing API** (9e59c1a)
+`MIMEType.parse()` now returns `null` for invalid input instead of throwing, and internal callers in data URL handling and inspector network sniffing switch to the safer path. This makes MIME parsing easier to use in optional/heuristic flows and avoids exception-driven control flow.
+
+### **Buffer validation now treats detached inputs as empty** (6bab948)
+`buffer.isAscii()` and `buffer.isUtf8()` no longer throw on detached `ArrayBuffer`s or views backed by them; they now return `true` for zero-length-equivalent inputs. That aligns detached buffers with other empty inputs and removes a surprising runtime error from common validation helpers.
+
+### **SQLite bindings accept ArrayBuffer and SharedArrayBuffer** (62acd48)
+`node:sqlite` now binds raw `ArrayBuffer` and `SharedArrayBuffer` values, not just typed-array views, both for positional and named parameters. The new tests cover inserts and queries with those buffer types, expanding the public API surface in a useful way.
+
+### **FIPS startup failures now explain what went wrong** (b79dcdf)
+Node now reports a concrete reason when `--enable-fips` or `--force-fips` fails instead of falling back to a blank OpenSSL error dump. On OpenSSL 3, it explicitly detects the missing `fips` provider and returns a clearer startup error.
+
+### **FIPS mode disablement stops being treated as a failure** (6b8a454)
+Disabling FIPS via OpenSSL 3 is now handled correctly, fixing a regression where a successful disable could be misread as an error. The change also adds regression coverage for the enable/disable sequence.
+
+### **DNS `resolveAny()` handles large TTL reply buffers** (3e6cca0)
+The c-ares wrapper now sizes TTL storage dynamically instead of relying on a fixed 256-entry stack buffer, preventing overflow/under-allocation for large `ANY` responses. This closes a security issue, CVE-2026-58042, and comes with a focused regression test.
+
+### **URL setters avoid crashing on unparsable serialized URLs** (b33cc0e)
+Updating URL properties now fails gracefully when reparsing the serialized URL would be invalid, rather than asserting and crashing Node. This fixes a sharp edge in WHATWG URL setters when the current `href` cannot round-trip through the parser.
+
+### **OpenSSL FIPS build and test infrastructure added** (dc7838c)
+The build/test tooling gains a dedicated OpenSSL FIPS Nix package and matrix entry for CI coverage. This supports validating the new FIPS behavior end-to-end.
+
+### Other misc changes
+- OpenSSL/FIPS build and config fixes: `node.gyp`, `configure.py`
+- Crypto internals cleanup and string reuse refactor
+- Docs updates for FIPS, `node.1`, stream defaults, buffer behavior, and `pbkd2Sync`
+- WPT/WebCrypto fixture refresh
+- Root CA bundle and sccache version bumps

src/posts/2026-08-05_oven-sh-bun.md

@@ -0,0 +1,28 @@
+---
+date: 2026-08-05
+repo: oven-sh/bun
+size: L
+title: "Security fixes, h2 stability, and install control"
+excerpt: "A major day of crash fixes across HTTP/2, fetch, Bun.serve, and editor APIs, plus isolated install hardening and TLS session caching."
+commits: 20
+authors: [robobun]
+commit_authors: {"3179434": robobun, "4fb02aa": robobun, "3f93daa": robobun, "abd7433": robobun, "4c26d64": robobun, "1f606e6": robobun, "402263e": robobun, "e752497": robobun, "f32cf86": robobun, "0f53bd0": robobun, "2ac192c": robobun, "dec3059": robobun, "1c4cfba": robobun, "d601782": robobun, "20f9397": robobun, "ef32923": robobun, "ce1d5b4": robobun, "9e36e9f": robobun, "6b6fb1a": robobun}
+---
+
+### **Enable `install.hoist` to disable isolated fallback hoisting** (3f93daa)
+Bun’s isolated linker now has a `hoist = false` switch to skip `node_modules/.bun/node_modules`, making store packages fail on undeclared imports instead of silently resolving phantom deps. The change is documented in bunfig/.npmrc docs and wired through the parser and installer options.
+
+### **Cache fetch TLS sessions for faster resumption** (6b6fb1a)
+`fetch()` now keeps a client-side TLS session cache so repeat connections to the same origin can resume instead of paying a full handshake and cert verification again. This reduces latency for cold-to-warm origin reconnects and closes a long-standing gap where only socket-based APIs could reuse sessions.
+
+### **Fix multiple HTTP/2 transport reentrancy and UAF crashes** (402263e, 2ac192c, 3179434, f32cf86)
+Several high-severity HTTP/2 bugs were fixed around transports that run user JS during writes: payloads are now copied when a JS callback can mutate or detach the backing buffer mid-send, frame emission no longer splits across re-entrant write callbacks, and stream lifetime bookkeeping was tightened to avoid use-after-free conditions in h2/h3 fetch paths.
+
+### **Bun.serve stop() now waits for real open connections** (abd7433)
+Graceful server shutdown now tracks live HTTP connections so the drain promise stays pending while keep-alive sockets are still open. That fixes cases where `server.stop(false)` could resolve too early and improves correctness for connection accounting during upgrades and closes.
+
+### **Prevent crashes in `Bun.openInEditor` and `bun test` formatting** (dec3059, 9e36e9f)
+`Bun.openInEditor()` now reads option values before borrowing its editor context, avoiding re-entrant RefCell panics from getters that call back into the API. The test runner also stopped crashing when pretty-formatting a `FormData` whose `toJSON` is missing or non-callable.
+
+### **Stabilize `node:http2` frame writes and metafile output** (4c26d64, 1c4cfba, ef32923, 20f9397, 1f606e6, 0f53bd0, e752497, d601782, ce1d5b4, 4fb02aa)
+The rest of the day was mostly correctness and test-harness work: deterministic metafile import paths, Windows socket-inherit fixes, safer file watch cleanup, GC/listener lifetime fixes, a direct-stream chunked terminator fix, and broad install-test cleanup now using TOML serialization. Temporal was also enabled by default.

src/posts/2026-08-05_pnpm-pnpm.md

@@ -0,0 +1,40 @@
+---
+date: 2026-08-05
+repo: pnpm/pnpm
+size: L
+title: "Sudo guard, GVS fixes, and major refactors"
+excerpt: "pnpm adds sudo protection, fixes several install/tarball edge cases, and lands big Rust module splits plus NAPI/API improvements."
+commits: 15
+authors: [zkochan, edwardlong-ctrl]
+commit_authors: {"34347bc": zkochan, "21429c6": edwardlong-ctrl, "bdb25ee": zkochan, "769fad5": zkochan, "8753f7d": zkochan, "1a75bb2": zkochan, "a92dc94": zkochan, "29b6da6": zkochan, "420f91b": zkochan, "1ee45b9": zkochan, "a550eca": zkochan}
+---
+
+### **Sudoed global mutations now warn in v11 and fail in v12** (bdb25ee)
+Running `pnpm setup`, `pnpm self-update`, or global write operations through `sudo` is now explicitly blocked, because pnpm keeps global state in the invoking user's home directory. v11 emits a warning; v12 turns that into `ERR_PNPM_SUDO_NOT_SUPPORTED`, while read-only global commands still work.
+
+### **Global virtual-store imports are now safe under concurrency, and the Node API can use them** (a550eca)
+Concurrent installs sharing a global virtual store no longer race when importing the same slot, avoiding directory-not-empty failures and transient removals of directories another process may be reading. The Node API also now exposes global-virtual-store configuration and related install inputs, making the shared store usable from embedders.
+
+### **`link:` deps inside global virtual-store slots are now materialized correctly** (8753f7d)
+`link:` dependencies are now included in the virtual-store slot hashing and materialization logic, so linked children stay present inside shared slots and changes to the link target invalidate the right ancestors. This fixes isolation bugs where a slot could miss a peer or be reused despite a changed linked target.
+
+### **Tarball extraction now normalizes backslashes in archive entry paths** (420f91b)
+Archive entries using `\` as a separator are now treated the same way pnpm already treats them elsewhere, so Windows-authored paths resolve correctly on Unix instead of being stored verbatim. That also closes a path-traversal gap where backslash-based `..` segments could bypass validation.
+
+### **Store path resolution keeps sandboxed installs inside the project** (21429c6)
+When nothing above the project can accept hard links, pnpm now creates the default store under `node_modules/.pnpm-store` inside the project instead of falling back to the home directory. That avoids copying everything in constrained sandboxes and prevents the store from escaping writable project-only mounts.
+
+### **`resolveDependency({ fullMetadata: true })` now preserves custom registry fields** (34347bc)
+The NAPI resolver stopped stripping full-metadata packuments down to npm's abbreviated field set, which had dropped registry-specific fields like Bit's `componentId`. This restores the API's expected full document shape for callers that need richer metadata.
+
+### **Major Rust modules were split for maintainability** (769fad5)
+The deps-restorer build phase was carved into smaller modules, with the orchestration left in place and the policy, snapshot build, and slot logic moved out. This is a structural refactor only, but it makes one of the crate's largest files much easier to navigate.
+
+### **More large internal refactors landed across install, audit, and tarball code** (1a75bb2, a92dc94, 29b6da6, 1ee45b9)
+Several other oversized Rust modules were split into per-concern pieces, including optimistic repeat-install checks, frozen install internals, the audit command, and the tarball crate root. These are mostly code-motion refactors, but they significantly reduce file size and improve long-term maintainability.
+
+### Other misc changes
+- Dependency / toolchain / GitHub Actions updates (2 commits)
+- Release prep for pacquet 12.0.0-rc.0
+- Move Rust CLI release lane from beta to rc
+- Minor changelog/test/package metadata updates

src/posts/2026-08-05_tc39-ecma262.md

@@ -0,0 +1,21 @@
+---
+date: 2026-08-05
+repo: tc39/ecma262
+size: M
+title: "Index helpers and execution-context cleanup"
+excerpt: "A refactor adds shared index-conversion helpers and rewrites several string, array, and typed-array algorithms; editorial cleanup also tightens execution-context wording."
+commits: 7
+authors: [gibson042, bakkot, michaelficarra, ljharb]
+commit_authors: {"f9ae2d7": bakkot, "4ebfa1c": michaelficarra, "7221f6c": gibson042, "f76baf1": gibson042, "8cb397f": ljharb, "668a264": gibson042, "51c90da": gibson042}
+---
+
+### **Introduce shared index conversion helpers and apply them broadly** (8cb397f, 668a264, 51c90da)
+The spec now defines `ToAbsoluteIndex` and `ToClampedIndex` as reusable abstract operations, replacing many repeated clamp/negative-index patterns across string, array-like, and typed-array methods. This makes the algorithms easier to read and keeps index handling consistent in places like `at`, `includes`, `indexOf`, `slice`, `copyWithin`, and several typed-array operations.
+
+### **Clarify execution-context resumption language** (f9ae2d7)
+The wording around resuming suspended contexts was changed from “Return” to “passing” to better reflect control transfer between execution contexts. A few generator and async-generator algorithms were also adjusted to model resumption explicitly.
+
+### **Other misc changes**
+- Editorial note move for CRLF line-terminator text (4ebfa1c)
+- ESMeta typecheck fixes and related spec assertions (7221f6c)
+- TypedArray `subarray` refactor to clarify `TypedArraySpeciesCreate` argument-count variance (f76baf1)