digest: add issues for 2026-06-03

Author: github-actions[bot]

src/posts/2026-06-02_biomejs-biome.md

@@ -0,0 +1,43 @@
+---
+date: 2026-06-02
+repo: biomejs/biome
+size: L
+title: "CSS, Svelte, YAML and Tailwind land"
+excerpt: "Parser, formatter, and lint fixes plus a new Svelte rule; YAML formatting and Tailwind variants also expanded."
+commits: 12
+authors: [Mokto, siketyan, tim-we, dyc3, jiwon79, denbezrukov, Conaclos]
+commit_authors: {"99bc7df": Mokto, "935c59a": dyc3, "c656679": Mokto, "a1b5834": Mokto, "44c22e9": jiwon79, "d150071": siketyan, "46d4ee6": siketyan, "1da3c75": denbezrukov, "e8e1e6a": Conaclos, "39ae9d5": siketyan}
+---
+
+### **Fix CSS selector lists inside `:global()`/`:local()` (99bc7df)**
+Biome’s CSS parser now accepts comma-separated selector lists in CSS Modules/Svelte-style pseudo-class functions like `:global(.foo, .bar)`. This closes a real parsing gap that previously turned valid selectors into bogus pseudo-classes.
+
+### **Truncate overly long diagnostics (935c59a)**
+Diagnostic rendering now trims extremely long lines and spans with ellipses so error output stays readable instead of sprawling across the terminal. This is a user-facing quality-of-life fix for pathological inputs.
+
+### **Add `useSvelteRequireEachKey` nursery rule (c656679)**
+Biome adds a new Svelte lint rule that flags `{#each}` blocks missing keys, bringing coverage for a common correctness/performance footgun in Svelte apps. The change also wires the rule into config, migration, docs metadata, and the backend schema.
+
+### **Parse destructuring rename bindings in Svelte `each` blocks (a1b5834)**
+The Svelte parser and formatter now support rename bindings like `{#each items as { id, component: Filter }}`. This fixes a syntax case that was previously rejected and required broad syntax/formatter/codegen updates.
+
+### **Parse Tailwind variant expressions (44c22e9)**
+Tailwind parsing now understands variant expressions, expanding support for more of the framework’s class syntax. The lexer and syntax tree were updated alongside a large batch of parser snapshots, indicating a substantial grammar expansion.
+
+### **Implement YAML file handling (39ae9d5)**
+Biome adds a YAML file handler in the service layer, making YAML part of the core file-processing pipeline. This is the plumbing needed for YAML support to be discovered and routed correctly.
+
+### **Preserve CSS declaration comment boundaries (1da3c75)**
+CSS and SCSS formatting now keeps spacing around comments that sit between a declaration name and `:` or after `!important`. That avoids reformats that can visually merge comments into syntax in a way that changes readability.
+
+### **Fix `useImportType` separated-type behavior (e8e1e6a)**
+`useImportType` now handles the `separatedType` style correctly when a default import is present and all named imports are types. The fix also tightens the code that extracts combined specifiers into a new import statement.
+
+### **Initial YAML formatter support for simple block mappings (46d4ee6)**
+Biome’s YAML formatter gets an initial pass at formatting simple block mappings instead of treating them purely verbatim. This is an important step toward real YAML pretty-printing, and the commit also updates comment handling and defaults around YAML formatting.
+
+### **Initial YAML formatter support for block sequences (d150071)**
+Block sequences are now formatted explicitly, along with supporting work in scalars and flow nodes. Together with the mapping work, this substantially broadens the formatter’s YAML coverage.
+
+### Other misc changes
+- Dependency/workflow bump: GitHub Actions major update (1 commit)

src/posts/2026-06-02_denoland-deno.md

@@ -0,0 +1,43 @@
+---
+date: 2026-06-02
+repo: denoland/deno
+size: L
+title: "Deno hardens Node, LSP, and compile flows"
+excerpt: "A heavy day of fixes and feature work across Windows, LSP autocomplete, native addons, npm install behavior, and compile bundling."
+commits: 47
+authors: [divybot, bartlomieju, nathanwhitbot, Xavrir, magurotuna, crowlKats, crowlbot]
+commit_authors: {"1425761": divybot, "5208330": magurotuna, "5604379": divybot, "7aceb22": bartlomieju, "840a734": bartlomieju, "d95ceb5": nathanwhitbot, "2f912cc": bartlomieju, "214f3d1": bartlomieju, "0bf0c7e": bartlomieju, "9deee55": bartlomieju, "3ac850f": divybot, "34ce847": divybot, "39893c2": divybot, "adba38f": divybot, "6a74fd2": bartlomieju, "cbb34eb": divybot, "5857f18": divybot, "ba7ed1a": divybot, "563aa7b": divybot, "b0cc911": divybot, "5f63bcb": divybot, "e7e1606": divybot, "ec2b4bf": bartlomieju, "9d13e9d": divybot, "ccfe78a": bartlomieju, "c9e800d": divybot, "619742f": bartlomieju, "e086b32": divybot, "20b2881": divybot, "5bb4051": divybot, "815bc76": divybot, "a7e40b0": divybot, "3b0cdf4": divybot, "ce605a1": divybot, "15a4c1a": crowlKats, "93d5bfa": divybot}
+---
+
+### **Node HTTP/S proxy support lands behind new flags** (ba7ed1a)
+Deno now wires Node's `--use-env-proxy` / `--no-use-env-proxy` into the CLI and sets `NODE_USE_ENV_PROXY` so the Node polyfills can honor `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`. The `node:_http_proxy` plumbing adds proxy-aware connection behavior for `node:http` and `node:https`, including CONNECT tunneling and HTTPS proxy handling.
+
+### **React Server Components CVEs get an opt-in patch layer** (9deee55)
+This adds load-time source rewriting for affected React Server Components builds, gated by `DENO_PATCH_REACT_CVE`. It targets the reported RCE and DoS cases so users can protect apps that depend on vulnerable `react-server-dom-*` versions without waiting for upstream packages.
+
+### **Compiled binaries now preserve CJS semantics for host files** (15a4c1a)
+`deno compile` can now analyze CommonJS files loaded from the host filesystem at runtime instead of assuming they are ESM. That fixes named-import failures in standalone binaries for real-world npm packages whose CJS entrypoints are not embedded in the VFS.
+
+### **LSP memory use drops when idle, and OOMs no longer kill the server** (3ac850f, 5bb4051)
+The language server now releases idle TSC memory back to the OS and recovers more gracefully if the type-checker isolate runs out of memory. Together, these changes make long-lived editor sessions substantially more stable.
+
+### **`deno compile --bundle` gets minification and better dependency closure** (6a74fd2, ccfe78a)
+Compilation now supports `--minify` for bundled output, reducing embed size and runtime memory at the cost of less readable stack traces. The bundling path also learned to pull in deeper CJS dependencies so compiled bundles miss fewer npm graph edges.
+
+### **N-API and legacy addon support gets a major cleanup** (b0cc911, a7e40b0, 9d13e9d, c9e800d, e7e1606)
+Deno expands the exported libuv/N-API surface for addons like ZeroMQ, allows native constructors to call back into JavaScript during construction, and replaces cryptic crashes for legacy V8/nan addons with clear errors and suggestions. Windows addon loading also now surfaces the real failure when a prebuilt binary links against `node.exe`.
+
+### **npm installer behavior is tightened for cache reuse and workspace scripts** (7aceb22, 5f63bcb, 563aa7b)
+The installer now handles stale `node_modules` symlinks/junctions on Windows, runs lifecycle scripts with the correct workspace-member `INIT_CWD`, and deduplicates equivalent peer-dependency variants so class identity stays consistent across installs.
+
+### **`deno add` now understands `@latest` JSR tags** (840a734)
+Version-tagged JSR requests no longer panic during package selection. The command resolves tags like `@latest` by selecting the latest available version, matching the behavior used elsewhere in the codebase.
+
+### **Web platform and Node runtime fixes round out the day** (0bf0c7e, 214f3d1, 39893c2, 5604379, 5208330, 619742f, e086b32, 2f912cc, 93d5bfa, 5857f18, 563aa7b, adba38f, 3b0cdf4, ce605a1, 1425761, 815bc76, 34ce847, 20b2881, cbb34eb, ec2b4bf, d95ceb5)
+A broad set of bug fixes improved `copyFile` self-copy safety, Windows ANSI coloring, `__proto__` error reporting, `process.stdout/stderr` callback handling, fetch body length preservation, DNS error codes, and LSP auto-import/completion behavior. Several internal refactors and test refreshes also landed alongside these user-facing fixes.
+
+### Other misc changes
+- WPT submodule upgraded and expectations refreshed.
+- Dependency and lockfile updates.
+- Docs, test, and regression coverage additions.
+- Internal refactors and cleanup across CLI, runtime, and ext crates.

src/posts/2026-06-02_microsoft-typescript-go.md

@@ -0,0 +1,43 @@
+---
+date: 2026-06-02
+repo: microsoft/typescript-go
+size: L
+title: "Filesystem watcher lands, plus key fixes"
+excerpt: "Major fswatch addition and a cluster of compiler/emit fixes across JSX, async super, metadata, and tsconfig parsing."
+commits: 21
+authors: [ahejlsberg, jakebailey, a-tarasyuk]
+commit_authors: {"95a42cf": ahejlsberg, "6c88330": ahejlsberg, "503ea95": a-tarasyuk, "704847d": jakebailey, "c0b4c4e": jakebailey, "e5f8968": ahejlsberg, "9a48038": jakebailey}
+---
+
+**fswatch package added with cross-OS CI** (c0b4c4e)
+A new `internal/fswatch` package was ported in with support code, tests, docs, and workflow plumbing to run it on BSD variants in CI. This is a substantial new subsystem for file watching and a big step toward more robust watch-mode behavior.
+
+**Decorator metadata now falls back for BigInt below ES2020** (433bc1e)
+`emitDecoratorMetadata` now emits a runtime-safe `BigInt` fallback when targeting pre-ES2020 instead of always assuming `BigInt` exists. That fixes invalid output for older targets and makes decorator metadata emission safer across more compile targets.
+
+**Async `super` handling fixed in default parameters** (bef4582)
+Downlevel async transform now correctly preserves and rewrites `super` references that appear in default parameter initializers, including inside async arrow functions. This closes a real emit bug that could generate incorrect code for inheritance-heavy async patterns.
+
+**Expando property flow analysis now reaches function expressions** (e5f8968)
+Control-flow analysis was extended so dotted-name assignments on function expressions and arrows are treated like expandos instead of stopping at the variable declaration. That improves narrowing and fixes false results in scenarios involving function-valued objects with assigned properties.
+
+**tsconfig include validation now rejects `**/../` patterns** (40f6707)
+Parsing now reports the parent-traversal-after-recursive-wildcard error for include specs like `**/../*.ts`, matching expected `tsconfig` rules. The fix also avoids crashing when attaching diagnostics to missing JSON array elements.
+
+**Syntactic errors now suppress follow-on option diagnostics** (306f69d)
+`GetDiagnosticsOfAnyProgram` now stops after syntactic diagnostics when errors are already present, instead of piling on unrelated option/global/semantic diagnostics. This makes `tsc` output cleaner and closer to expected behavior in broken files.
+
+### Other misc changes
+- JSX uppercase hex entities now match `tsc` behavior (2e3f36b)
+- Auto-accessor type resolution fix (95a42cf)
+- JSDoc from contextual type used in hover when available (6c88330)
+- CommonJS shorthand destructuring rewrite fix (90c540a)
+- Incompatible function type diagnostics now use tuple labels for parameter names (336f59c)
+- Namespace imports elided when only used by type-only export aliases (c4cf203)
+- Enum member emit fixed for escaped identifiers (244cda9)
+- Null enum values handled in tsconfig parsing (9874733)
+- Async arrow `this` capture fixed in static field emit (109f18b)
+- `import.defer` preserved in CommonJS emit (503ea95)
+- macOS `F_GETPATH` realpath fix (704847d)
+- Format selection no longer deletes comments when selection ends in trivia (eb6de00)
+- VS-prefixed type naming cleanup across LSP/LS internals (9a48038)

src/posts/2026-06-02_nodejs-node.md

@@ -0,0 +1,30 @@
+---
+date: 2026-06-02
+repo: nodejs/node
+size: L
+title: "Perf wins, one crash fix, and build refactor"
+excerpt: "Node.js sped up coverage reporting, fixed a zlib crash edge case, tightened Navigator brand checks, and refactored libnode/snapshot build logic."
+commits: 18
+authors: [nodejs-github-bot, Han5991, zeeshan56656, tniessen, mcollina, bobu-putheeckal, joyeecheung, legendecas, alphaleadership, ndossche, RafaelGSS, 3zrv, addaleax, MayaLekova]
+commit_authors: {"a0423e2": tniessen, "3d35dd8": legendecas, "458c37b": ndossche, "75b16f1": Han5991, "29aad20": Han5991, "ba7e6b3": 3zrv}
+---
+
+### **Coverage reporting gets much faster** (75b16f1, 29aad20)
+The test runner now compiles coverage include/exclude globs once per `TestCoverage` instance and caches per-URL skip decisions. That removes repeated glob parsing and duplicate work across workers, which should noticeably cut coverage report time on large runs.
+
+### **zlib avoids a crash on failed deflate init** (458c37b)
+`src/node_zlib.cc` now initializes `strm_.msg` after a `deflateInit2()` failure path that can leave it uninitialized when zlib versions or stream layouts mismatch. This prevents `CompressionError` creation from dereferencing stale memory and crashing Node.
+
+### **`Navigator#language` now brand-checks like other getters** (ba7e6b3)
+The `language` getter was updated to throw on invalid receivers instead of silently working on plain objects or `Navigator.prototype`. The added test coverage locks in consistent TypeError behavior across all `Navigator` prototype getters.
+
+### **Build logic now supports snapshot/codecache with libnode** (3d35dd8)
+The build system was refactored so `node_use_node_snapshot` and `node_use_node_code_cache` no longer depend on `--shared`, and the old `--node-snapshot-main`/`--shared` incompatibility was removed. The change also reorganizes `node.gyp` around `node_base`, which is a significant build-graph cleanup that broadens supported configurations.
+
+### **X509 subject matching logic was deduplicated** (a0423e2)
+Certificate host/email/IP matching now shares a common helper, reducing duplicated control flow in `crypto_x509.cc`. This is mostly an internal refactor, but it trims maintenance overhead in a security-sensitive area.
+
+### Other misc changes
+- Doc clarifications and history updates for TTY, `worker_threads`, and `blockList`.
+- Dependency bumps: amaro, googletest, and nixpkgs.
+- Internal cleanup in FFI, external reference registration, and test fixtures/warnings.

src/posts/2026-06-02_oven-sh-bun.md

@@ -0,0 +1,57 @@
+---
+date: 2026-06-02
+repo: oven-sh/bun
+size: L
+title: "Crash fixes and Bun internals hardening"
+excerpt: "Several crash fixes landed across sourcemaps, WebSocket close handling, NAPI finalizers, fetch proxy tunneling, and bundler memory safety."
+commits: 20
+authors: [robobun, alii, Jarred-Sumner, dylan-conway]
+commit_authors: {"9333748": robobun, "3f153b9": robobun, "3edc7af": alii, "31cae2e": alii, "4b42439": robobun, "b7fa3cb": robobun, "8fe7a60": alii, "f7b9902": Jarred-Sumner, "1b7a407": dylan-conway, "684f2af": Jarred-Sumner, "9fd8850": alii, "f8f7490": robobun, "7ef293b": robobun, "17b4071": robobun, "8cf3737": robobun, "561eb8f": robobun, "fdf1246": robobun}
+---
+
+### **Sourcemap embedding now rejects overflow and oversized maps** (3f153b9)
+Bun now validates VLQ accumulation and source-map size math instead of trusting decoded values, preventing integer overflow and capacity-overflow crashes during `bun build --compile` with sourcemaps. Oversized or malformed standalone maps now fail cleanly with build errors rather than panicking.
+
+### **WebSocket close events now report the right JS code** (31cae2e)
+The WebSocket client was conflating the wire echo code with the code exposed to JavaScript, which led to incorrect `CloseEvent.code` and `wasClean` values for several close scenarios. This fixes bodyless closes, `1001` handling, and server-initiated close state transitions.
+
+### **NAPI references can be deleted from finalizers during GC** (17b4071)
+`napi_delete_reference` was incorrectly guarded against GC-time calls, causing a panic in valid finalizer paths used by Node-API addons. The fix aligns Bun with Node’s behavior and covers the experimental GC finalizer path with regression tests.
+
+### **Fetch proxy CONNECT tunneling no longer leaks stale envelope bytes** (8cf3737)
+A split CONNECT response could leave proxy handshake bytes in the response buffer, causing proxy headers and even raw upstream HTTP bytes to leak into the user-facing response. Bun now clears ownership of that buffer before tunneling starts, fixing the bad response parsing and hang.
+
+### **Repeated Worker create/terminate no longer leaks memory** (561eb8f)
+A memory leak in worker lifecycle cleanup was fixed, reducing RSS growth when workers are repeatedly spawned and terminated. This matters for apps that churn workers over long runtimes.
+
+### **Bundler stops re-interning module paths across repeated builds** (fdf1246)
+The bundler was reusing the wrong arena for pretty-path allocation and repeatedly re-interning paths into the filename store, which could panic after many in-process `Bun.build()` calls. The change fixes the ownership bug and removes the path-store growth issue.
+
+### **Install no longer panics when a removed patch is still referenced** (f8f7490)
+`bun install` now tolerates stale patch metadata when a patch has been removed from `package.json`, downloading the package unpatched instead of unwrapping a missing entry. That turns a crash into a recoverable install path.
+
+### **FilePoll unregister handles macOS kevent errors correctly** (b7fa3cb)
+macOS `EV_ERROR` changelist results carry errno values in `data`, not -1-style syscall return codes, and Bun was decoding them incorrectly before unwrapping. This fixes the unregister panic seen when stale fds are torn down while polling.
+
+### **Crash handler now trims its own stack frames correctly** (7ef293b)
+The crash handler now evaluates stack-trim anchors in the capturing frame so the reported trace centers on the real crash site instead of the handler internals. That makes crash reports materially more useful.
+
+### **Valkey RESP buffer adoption avoids extra copies** (9fd8850)
+Owned RESP payloads are now adopted as Buffer backing stores instead of being memcpy’d into new `ArrayBuffer`s for every reply. That reduces per-response allocations and copying in buffer mode.
+
+### **Package lockfile exact-pinned flags use a bitset** (f7b9902)
+`Lockfile.exact_pinned` switched from `Vec<bool>` to a packed dynamic bitset, shrinking per-package flag storage and aligning it with Bun’s existing install-time data structures. The behavior stays the same while using less memory.
+
+### **Standalone Docker test services now build their own images** (3edc7af)
+The Docker-based test services no longer rely on bind-mounted config files, which makes them work better with remote/sidecar Docker daemons. This is infrastructure work for CI portability rather than product behavior.
+
+### Other misc changes
+- Hardening sweep across multiple subsystems, including Node compatibility and input validation (684f2af)
+- WebKit dependency bump (1b7a407)
+- `bun.lock` version re-save behavior fix (9333748)
+- Docker test host override for remote Docker (`BUN_DOCKER_TEST_HOST`) (8fe7a60)
+- JS highlighter out-of-bounds panic fix (4b42439)
+- Fetch CONNECT tunnel buffer cleanup and tests (8cf3737)
+- Misc ignore/file and other low-impact maintenance changes
+- Package patch-download and related internal enqueue fixes (f8f7490)
+- Sourcemap standalone zstd guard/support updates (3f153b9)