digest: add issues for 2026-07-31

Author: github-actions[bot]

src/posts/2026-07-30_biomejs-biome.md

@@ -0,0 +1,24 @@
+---
+date: 2026-07-30
+repo: biomejs/biome
+size: L
+title: "Tailwind rule lands; CSS/YAML fixes"
+excerpt: "Biome adds a new Tailwind arbitrary-value lint rule and fixes crashes plus YAML/CSS parsing edge cases."
+commits: 3
+authors: [denbezrukov, dyc3, THEjacob1000]
+commit_authors: {"dd9158a": denbezrukov, "f399d3a": dyc3, "e007143": THEjacob1000}
+---
+
+### **New Tailwind arbitrary-value lint rule** (e007143)
+Biome adds `noTailwindArbitraryValue`, a nursery rule that flags Tailwind CSS arbitrary values like `w-[400px]`. It applies across HTML/JSX class attributes, supported utility functions, and tagged templates, and also wires the rule into config, diagnostics, and ESLint migration support.
+
+### **CSS analysis no longer crashes on incomplete property values** (dd9158a)
+Biome now handles incomplete CSS declarations during editing without panicking, fixing a crash in semantic analysis for partially typed property values. This is an important stability fix for live editor workflows where code is frequently invalid mid-edit.
+
+### **YAML formatter/parser better attaches properties across lines** (f399d3a)
+The YAML parser and formatter were updated to correctly associate properties that span lines in block mappings, improving handling of anchors, tags, and comments in tricky multiline cases. This reduces formatting mismatches and parse errors on real-world YAML inputs.
+
+### Other misc changes
+- Rule metadata/migration plumbing for the new Tailwind rule
+- YAML snapshot churn and test updates
+- Small AST pointer behavior refactor and roundtrip test

src/posts/2026-07-30_denoland-deno.md

@@ -0,0 +1,32 @@
+---
+date: 2026-07-30
+repo: denoland/deno
+size: L
+title: "Deno tightens networking and package handling"
+excerpt: "Origin-scoped redirect header stripping, safer stream close cancellation, npmrc auth matching fixes, plus new add and CJS analysis behavior."
+commits: 8
+authors: [nathanwhit, piscisaureus, dsherret, cppcoffee]
+commit_authors: {"1635110": nathanwhit, "5558c9d": nathanwhit, "c026afe": nathanwhit, "786225a": nathanwhit, "131a727": nathanwhit, "39f402e": dsherret}
+---
+
+### **Fix redirect-sensitive headers to follow origin boundaries** (131a727)
+Deno now strips authorization-class headers whenever a redirect crosses origins, instead of using a looser host/protocol check. This brings fetch behavior in line with the spec and closes cases where sensitive headers could leak across origin changes.
+
+### **Cancel pending writes when network streams close** (1635110)
+TCP, Unix, vsock, and TLS streams now cancel blocked writes and shutdowns as well as reads when the resource closes. That prevents closed sockets from staying alive behind a pending write and fixes a subtle resource-lifetime bug.
+
+### **Match npm auth config by full authority and path boundaries** (c026afe)
+The npmrc resolver now compares auth settings against the URL’s complete authority, including port, and only matches path prefixes at segment boundaries. This avoids selecting the wrong registry token for similarly named hosts, sibling paths, or non-default ports.
+
+### **Add `deno add --unscoped` for aliasing scoped packages by name** (39f402e)
+A new `--unscoped` flag lets `deno add` store scoped packages under their unscoped alias, e.g. `jsr:@david/jsonc-morph` becomes `jsonc-morph`. That makes import-map entries and install commands shorter and more consistent when you want the package’s public name.
+
+### **Preserve pre-quoted shell args without weakening escaping** (5558c9d)
+Node-compatible `spawn`/`spawnSync` now strip one caller-added quote layer before re-escaping shell arguments, so already-quoted values continue to work with `shell: true`. The added regression covers quote-breakout attempts to ensure the command-injection mitigation still holds.
+
+### **CJS recursive analysis now uses loader-owned sources** (786225a)
+CommonJS export analysis was refactored to take source from the active module loader instead of reopening files independently. That makes recursive analysis consistent across graph, npm, standalone, and bundled loading paths, and avoids early parse failures and permission surprises.
+
+### Other misc changes
+- Updated Node test viewer and contributor-guide links; removed crux.land/eszip viewer references
+- Docs path updates in contributor instructions

src/posts/2026-07-30_denoland-std.md

@@ -0,0 +1,34 @@
+---
+date: 2026-07-30
+repo: denoland/std
+size: L
+title: "API cleanup, deprecations, and perf fixes"
+excerpt: "Major XML API cleanup, YAML structured errors, a new HttpError, plus faster line streaming and tree cloning fixes."
+commits: 18
+authors: [tomas-zijdemans, bartlomieju, piscisaureus, denobot, iuioiua, LeSingh1]
+commit_authors: {"c09b948": iuioiua, "07a05eb": bartlomieju, "02e05a4": bartlomieju, "fbe3870": LeSingh1, "5e7c0b9": tomas-zijdemans, "7a0239f": tomas-zijdemans, "6861a2b": tomas-zijdemans, "0d820d1": tomas-zijdemans}
+---
+
+**XML public API cleanup lands as breaking change** (7a0239f)
+The XML module tightens and reshapes its exported surface, including type changes around declarations and tokenizer callbacks. It also improves error reporting when position tracking is disabled, and the API cleanup is explicitly breaking.
+
+**YAML parsing now exposes structured `YamlSyntaxError`** (6861a2b)
+YAML errors now carry line, column, and offset data in a dedicated error type instead of stringified `SyntaxError` messages, and the main module re-exports the new types. The parser also adds single-document enforcement support, making failures easier to inspect and downstream handling more precise.
+
+**`HttpError` adds a typed unstable HTTP error API** (c09b948)
+A new unstable `HttpError` class gives HTTP handlers a standard way to represent status-coded failures, with optional response init and cause support. This is a meaningful addition for route/error handling patterns in `@std/http`.
+
+**Text line streaming is fixed to avoid quadratic buffering** (5e7c0b9)
+`TextLineStream` now buffers chunks incrementally instead of repeatedly re-slicing accumulated text, eliminating quadratic behavior for long lines split across many chunks. That’s a real performance fix for streamed text processing.
+
+**Tree cloning now deep-copies nodes correctly** (fbe3870)
+`BinarySearchTree.from()` and `RedBlackTree.from()` now copy node structure instead of reusing nodes from the source tree, so mutations on the clone no longer affect the original. This fixes correctness bugs when cloning and then mutating trees.
+
+**Testing and dotenv deprecations broaden API cleanup** (07a05eb, 02e05a4, 0d820d1)
+The day also marks several APIs as deprecated, including snapshot helpers, BDD testing modules, and dotenv `load()`/`loadSync()` entry points. These signal upcoming removals and help steer users toward newer APIs.
+
+### Other misc changes
+- Release 2026.07.30
+- CI/workflow dependency bumps and Node test matrix tweaks
+- Docs cleanup removing the deprecated coverage explorer link
+- Minor refactors and type annotation cleanup

src/posts/2026-07-30_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-30
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-30_leanprover-lean4.md

@@ -0,0 +1,49 @@
+---
+date: 2026-07-30
+repo: leanprover/lean4
+size: L
+title: "Lean4 tightens VCGen and kernel safety"
+excerpt: "New do-notation assertions, faster vcgen framing, and multiple soundness fixes land alongside module export and contract syntax updates."
+commits: 15
+authors: [sgraf812, leodemoura, algebraic-dev, tydeu, wkrozowski, TwoFX]
+commit_authors: {"d53dcb2": leodemoura, "41056da": leodemoura, "8be3650": tydeu, "fd1cec3": leodemoura, "a0acacb": sgraf812, "a97629d": sgraf812, "0a67f6b": sgraf812, "c7673e7": sgraf812, "103ef69": wkrozowski, "2d0879c": sgraf812, "d19a5e5": sgraf812, "f9541a7": algebraic-dev, "44d40a3": algebraic-dev, "55293f2": algebraic-dev, "5fe7f24": TwoFX}
+---
+
+### **VCGen framing is reworked for footprint-based inference** (d19a5e5)
+`@[frameproc]` procedures can now discharge split verification conditions themselves, which lets frame inference handle operators like separating conjunction that the built-in lattice split could not decompose. This is a major vcgen overhaul that improves separation-logic support and makes framing more scalable.
+
+### **`partial` export stubs are now marked unsafe** (d53dcb2)
+A module-system soundness bug let exported stubs of `partial` definitions lose their unsafe marking, making them usable from safe declarations downstream. The fix ensures any non-`safe` exported definition stays unsafe, closing a meta-programming exploit path.
+
+### **Kernel now rejects mutual blocks with mismatched universe params** (41056da)
+Mutual definitions must now share the same universe level parameters, matching an invariant the elaborator already enforced. This plugs a kernel-level hole that meta-programming could bypass and avoids cache-related unsoundness.
+
+### **Intrinsic verification gains `assert` in `do` blocks** (a0acacb)
+`do` notation can now contain `assert P` and binder forms like `assert s => P s`, which vcgen reads as proof obligations while erasing them at runtime. This adds a new public verification-syntax feature for programs using intrinsic verification.
+
+### **`requires`/`invariant` clauses can bind their own arguments** (0a67f6b)
+Preconditions and loop invariants now accept binder forms such as `requires s => ...` and `invariant pref suff s => ...`, removing the need for extra `fun` wrappers. That makes contract and invariant syntax more expressive, especially for stateful specifications.
+
+### **vcgen frame inference is optimized and decoupled from speculative applies** (a97629d)
+Frame inference inputs are computed on demand again, restoring performance lost in an earlier change. The refactor also reshapes the frame-proc machinery around explicit split proofs and residual preconditions, reducing unnecessary work during spec application.
+
+### **`for` invariants are simplified to prefix/suffix semantics** (c7673e7)
+The loop-invariant representation for `Std.Internal.Do` was made non-dependent, with invariants now phrased directly over the consumed and remaining list segments. This is a broad internal refactor that simplifies the generated VCs and changes how `for ... invariant` is elaborated.
+
+### **Code-quality benchmark frontend is added** (103ef69)
+A new runner frontend for the upcoming code-quality checking framework was introduced. It lays the groundwork for future linting/quality automation rather than changing existing compiler behavior.
+
+### **HTTP server benchmark added** (f9541a7)
+New compile benchmarks exercise the HTTP server and TCP variants. This helps track performance regressions in the server stack over time.
+
+### **HTTP `Builder.stream` overwrite bug fixed** (44d40a3)
+The stream body builder no longer risks overwriting a known size in time-sensitive scenarios. That fixes a subtle correctness issue in HTTP body handling.
+
+### **`requires` replaces `require` for def contracts** (2d0879c)
+The contract precondition clause on `def` has been renamed from `require` to `requires`, aligning it with `ensures` and updating the parser/macro plumbing accordingly. This is a source-level syntax change for contract-bearing definitions.
+
+### **Other misc changes**
+- Untraced internal build flags in the core build trace (8be3650)
+- Added a missing metavariable/free-variable check in inductive kernel code (fd1cec3)
+- Deflaked an HTTP unknown-size stream test (55293f2)
+- Simplified `bif`/`cond` handling and related lemmas/tests (5fe7f24)

src/posts/2026-07-30_microsoft-typescript-go.md

@@ -0,0 +1,25 @@
+---
+date: 2026-07-30
+repo: microsoft/typescript-go
+size: L
+title: "Checker speedups and LS memory fixes"
+excerpt: "TypeScript-Go got faster narrowing, safer symbol resolution, and a fix for config diagnostics after watched file edits."
+commits: 5
+authors: [johnfav03, ahejlsberg, connorshea]
+commit_authors: {"322fa1e": ahejlsberg, "98c4784": johnfav03, "0f29c77": johnfav03, "4443b20": johnfav03, "37357ae": connorshea}
+---
+
+### **Optimize equality and switch narrowing** (322fa1e)
+The checker now uses a more targeted union/type removal path and adds new enum flags to support faster `narrowTypeByEquality` and `narrowTypeBySwitchOnDiscriminant`. This should reduce work in common control-flow narrowing cases and includes new coverage for non-uniform union narrowing.
+
+### **Fix O(K²) memory blowup in go-to-implementation** (0f29c77)
+The language service now deduplicates references and implementation groups as it expands the worklist, preventing quadratic retention when many implementations are discovered repeatedly. This fixes a real OOM class in deeply-typed projects without changing the final response.
+
+### **Refresh config diagnostics after watched file changes** (98c4784)
+`tsconfig.json`/`jsconfig.json` diagnostics are now republished when a watched config file changes on disk, even if the client does not issue another pull request. That closes a gap where config errors could go stale until the editor re-asked for diagnostics.
+
+### **Prevent stack overflow in self-referential `for...of`** (4443b20)
+`getExplicitTypeOfSymbol()` now guards against recursive re-entry on the same symbol, avoiding infinite recursion on patterns like `for (const a of a)`. This turns a crash into the expected diagnostics for the self-referential loop.
+
+### Other misc changes
+- Typo fix in declaration transformer variable naming (37357ae)

src/posts/2026-07-30_nodejs-node.md

@@ -0,0 +1,28 @@
+---
+date: 2026-07-30
+repo: nodejs/node
+size: M
+title: "FFI fixes, glob cache isolation, and HTTP hardening"
+excerpt: "Node.js tightens Fast API validation, preserves FFI buffer fast paths, fixes glob cache cross-platform bugs, and hardens HTTP timeouts."
+commits: 8
+authors: [trivikr, Archkon, IlyasShabi, bmuenzenmeyer, ganjanggejang, efekrskl]
+commit_authors: {"c8e2a82": trivikr, "f85fdab": trivikr, "f9e2fe0": Archkon, "111a62d": Archkon, "396aad0": IlyasShabi, "3f2f10a": bmuenzenmeyer, "cacd7a2": ganjanggejang, "0012a77": efekrskl}
+---
+
+### **FFI fast path now validates 32-bit integers** (c8e2a82)
+Fast API calls now reject out-of-range or non-integer values for `i32`/`int32` and `u32`/`uint32` instead of letting V8 coerce or truncate them. This closes a correctness gap for optimized FFI calls and brings 32-bit behavior in line with the existing integer validation for other widths.
+
+### **Optimized FFI buffer conversions stay on the native fast path** (f85fdab)
+Buffer- and ArrayBuffer-backed arguments were being routed through a slower or incorrect conversion path after Fast API optimization; this commit preserves the pointer-like handling for those signatures. It fixes a regression where memory-backed arguments could lose the specialized native path, which matters for both correctness and performance.
+
+### **HTTP server now guards invalid timeout values** (0012a77)
+`checkConnections()` now sanitizes `headersTimeout` and `requestTimeout` before using them, treating invalid or negative values as `0`. That prevents bad timeout settings from crashing connection checks and makes the server more resilient to unexpected configuration.
+
+### **FS glob matcher cache is keyed by platform** (111a62d)
+Glob matchers are now cached separately for `path.posix` and `path.win32`, matching the fact that compiled matchers capture platform-specific path semantics. This fixes cross-platform cache reuse that could return the wrong matcher for the same pattern.
+
+### Other misc changes
+- Registered the missing `SetURL` wasm web API external reference (f9e2fe0)
+- Added permission enforcement for `v8.setHeapSnapshotNearHeapLimit()` (396aad0)
+- Corrected `url.format()` return type docs (3f2f10a)
+- Updated FFI docs to use `ffi.suffix` instead of hardcoded `.so` paths (cacd7a2)