digest: add issues for 2026-07-27

Author: github-actions[bot]

src/posts/2026-07-26_biomejs-biome.md

@@ -0,0 +1,28 @@
+---
+date: 2026-07-26
+repo: biomejs/biome
+size: L
+title: "YAML formatter gets major behavior upgrades"
+excerpt: "Biome added several YAML formatting fixes, plus new Svelte declaration-tag support and Symbol global type migration."
+commits: 6
+authors: [dyc3, minseong0324, Mokto]
+commit_authors: {"5809875": Mokto, "762c8c1": minseong0324, "a79bb36": dyc3, "c91ce44": dyc3, "52283b6": dyc3, "903b177": dyc3}
+---
+
+### **Svelte declaration tags with `let`/`const` now parse, format, and lint** (903b177)
+Biome now supports Svelte declaration tags, including formatting and linting bindings declared with `{let ...}` and `{const ...}`. This expands HTML/Svelte coverage and closes a notable language-support gap for real-world component files.
+
+### **YAML formatting gets cleaner handling for comments, scalars, and node properties** (c91ce44, a79bb36, 52283b6)
+Biome’s YAML formatter picked up three substantial behavior changes: comments are now indented according to block structure, flow scalar content is normalized more accurately, and node properties stay on the entry line where appropriate. Together these improve readability and reduce surprising rewrites across mappings, sequences, anchors, tags, and multiline scalars.
+
+### **HTML/Svelte embedded code no longer reindents verbatim regions** (5809875)
+`biome check --write` is now idempotent for Svelte files in the cases covered here: multiline template literals in `<script>` blocks and block comments in `<style>` blocks stop gaining extra indentation on repeated runs. That fixes a concrete formatting bug that could otherwise churn files on every autofix pass.
+
+### **Symbol global types were migrated into generated type data** (762c8c1)
+The JS type-info generator now owns `Symbol`, `Symbol.dispose`, and `Symbol.asyncDispose` type definitions, instead of keeping them as manual globals. This tightens the global-type model and preserves the expected static members on `Symbol` while aligning the generated metadata with the rest of the predefined globals.
+
+### Other misc changes
+- YAML formatter test coverage expanded across many multiline/comment/anchor fixtures.
+- Svelte formatter/analyzer test updates and snapshot additions.
+- HTML service/parser internals adjusted to support the embedded formatting fix.
+- Added changeset entries for the released patch-level behavior changes.

src/posts/2026-07-26_denoland-deno.md

@@ -0,0 +1,22 @@
+---
+date: 2026-07-26
+repo: denoland/deno
+size: M
+title: "Deno desktop and Node compat get notable fixes"
+excerpt: "Desktop navigation events, node:test tags, and web stream interop were improved; Laufey was also bumped to 0.6.1."
+commits: 4
+authors: [littledivy, bartlomieju]
+commit_authors: {"34c4661": littledivy, "bec84a0": bartlomieju, "39cc464": bartlomieju, "dc80b47": littledivy}
+---
+
+### **Desktop now exposes page-load events and fixes HMR URL parsing** (34c4661)
+Deno Desktop now surfaces a `load` event on `BrowserWindow` and forwards completed navigation as a `pageLoad` event, which also preserves the initial hidden-window reveal behavior on first load. The same change strips ANSI codes from framework dev-server output so colored HMR URLs can be parsed correctly.
+
+### **node:test gains tag filtering support** (bec84a0)
+`node:test` now accepts experimental `testTagFilters`, normalizes a single string into an array, validates the filter types, and emits the one-time experimental warning when tags are used. Test contexts also carry canonical tags through parent/child suites so tag inheritance and filtering work consistently.
+
+### **Web stream and Node stream interop is tightened** (39cc464)
+Node compat for streams was expanded to handle real web `TransformStream`s in `eos`, unwrap `ArrayBuffer`/`SharedArrayBuffer` writes for non-object-mode writable streams, and wire abort handling into web stream controllers. That improves behavior for `addAbortSignal` and other stream bridges that previously could fail with awkward type errors.
+
+### Other misc changes
+- Bumped `laufey` to 0.6.1 and updated the desktop ABI guard/checksum pins (dc80b47)

src/posts/2026-07-26_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-26
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-26_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-26
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-26_leanprover-lean4.md

@@ -0,0 +1,21 @@
+---
+date: 2026-07-26
+repo: leanprover/lean4
+size: L
+title: "Lean init bugfix and benchmark refresh"
+excerpt: "Fixes a private-import initialization segfault and overhauls Lake inundation benchmarks with precompile variants."
+commits: 2
+authors: [Kha, tydeu]
+commit_authors: {"0bfc3ac": Kha, "3b7f377": tydeu}
+---
+
+### **Fix Lean runtime initialization for private imports** (0bfc3ac)
+Lean-generated modules now call the right initialization entrypoint even when `Lean` is only imported privately, preventing segfaults from missing `lean_initialize` calls. The runtime init functions were also made idempotent so repeated module initialization is safe, and FFI users no longer need to call the initialization helpers themselves.
+
+### **Overhaul Lake inundation benchmarks** (3b7f377)
+The `inundation` benchmark suite was reorganized into multiple sub-libraries with configurable layers, width, and precompile mode. This trims benchmark size back into a reasonable runtime budget while adding variants that better exercise precompiled module builds.
+
+### Other misc changes
+- Added a regression test for private `Lean` imports in executable packages
+- Updated the reverse-FFI example to rely on implicit runtime initialization
+- Benchmark script and test harness refactors

src/posts/2026-07-26_microsoft-typescript-go.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-26
+repo: microsoft/typescript-go
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-26_nodejs-node.md

@@ -0,0 +1,36 @@
+---
+date: 2026-07-26
+repo: nodejs/node
+size: L
+title: "Node tightens DNS, REPL, sqlite and streams"
+excerpt: "Security and correctness fixes land across DNS reverse lookups, sqlite session lifetimes, REPL highlighting, and web streams."
+commits: 9
+authors: [avivkeller, 3zrv, Archkon, remcohaszing, arcanis, iliaal]
+commit_authors: {"54a5095": Archkon, "4a5eb1c": avivkeller, "1ba3ce4": avivkeller, "893602c": avivkeller, "4314d13": 3zrv, "d4d35c6": 3zrv, "2c4ea73": remcohaszing, "c8da4ec": arcanis, "eb7ee32": iliaal}
+---
+
+### **DNS reverse lookups now ignore hosts files** (54a5095)
+`dns.reverse()` is now forced to use DNS/PTR lookups only, matching the documented behavior of other `dns.resolve*()` APIs and avoiding `/etc/hosts` bleed-through via c-ares lookup order. This closes a surprising inconsistency for reverse lookups and adds a focused regression test.
+
+### **REPL gains basic syntax highlighting** (4a5eb1c)
+Node’s REPL now colorizes user input with a new tokenizer-based highlighter, wired through readline’s refresh path so multiline prompts and cursor movement stay visually correct. This is a user-facing polish change that makes interactive REPL use noticeably nicer without changing REPL semantics.
+
+### **Buffer copyArrayBuffer gets a bounds check fix** (eb7ee32)
+`process.binding('buffer').copyArrayBuffer()` now asserts offsets are within the buffer before subtracting, preventing unsigned wraparound from turning an out-of-bounds offset into a huge length. The fix addresses a real memory-safety bug in an internal binding.
+
+### **sqlite sessions now keep their database alive** (d4d35c6)
+`DatabaseSync.createSession()` now holds a strong reference to the database so a session can’t outlive freed database memory. That prevents a crash when the database handle is dropped first, and the new test covers the GC/lifetime behavior.
+
+### **Module hooks support `Symbol.dispose`** (2c4ea73)
+`registerHooks()` return values now implement `Symbol.dispose` as an alias for `deregister()`, which means they work with the `using` keyword and explicit resource management. This is a small but useful public API addition for cleaner hook lifecycle handling.
+
+### **Web Streams adapters stop throwing after teardown** (4314d13)
+The writable-side adapter now guards calls to `controller.error()` after the controller may already be gone, fixing an uncatchable error when closing half-open `Duplex.toWeb()` writables. This makes stream teardown behavior more robust in edge cases.
+
+### **Loader package-map lookup normalizes paths first** (c8da4ec)
+Package-map path resolution now normalizes incoming paths before cache lookup, which fixes resolution when `createRequire()` paths use mixed separators. This is a correctness fix for package-map users, especially on cross-platform path inputs.
+
+### Other misc changes
+- Test runner V8 deserializer unsigned-length handling fix + regression test (1ba3ce4)
+- Mark `test-repl-user-error-handler` as flaky (893602c)
+- Misc REPL test adjustments and internal cleanup around highlighting and multiline rendering (4a5eb1c)

src/posts/2026-07-26_oven-sh-bun.md

@@ -0,0 +1,18 @@
+---
+date: 2026-07-26
+repo: oven-sh/bun
+size: M
+title: "Builder images refreshed for new secret flow"
+excerpt: "CI builder images were republished with updated bootstrap logic, moving Buildkite token lookup to cloud secrets and trimming launch tags."
+commits: 1
+authors: [Jarred-Sumner]
+commit_authors: {"43d60f6": Jarred-Sumner}
+---
+
+### **Builder images refreshed for current agent bootstrap** (43d60f6)
+Republished the builder images with updated bootstrap logic so Buildkite agents can fetch their registration token from cloud secret stores instead of launch-time tags. AWS now reads from Secrets Manager and Azure from Key Vault, with a fallback to the older metadata tag path for pre-secret images.
+
+This also removes token-related launch parameters/tags from machine provisioning, tightening how credentials are passed to CI machines and reducing dependence on instance metadata for new images.
+
+### Other misc changes
+- None beyond the builder-image/bootstrap refresh.

src/posts/2026-07-26_pnpm-pnpm.md

@@ -0,0 +1,57 @@
+---
+date: 2026-07-26
+repo: pnpm/pnpm
+size: L
+title: "pnpm lands major install and resolver fixes"
+excerpt: "Big day of install-lifecycle, lockfile, and peer-resolution fixes, plus CLI parity and a GVS crash fix."
+commits: 17
+authors: [zkochan]
+commit_authors: {"5ed47dc": zkochan, "1e22aa1": zkochan, "5de55a1": zkochan, "b9df82e": zkochan, "d7d0ba7": zkochan, "b726d9f": zkochan, "51c849f": zkochan, "723dc76": zkochan, "208e5af": zkochan, "f892e3d": zkochan, "076f6cc": zkochan, "760b2ec": zkochan, "8c041fe": zkochan, "291ab43": zkochan, "01dc5ac": zkochan}
+---
+
+### **Record bundledDependencies correctly** (5ed47dc)
+pnpm now preserves and honors `bundledDependencies` during install and bin linking, including the `bundleDependencies: true` form that means “bundle everything in `dependencies`.” This fixes a real packaging bug where bundled names could be dropped from the lockfile/install flow.
+
+### **Run `pnpm:devPreinstall` at the right time** (1e22aa1)
+The root project’s `pnpm:devPreinstall` hook now runs once per install before resolution/linking, matching pnpm’s behavior and unblocking workspaces that rely on it to prepare install-time state. It’s skipped in the expected no-script paths like `--ignore-scripts`, `--dry-run`, `--lockfile-only`, `fetch`, `rebuild`, and already-up-to-date installs.
+
+### **Resolve `$dep-name` override self-references** (5de55a1)
+Overrides that use `$foo` now resolve to the root manifest’s declared specifier for `foo` instead of staying as a raw `$foo` reference. That restores frozen-install compatibility with lockfiles written by pnpm 11 and prevents false `ERR_PNPM_OUTDATED_LOCKFILE` failures.
+
+### **Fix peer-edge keys to keep the provider’s depPath** (b9df82e)
+Peer edges are now keyed to the provider node’s own resolved depPath instead of being rewritten to a fabricated variant. This closes a lockfile/resolution mismatch that showed up in large workspace installs, including the remaining `next.js` reproduction.
+
+### **Make `dedupe --check` report the actual diff** (d7d0ba7)
+`pnpm dedupe --check` now prints what would change, returns a dedicated `ERR_PNPM_DEDUPE_CHECK_ISSUES` diagnostic, and warns when peer issues remain. The same work also restores `pnpm peers check` as a valid command spelling, matching the documented CLI surface.
+
+### **Give local directory deps their own GVS slot** (51c849f)
+Installing local `file:` directory dependencies with the global virtual store no longer crashes, and directory snapshots now get a project-scoped slot instead of being shared across unrelated projects. That fixes the broken symlink / `undefined.split` failure mode for local and injected directory packages.
+
+### **Rewrite `jsr:` deps on `update --latest`** (723dc76)
+`update --latest` now rewrites `jsr:` specifiers back to the picked version instead of leaving them stale. Without this, JSR dependencies could survive a latest update unchanged because the resolver never reported a normalized bare specifier.
+
+### **Match pnpm’s lifecycle-script selection rules** (208e5af)
+Projects now run their own lifecycle scripts based on pnpm’s per-project mutation rules instead of a single full-install flag. This fixes `add`, targeted `update`, workspace-root behavior, and other install-family commands that previously fired scripts for the wrong set of projects.
+
+### **Hoist root local deps by version, not path** (f892e3d)
+When a workspace root dependency is declared with `link:`, `file:`, or path-style `workspace:`, peers hoisted from that root now resolve against the linked package’s version rather than the raw path. That avoids broken symlinks and incorrect peer resolution for root-local packages.
+
+### **Free disk before coverage runs** (076f6cc)
+The codecov workflow now cleans up preinstalled toolchains before the coverage build. This is a CI reliability fix to stop the runner from hitting “No space left on device” mid-job.
+
+### **Close remaining CLI-surface parity gaps** (760b2ec)
+Several pnpm 12 CLI/reporting mismatches were restored, including the `Scope:` line, cached lockfile-verification timing, and the build-approval placeholder in `pnpm-workspace.yaml`. This is mostly parity work, but it touches user-facing output and workflow behavior.
+
+### **Fix peer-context divergences in large workspaces** (8c041fe)
+The resolver now matches pnpm’s handling for packages that shadow a peer in `dependencies`, and it collapses duplicate peer-suffixed variants more consistently. This addresses lockfile drift seen in larger workspaces where pnpm 11 and pacquet were producing different graphs.
+
+### **Support `publishConfig.name` for renamed publishes** (291ab43)
+Publishing now respects `publishConfig.name`, letting a package publish under a different registry name than its workspace manifest name. That also unblocks changelog, ledger, and release tooling paths that key off the published name.
+
+### **Fail frozen installs when recorded settings drift** (01dc5ac)
+Frozen installs now check more lockfile settings, including `autoInstallPeers`, `dedupePeers`, and `excludeLinksFromLockfile`. This closes a reproducibility hole where pnpm would have rejected the install but pacquet previously proceeded against a stale lockfile.
+
+### Other misc changes
+- Dependency and toolchain bumps, including Node.js, pnpm, and GitHub Actions configs (b726d9f)
+- Additional resolver/install test coverage across workspaces, peers, GVS, and lifecycle scripts
+- Minor internal refactors and reporter/output plumbing to support the fixes above

src/posts/2026-07-26_tc39-ecma262.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-26
+repo: tc39/ecma262
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+