digest: add issues for 2026-06-04

Author: github-actions[bot]

src/posts/2026-06-03_biomejs-biome.md

@@ -0,0 +1,27 @@
+---
+date: 2026-06-03
+repo: biomejs/biome
+size: L
+title: "Biome adds a new linter rule and parser fixes"
+excerpt: "New `useIncludes` lint, RDJSON now reports real fix text, and HTML/Svelte parsing gets two correctness fixes."
+commits: 4
+authors: [Mokto, Dotify71, mangod12, dyc3]
+commit_authors: {"96ef9a4": Mokto, "0f29b83": Dotify71, "c394fae": mangod12, "c3f07f7": dyc3}
+---
+
+### **New `useIncludes` lint rule for clearer membership checks** (0f29b83)
+Biome adds a nursery rule that flags `indexOf(...) !== -1`-style comparisons and suggests `includes()` or `!includes()` instead. It also wires the rule into config/schema generation and ESLint migration so it can be enabled and discovered like other built-in rules.
+
+### **RDJSON reporter now emits replacement text for fix suggestions** (c394fae)
+The RDJSON reporter was sending the human-readable fix description instead of the actual code replacement text. This fixes structured reporter output so downstream tools get the real suggested edit, not just a summary.
+
+### **Svelte `{#each}` parsing now accepts TypeScript `as const`** (96ef9a4)
+Biome’s HTML/Svelte parser now distinguishes a TypeScript `as const` assertion inside the iterable expression from the Svelte binding `as`. That prevents valid `{#each}` expressions from being rejected and makes Svelte parsing more compatible with TypeScript syntax.
+
+### **HTML parser stops rejecting literal `\u` attribute text** (c3f07f7)
+Quoted HTML attribute values no longer treat raw `\u` sequences as invalid escape handling. This removes an unnecessary parser restriction and lets literal backslash-u text pass through normally.
+
+### Other misc changes
+- RDJSON snapshot/test updates and diagnostics serialization tweaks
+- HTML parser lexer cleanup related to string-literal handling
+- Linter config/schema generation updates for the new rule

src/posts/2026-06-03_denoland-deno.md

@@ -0,0 +1,47 @@
+---
+date: 2026-06-03
+repo: denoland/deno
+size: L
+title: "Deno hardens LSP, npm, and web compat"
+excerpt: "Major refactors in web geometry and Node polyfills, plus several LSP, npm, and Jupyter fixes with user-visible behavior changes."
+commits: 19
+authors: [divybot, crowlbot, bartlomieju, nathanwhitbot, nathanwhit, denobot]
+commit_authors: {"8875139": nathanwhit, "e032939": nathanwhitbot, "5bfb235": nathanwhitbot, "c7f97e5": nathanwhitbot, "4acfa5d": divybot, "9935b92": divybot, "085be0b": denobot, "f4be8bc": crowlbot, "d23528d": crowlbot, "d325319": crowlbot, "a984e2d": divybot, "c4e2dcd": bartlomieju, "49bdca6": bartlomieju, "5921c21": crowlbot, "b6c0d09": bartlomieju, "ee3040e": bartlomieju, "279285c": divybot, "85cb7ae": divybot, "f07b46d": divybot}
+---
+
+### **Web geometry drops nalgebra for local math** (c7f97e5)
+Deno’s `deno_web` geometry implementation now uses in-tree vector/matrix helpers instead of `nalgebra`, trimming the dependency graph and keeping DOMMatrix/DOMPoint behavior local to the module. This is a sizable refactor with direct impact on bundle size, build complexity, and future maintenance.
+
+### **Node polyfills are migrated to primordials** (9935b92)
+The entire `ext/node/polyfills/` layer was converted to use primordials, removing the old lint suppression and aligning the Node compatibility surface with Deno’s hardened runtime patterns. This is a broad internal refactor across dozens of files that reduces reliance on mutable globals.
+
+### **Jupyter kernel handshake is fixed for real ZMTP peers** (49bdca6)
+The JS Jupyter kernel now speaks a libzmq-compatible ZMTP handshake, including the correct greeting format, READY framing, and single-write frame emission. This unblocks real editors and clients like VS Code and JupyterLab from failing at kernel info / message delivery.
+
+### **npm tarball auth now falls back for same-origin registries** (c4e2dcd)
+Tarball fetching now reuses scoped registry credentials when the tarball is served from the same origin as the registry, even if the tarball path doesn’t match the auth scope prefix. That fixes installs against registries like GitLab instance-level npm endpoints where tarballs live under a different path.
+
+### **Workspace lifecycle scripts now run for npm package members** (4acfa5d)
+The installer now treats workspace members as lifecycle-capable install roots, including members without package metadata, and orders scripts so transitive workspace dependencies still run first. This changes npm workspace install behavior in a user-visible way and adds coverage for the new execution order.
+
+### **LSP request serialization is tightened for positional TSC calls** (5921c21)
+Several TypeScript server requests now serialize through `ToV8` instead of generic serde paths, with primitive tuples encoded more directly and integers wrapped explicitly as JS numbers. This is a correctness-focused refactor in the LSP transport layer that reduces conversion ambiguity.
+
+### **LSP fixes notebook diagnostics and workspace scoping** (85cb7ae, e032939, f07b46d)
+Notebook and untitled/in-memory documents are now associated with the workspace root, avoiding bogus scope resolution and suppressing spurious library redeclaration diagnostics in Jupyter cells. In the same area, the document cache was refactored away from `weak-table`, and the LSP parent-process checker now avoids killing the server when the editor PID isn’t visible inside a container or private PID namespace.
+
+### **PerformanceObserver buffered entries now replay correctly** (d23528d)
+`PerformanceObserver.observe({ buffered: true })` now replays already-recorded entries into the observer buffer as the spec requires. This fixes a user-visible API bug where buffered observers missed earlier performance entries.
+
+### **MessageEvent.ports is now frozen** (d325319)
+`MessageEvent.ports` is now exposed as a frozen array, matching the spec’s `FrozenArray<MessagePort>` semantics. Code that mutates the ports array will now fail as it should instead of silently succeeding.
+
+### **Local-file fallback handles import-map folder name conflicts** (b6c0d09)
+When import-map resolution points at an npm package path that doesn’t exist, Deno now retries the original `{package}/{subpath}` as a local file if present. This fixes `deno run` cases where a folder name matches an import-mapped package name.
+
+### Other misc changes
+- Version bump to 2.8.2 and release metadata updates (085be0b)
+- Differential tests for geometry matrix math (8875139)
+- Regression specs for non-executable entrypoints, workspace symlink cycles, and import-map rename behavior (f4be8bc, a984e2d, 279285c)
+- Reverted the descriptive `__proto__` accessor error due to Playwright incompatibility (ee3040e)
+- Minor npm/LSP/doc cache refactors and cleanup (e032939, 5bfb235, 5921c21, f07b46d)

src/posts/2026-06-03_microsoft-typescript-go.md

@@ -0,0 +1,30 @@
+---
+date: 2026-06-03
+repo: microsoft/typescript-go
+size: L
+title: "LSP overhaul and several crash fixes"
+excerpt: "Major API and LSP protocol changes landed alongside fixes for declaration emit, parser edge cases, and several compiler panics."
+commits: 22
+authors: [andrewbranch, a-tarasyuk, ahejlsberg, weswigham, jakebailey]
+commit_authors: {"84a8751": andrewbranch, "3a693d2": andrewbranch, "2058ba3": weswigham}
+---
+
+### **Use integer snapshot IDs and add profiling APIs** (3a693d2)
+The native preview API now uses numeric snapshot IDs instead of strings, updating release calls and the internal object wiring accordingly. It also adds internal CPU/heap profiling endpoints, which is a meaningful API shift for tooling built on this package.
+
+### **Move experimental LSP capabilities under `experimental`** (221106c)
+Client capability negotiation now follows the LSP spec by placing these custom flags under `capabilities.experimental`, and the server-side hover path now reads the new location. This affects multiple editor features and the generated protocol types, so it’s a real wire-format change.
+
+### **Consolidate LSP logs into a single output pane** (84a8751)
+Logging was reworked so the extension and server funnel output into one pane instead of scattered logging paths. That should make diagnostics and session debugging much easier for users and contributors.
+
+### **Fix declaration emit skipping and diagnostics tracking** (2058ba3)
+Declaration emit now keeps running long enough to record transform diagnostics, but still suppresses output when declaration errors are present. The incremental build path was updated in tandem so emit-diagnostic state is tracked consistently.
+
+### **Handle more declaration-emit and checker crash cases**
+Several fixes landed for real compiler failures: invalid decorator targets, broken set accessors, bad expando namespace emit, inferred object literals referencing `this`, and an infinite recursion path in control-flow analysis. Together these are substantial stability improvements for declaration emit and type checking.
+
+### **Other misc changes**
+- Fixed redirect ordering in module path ranking, tsconfig key diagnostics, JSX pragma scanning, source-map emit, wildcard pattern overlap panics, and a few other edge cases.
+- Switched an LSP overlay fallback, adjusted hover/source-definition tests and generated protocol code, and removed one CI VM test matrix entry.
+- Misc test/baseline updates and small internal refactors across parser, resolver, emitter, and build tooling.

src/posts/2026-06-03_nodejs-node.md

@@ -0,0 +1,22 @@
+---
+date: 2026-06-03
+repo: nodejs/node
+size: M
+title: "Crypto hardens, fs watch race fixed"
+excerpt: "Node.js patches a crypto allocation failure path and fixes recursive fs watch ENOENT races; docs and tooling also updated."
+commits: 6
+authors: [aduh95, trivikr, watilde, Herrtian]
+commit_authors: {"8346181": aduh95, "af2e68b": watilde, "f47f941": Herrtian, "b345a17": aduh95, "3dfd512": trivikr, "4d7996f": trivikr}
+---
+
+### **Crypto now fails gracefully on cipher context allocation errors** (f47f941)
+WebCrypto AES and ChaCha20-Poly1305 now return a failure status if cipher context allocation fails instead of hard-checking and aborting. The lower-level cipher init path also surfaces a proper `ERR_CRYPTO_OPERATION_FAILED` error, making these OOM-style failures handleable rather than fatal.
+
+### **Recursive fs watch ignores deleted directories during scan** (4d7996f)
+The non-native recursive watcher now suppresses `ENOENT` when a directory disappears between discovery and scan, avoiding an unhandled watcher error in a real deletion race. A regression test was added to lock in the behavior.
+
+### **Other misc changes**
+- zlib updater script fixed to be more portable/robust (8346181)
+- Node.js 25 marked End-of-Life in the changelog index (b345a17)
+- async-hooks abort tests updated to accept platform-specific abort signals (3dfd512)
+- http2 docs typo fix: “used to sent” → “used to send” (af2e68b)

src/posts/2026-06-03_oven-sh-bun.md

@@ -0,0 +1,35 @@
+---
+date: 2026-06-03
+repo: oven-sh/bun
+size: L
+title: "Bun fixes DNS, fetch, Windows paths, and GC safety"
+excerpt: "A mixed day of crash fixes and minifier polish: Windows path overflow, DNS UTF-16 handling, empty compressed fetch bodies, and setter type safety."
+commits: 8
+authors: [robobun, Jarred-Sumner, alii]
+commit_authors: {"bf70cc7": Jarred-Sumner, "43fff14": robobun, "40d8c4e": robobun, "d2a6506": robobun, "79b5471": alii, "800c0e5": robobun, "5d9b84a": robobun, "a587949": robobun}
+---
+
+### **Fix Windows over-long path conversion to UTF-16** (43fff14)
+Bun now guards UTF-8→UTF-16 conversion buffers instead of assuming they fit, preventing a crash when extremely long Windows paths are converted for `node:fs`. The fix adds checked conversion paths and regression coverage for the 49k+ character range that previously panicked.
+
+### **Harden DNS lookup/resolve for UTF-16 strings** (d2a6506)
+`Bun.dns.lookupService` and `Bun.dns.resolve` now convert string inputs through the UTF-16-safe slice path, avoiding a debug assertion when JS strings are backed by 16-bit storage. This closes a fuzzing crash and makes DNS argument handling work with strings from APIs like `TextDecoder("utf-16le")`.
+
+### **Treat empty compressed fetch bodies as empty** (79b5471)
+Fetch no longer tries to decompress a response that advertises gzip but sends zero body bytes, which previously surfaced as `ZlibError`. Empty compressed responses now resolve to an empty body, matching Node and fixing a real interoperability bug.
+
+### **Collapse single-return arrow bodies during minification** (800c0e5)
+The bundler now rewrites arrows like `{ return a + b }` into expression bodies when minifying syntax, producing shorter output that matches other tooling. The change is gated so runtime transpilation and `Function.prototype.toString()` behavior stay unchanged.
+
+### **Fix type confusion in generated class custom setters** (5d9b84a)
+Generated DOM-style setter wrappers now verify the receiver type before downcasting, instead of blindly assuming the `this` value is the expected class instance. That prevents heap corruption when setters are invoked through proxies, prototype tricks, or extracted accessor functions.
+
+### **Stub `process.execve` inside the Fuzzilli REPRL wrapper** (40d8c4e)
+The fuzzing REPRL harness now replaces `process.execve` with a no-op so fuzz cases can’t terminate the child process by design. That keeps deterministic fuzz runs from being misclassified as crashes while still testing the wrapper logic.
+
+### **Fix resolver filename-store overflow under `--bun`** (a587949)
+Bun’s resolver intern pool and related overflow list sizing were adjusted to avoid a panic once the filename store grows past the old hard limit. This removes a `--bun`-specific crash path that could be triggered by heavy resolution workloads.
+
+### Other misc changes
+- Removed stale `TODO(port)` comments and dead code across AST, bundler, and core modules (bf70cc7).
+- Misc internal cleanup and test-only adjustments around the high-impact fixes above.

src/posts/2026-06-03_pnpm-pnpm.md

@@ -0,0 +1,31 @@
+---
+date: 2026-06-03
+repo: pnpm/pnpm
+size: L
+title: "pnpr gets faster, smaller, and properly benchmarked"
+excerpt: "One-round-trip installs, gzip packuments, metadata slimming, and CI benchmark upgrades make pnpr materially faster."
+commits: 8
+authors: [zkochan]
+commit_authors: {"f06ab5e": zkochan, "69cfcb7": zkochan, "3492bb8": zkochan, "65c9bef": zkochan, "e1648a6": zkochan, "6305e95": zkochan, "930c9d7": zkochan}
+---
+
+### **One-round-trip install-accelerator cold path** (f06ab5e)
+The pnpr client now asks the server to inline missing files in `/v1/install`, eliminating the separate handshake and `/v1/files` fetch on the cold path. That cuts a remote install from three sequential trips to one, which is a major latency win for real deployments.
+
+### **pnpr packuments are now gzip-compressed** (3492bb8)
+The server and client both enabled gzip for package metadata, bringing pnpr closer to how CDN-fronted registries behave in practice. This should materially reduce resolution-time transfer cost, since packuments are among the largest payloads fetched during installs.
+
+### **Abbreviated packuments were slimmed further** (6305e95)
+pnpr now strips more unused metadata from abbreviated packuments before serving them, including several top-level and per-version fields that resolvers never read. Less JSON on the wire means less download, parsing, and caching overhead for clients.
+
+### **Packument timestamps are coarsened to shrink responses** (e1648a6)
+The resolver side now accepts rounded publish times, letting pnpr reduce precision in abbreviated packuments without breaking `minimumReleaseAge` checks. This trims more bytes from metadata responses while preserving the resolver guarantees it needs.
+
+### **Install-accelerator benchmarking now reflects real network cost** (930c9d7, 65c9bef, 69cfcb7)
+The integrated benchmark was expanded to measure both direct installs and pnpr-backed installs, with injected latency so the remote-server shape is actually exercised. CI also gained per-commit binary caching for benchmark revisions, which should make these runs much less expensive and more stable.
+
+### **Other misc changes**
+- Renamed the experimental `agent` setting/client to `pnprServer` / `@pnpm/pnpr.client` and updated related config plumbing.
+- Fixed a pnpr regression around forwarding `optionalDependencies`.
+- Honored `--lockfile-only` correctly through pnpr.
+- CI/workflow tweaks for benchmark uploads, paths, timeouts, and helper plumbing.

src/posts/2026-06-03_tc39-ecma262.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-03
+repo: tc39/ecma262
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-03_tc39-proposals.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-03
+repo: tc39/proposals
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-03_vitejs-vite.md

@@ -0,0 +1,23 @@
+---
+date: 2026-06-03
+repo: vitejs/vite
+size: M
+title: "Type-safety, sourcemaps, and glob fixes"
+excerpt: "Stronger import-glob typings, a path-segment glob base fix, and optimized dep sourcemap preservation landed alongside a lexer bump."
+commits: 5
+authors: [nicolo-ribaudo, nathanhleung, jiyujie2006, Andarist, i62navpm]
+commit_authors: {"1298951": Andarist, "cc39e55": nathanhleung, "eb12604": jiyujie2006}
+---
+
+### **Preserve sourcemaps for optimized deps with follow-up transforms** (1298951)
+Vite now writes optimized dependency bundles with hidden sourcemaps and reads the generated `.map` file back when serving them. This should keep stack traces and debugging accurate even when optimized deps go through extra transforms.
+
+### **Add more precise `importGlob` typing for known queries** (cc39e55)
+The `importGlob` types now distinguish known `query` values like `?raw` from unknown ones, and export the new `KnownQueryTypeMap`. That makes the return type better reflect `eager`, `as`, and query combinations, improving type inference for users.
+
+### **Fix `import.meta.glob` common-base detection by path segment** (eb12604)
+`getCommonBase()` no longer treats path prefixes as shared directories, so patterns like `/a/foo/*.js` and `/a/foobar/*.js` correctly resolve only to `/a`. This avoids incorrect base calculation when glob roots merely share a string prefix.
+
+### Other misc changes
+- Bumped `es-module-lexer` to 2.0.0.
+- Clarified `loadEnv()` docs to say it merges matching `process.env` values.