digest: add issues for 2026-08-07

Author: github-actions[bot]

src/posts/2026-08-06_biomejs-biome.md

@@ -0,0 +1,42 @@
+---
+date: 2026-08-06
+repo: biomejs/biome
+size: L
+title: "Markdown linter lands; parser and CSS grow"
+excerpt: "Major new markdown linting, a Markdown parser refactor, and several meaningful fixes across CSS, JS, Vue, and Grit."
+commits: 9
+authors: [dyc3, ematipico, vznh, Austin1serb, saberoueslati, denbezrukov, Turtle-Hwan]
+commit_authors: {"ea9dd8a": dyc3, "c4a07bf": ematipico, "6be7be1": vznh, "481d008": Austin1serb, "4d603b0": saberoueslati, "51997e6": ematipico, "554e6e8": denbezrukov, "d5f5704": Turtle-Hwan, "52b44d6": dyc3}
+---
+
+### **Markdown linting support added** (51997e6)
+Biome now ships a dedicated Markdown analyzer, including configuration plumbing, CLI/SARIF integration, and a first nursery rule: `useConsistentHeaderLevel`. This is a notable expansion of lint coverage into Markdown and makes the new language support usable end-to-end.
+
+### **Markdown parser moved to a two-phase parse** (c4a07bf)
+Markdown parsing was refactored to separate block parsing from inline resolution, so link references can be resolved after the full document is known. That’s a substantial internal change that should make the parser more correct around reference links and nested inline content, with accompanying invariant and formatter tests.
+
+### **SCSS partial combinator selectors are now supported** (554e6e8)
+The CSS parser, factory, formatter, semantic layer, and analyzer were updated to understand SCSS partial combinator selectors. This adds support for a real SCSS syntax feature and changes diagnostic behavior accordingly, which should unblock parsing/formatting of selectors like `.partial > {}`.
+
+### **`noImportCycles` skips `node_modules` for better performance** (ea9dd8a)
+The import-cycle lint now reuses a shared `node_modules` path check and explicitly excludes dependency trees from SCC work. That trims unnecessary graph work on large projects and improves performance without changing the rule’s core purpose.
+
+### **`noUselessUndefined` respects explicit return types** (6be7be1)
+The rule now avoids flagging `return undefined` when the enclosing function’s return type is explicitly something other than `undefined` or `void`. This fixes an annoying false positive in typed code and makes the lint smarter about intent.
+
+### **`useAwait` recognizes `await using`** (d5f5704)
+`useAwait` now treats `await using` as an async operation, so async functions using resource-disposal syntax are no longer incorrectly flagged. That keeps the rule aligned with newer JavaScript semantics.
+
+### **Vue template globals are scoped correctly** (4d603b0)
+`noUndeclaredVariables` was adjusted so Vue template globals like `$slots`, `$attrs`, and `$event` are handled in the right contexts. This removes false positives in templates while still reporting those names inside `<script setup>` where they’re actually undeclared.
+
+### **Svelte legacy `{@const}` gets a new nursery rule** (52b44d6)
+Biome added `noSvelteLegacyConst`, a new HTML/Svelte lint rule that discourages legacy `{@const}` tags in favor of declaration tags with `$derived()`. This adds another framework-specific correctness/style check and extends config/schema support for it.
+
+### **Grit WASM snippets now use byte offsets** (481d008)
+Grit pattern parsing in the JS API was fixed to use byte offsets for WASM snippets. That should eliminate offset mismatches when snippets include non-ASCII text and makes embedded pattern handling more reliable.
+
+### Other misc changes
+- Dependency and workspace updates for the new Markdown analyzer and related rule plumbing
+- New/updated tests across CSS, JS, Markdown, Vue, Svelte, and Grit
+- Minor configuration/schema and generated-code refreshes

src/posts/2026-08-06_denoland-deno.md

@@ -0,0 +1,25 @@
+---
+date: 2026-08-06
+repo: denoland/deno
+size: M
+title: "Release automation and bundle deadlock fix"
+excerpt: "Updated release tooling for renamed crates and no-verify publishing, plus a bundle-side esbuild client upgrade to fix a protocol deadlock."
+commits: 4
+authors: [bartlomieju, denobot, nathanwhit]
+commit_authors: {"903d670": denobot, "72516b6": bartlomieju, "ec98b03": bartlomieju, "8af9351": nathanwhit}
+---
+
+### **Bundle fix: avoid an esbuild protocol deadlock** (8af9351)
+Updated `esbuild_client` to 0.7.2, bringing in a protocol-reader/writer deadlock fix. This matters for bundle builds under load, where packet forwarding could stall while response delivery waited on bounded channel capacity.
+
+### **Release tooling now handles renamed crates correctly** (ec98b03)
+The version-bump script now special-cases crates like `deno_v8` that are renamed in the root `Cargo.toml`, so release automation can bump their versions without failing on missed manifest entries. That prevents release bumps from getting stuck on dependency declarations that don't match the crate name.
+
+### **Dependency crates are published with `--no-verify`** (72516b6)
+Release publishing now skips cargo's standalone tarball verification for dependency crates, while still verifying the top-level `deno` crate. This works around a packaging limitation where these crates can't be built in isolation because engine selection happens only at the workspace top level.
+
+### **Main branch release commit forwarded to sync generated files** (903d670)
+Brought the v2.9.5 release commit onto `main`, including the release notes, version files, lockfile updates, and generated CI cache-key refreshes. This is mostly bookkeeping to keep the branch aligned with the tagged release.
+
+### Other misc changes
+- CI cache key/version bumps across generated workflows and Cargo metadata (1 commit)

src/posts/2026-08-06_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-08-06
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-08-06_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-08-06
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-08-06_leanprover-lean4.md

@@ -0,0 +1,20 @@
+---
+date: 2026-08-06
+repo: leanprover/lean4
+size: M
+title: "Code-quality lint JSON and matchy ensures clauses"
+excerpt: "Lake lint can now emit machine-readable code-quality results, and `ensures` clauses may use match alternatives with prettier formatting."
+commits: 2
+authors: [wkrozowski, sgraf812]
+commit_authors: {"4a37393": wkrozowski, "ddc2f33": sgraf812}
+---
+
+### **Lake lint gains `--code-quality` JSON output** (4a37393)
+`lake lint` now has a code-quality mode that turns builtin linter output into machine-readable JSON entries instead of human-readable diagnostics. Text-linter warnings are aggregated per module/linter, and environment-linter findings are emitted per flagged declaration, which should make downstream tooling and dashboards much easier to build.
+
+### **`ensures` clauses can now use match alternatives** (ddc2f33)
+Def contracts can now write postconditions in a `fun`/match style, so a result-specific spec like `ensures | none => False | some v => ...` is accepted and expanded into the generated spec theorem. The pretty-printer also formats contract clauses on their own lines to match source style more closely.
+
+### Other misc changes
+- Added/updated tests for code-quality lint output.
+- Added/updated formatting and intrinsic verification tests for `ensures` match alternatives.

src/posts/2026-08-06_microsoft-typescript-go.md

@@ -0,0 +1,10 @@
+---
+date: 2026-08-06
+repo: microsoft/typescript-go
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-08-06_nodejs-node.md

@@ -0,0 +1,37 @@
+---
+date: 2026-08-06
+repo: nodejs/node
+size: L
+title: "Node adds aligned buffers, BlockList boost"
+excerpt: "New Buffer alignment support, a fast/expanded net.BlockList, Windows HANDLE file streams, and several fixes across zip, dns, streams, sqlite, and zlib."
+commits: 14
+authors: [aduh95, araujogui, hyemimi, standard-Chan, joyeecheung, PickBas, jasnell, mcollina, lazerg, ronag, mike-git374, ndossche]
+commit_authors: {"6c862f4": standard-Chan, "d9d4446": PickBas, "27d6cfa": jasnell, "295e4cd": mcollina, "ee64033": lazerg, "85d4755": ronag, "51c0d94": araujogui, "04c104a": araujogui}
+---
+
+### **Buffer.allocUnsafe gets alignment support (85d4755)**
+`Buffer.allocUnsafe()` and `Buffer.allocUnsafeSlow()` now accept an optional `alignment` argument, letting callers request buffers whose backing memory starts on a chosen power-of-two boundary. This is useful for direct I/O and other native interfaces that require aligned memory, and the implementation adds new docs and coverage for the API.
+
+### **net.BlockList gets a major performance and API expansion (27d6cfa)**
+`net.BlockList` was substantially reworked for faster reads and writes, with shared-lock reads, bulk address insertion, storage/layout changes, and fast-path checks. The update also adds new capabilities like `clear()`, CIDR parsing, remove-range/subnet support, improved rule ordering, and benchmarking/tests to validate the new behavior.
+
+### **File streams can now wrap raw Windows HANDLEs (d9d4446)**
+`fs.ReadStream` and `fs.WriteStream` now accept a `windowsHandle` option, allowing Node to work with raw Win32 HANDLEs instead of CRT file descriptors on Windows. That opens the door to scenarios like inherited pipe handles from other processes, while enforcing platform and option-compatibility checks.
+
+### **ZIP archive end detection is hardened against ambiguity (295e4cd)**
+The ZIP reader now inspects all plausible EOCD candidates in the tail window and rejects archives with ambiguous endings instead of guessing based on trailing padding. This tightens validation for malformed or crafted archives and closes off a class of parsing ambiguity in `zlib`'s ZIP handling.
+
+### **WritableStream abort now follows the spec more closely (6c862f4)**
+Abort handling now re-checks stream state after signaling the controller, which fixes recursive abort behavior and makes the related WPT pass. Promise rejection logic was also narrowed so only still-pending close/closed caches are rejected, avoiding incorrectly touching already-settled promises.
+
+### **SQLite StatementSync gains explicit close/dispose support (51c0d94, 04c104a)**
+Prepared statements now have an explicit `close()` method and `Symbol.dispose()` support, making statement finalization deterministic and compatible with `using` declarations. The API update is backed by tests that verify finalized statements reject further use and that repeated disposal is safe.
+
+### **DNS `setServers()` no longer crashes on port 0 (ee64033)**
+`dns.setServers()` now handles `:0` server entries correctly instead of crashing when validating the port. The fix also adds coverage showing that port 0 is normalized to the default-port form returned by `getServers()`.
+
+### **Other misc changes**
+- Grammar/link/doc fixes in `worker_threads.md` and `buffer.md` (2 commits)
+- Test timeout adjustment for a debugger probe race (1 commit)
+- SQLite data-type and undefined-behavior fixes (2 commits)
+- `pkcs11-store-test` workflow check fix (1 commit)

src/posts/2026-08-06_oven-sh-bun.md

@@ -0,0 +1,40 @@
+---
+date: 2026-08-06
+repo: oven-sh/bun
+size: L
+title: "XML lands, with several crash fixes"
+excerpt: "Bun adds native XML parsing/loading and ships a batch of security, correctness, and runtime stability fixes."
+commits: 34
+authors: [robobun, dylan-conway]
+commit_authors: {"3171136": dylan-conway, "b4d632a": robobun, "aa1e446": robobun, "6e6aedb": robobun, "45be4ac": robobun, "f503e16": dylan-conway, "cf5ddf7": robobun, "d18ddfc": robobun, "0ffabf6": robobun, "2d1de1e": robobun, "3ee86ad": robobun, "4273dd9": robobun, "9a5e331": robobun, "7d9f21b": robobun, "a4ad4e0": robobun, "15d6710": robobun, "a32adeb": robobun, "80e6dba": robobun, "7f4acb2": robobun}
+---
+
+### **Bun.XML and native .xml loading arrive** (3171136)
+Bun now has `Bun.XML.parse` / `Bun.XML.stringify`, plus first-class `.xml` imports for `import`, `require`, `bun build`, and import attributes. The new parser/loader follows the existing `Bun.TOML`/`Bun.YAML`/`Bun.JSON5` pattern and adds docs, types, benchmarks, and bundler wiring.
+
+### **YAML parse now supports cyclic aliases** (f503e16)
+`Bun.YAML.parse` can now build cyclic object graphs when an alias points back into the collection that contains it, instead of rejecting them as unresolved aliases. The bundler and pnpm lockfile parser still reject cyclic aliases so module/import use stays acyclic.
+
+### **Bundler now fails hard on print errors instead of emitting corrupt output** (4273dd9)
+When the printer cannot finish a module, `bun build` now returns a failure instead of silently writing a truncated bundle with exit code 0. That closes a correctness hole where builds could look successful but produce broken artifacts that fail only at runtime.
+
+### **Resolver fixes `.` and `..` specifiers to prefer directories** (2d1de1e)
+Imports like `.` and `..` now resolve as directory specifiers instead of accidentally picking sibling files such as `lib.ts`. This fixes a real module-resolution bug that could silently load the wrong file when both a sibling and an `index` module exist.
+
+### **Socket connect/TLS dispatch no longer leaves pending exceptions behind** (b4d632a)
+Socket error paths were tightened so failed connect promises and TLS session/keylog dispatches no longer leave the VM in a bad exception state. The patch also adds fault-injection coverage for the new TLS session-buffer failure mode.
+
+### **Terminal raw-mode and drain handling are made deadlock-safe** (aa1e446, 7f4acb2)
+PTY raw mode now uses `TCSANOW` instead of `TCSADRAIN`, avoiding a runtime-wide deadlock when the child is blocked on a full PTY buffer. Separately, terminal drain callbacks keep the wrapper alive through PTY EOF so GC can’t drop or misfire a pending dispatch.
+
+### **High-risk runtime crashes and type confusions fixed across core APIs** (6e6aedb, 45be4ac, cf5ddf7, 9a5e331, 7d9f21b, d18ddfc, 3ee86ad, a4ad4e0, 0ffabf6, 80e6dba, 15d6710, a32adeb)
+Multiple user-facing crashes and assertion failures were fixed: SQLite FTS5 close no longer hits a UAF, `onmessage`/`onerror` through proxies no longer segfault, `ReadableStream` private setters are properly guarded, `spyOn(..., "prototype")` stops aborting, and mock matchers no longer crash when `mock.results` is tampered with. Crypto, fetch preconnect, `net` happy-eyeballs, TOML deep imports, `X509Certificate` descriptors, boxed primitive unwrapping, and Temporal deep-equality/`toEqual` all got correctness fixes that remove panics or wrong results in edge cases.
+
+### Other misc changes
+- Dependency/benchmark/docs/test updates around XML and YAML support.
+- String-search refactor to route byte/substring searches through Highway SIMD.
+- Removed dead legacy scaffolding (`bun-wasm`, peechy schema, write-only option plumbing).
+- Install/watcher/crypto/terminal test flake fixes and small runtime cleanups.
+- Zlib test harness fix and conservative-GC NAPI test stabilization.
+- Install alias resolution, isolated-store path sanitization, and numeric range-check hardening for UDP/password APIs.
+- Lint/allowlist and harness tweaks, plus small internal refactors.

src/posts/2026-08-06_pnpm-pnpm.md

@@ -0,0 +1,55 @@
+---
+date: 2026-08-06
+repo: pnpm/pnpm
+size: L
+title: "Git resolution, update fixes, and faster installs"
+excerpt: "Major git spec semantics changed, with several perf wins and bug fixes across lockfile updates, resolver behavior, and global interactive update flows."
+commits: 16
+authors: [zkochan, Ayush442842q, junhaoliao, xianjianlf2, felipeplets, m2na7]
+commit_authors: {"7490284": Ayush442842q, "8ae2e28": Ayush442842q, "14a890d": zkochan, "ffc51c8": zkochan, "ea90e2d": zkochan, "afe0aa9": junhaoliao, "dd0e058": zkochan, "acb28ad": xianjianlf2, "25437e2": zkochan, "f31c7ca": zkochan, "ecd540b": Ayush442842q, "3b85f07": m2na7, "2d10d1f": zkochan, "cba0df1": zkochan, "74577d7": zkochan}
+---
+
+### **Hosted git specs now resolve via canonical HTTPS** (14a890d)
+GitHub/GitLab/Bitbucket shorthand and URL forms are now treated as repository identities, not transport hints. pnpm records canonical HTTPS or archive tarball resolutions instead of inferring SSH, which avoids lockfiles that only work on the machine that created them.
+
+### **Git resolver now falls back to HTTPS on CI-friendly probes** (8ae2e28)
+A transient SSH-vs-HTTPS probe race could record an SSH URL for a repo that never asked for it, breaking installs on keyless CI runners. The resolver now retries flaky HEAD checks and prefers anonymous HTTPS probing before SSH inference.
+
+### **Patch-only installs no longer force a full re-resolve** (ffc51c8)
+Changes to `patchedDependencies` now rewrite the affected lockfile entries and reuse the already-resolved graph instead of resolving everything again. That makes patch edits much faster, while still falling back to full resolution when a patch touches peer-reachable packages.
+
+### **Ignored optional dependency additions can skip resolution** (f31c7ca)
+Adding new `ignoredOptionalDependencies` patterns can now prune unreachable optionals and their snapshots without a fresh dependency resolution. This speeds up installs when the new ignore rules are monotonic and the lockfile already proves nothing else changes.
+
+### **Inert lockfile setting changes are recorded without re-resolving** (dd0e058)
+Several settings that only matter when peers or workspace links are actually present now update the lockfile in place when they cannot affect the graph. That avoids unnecessary resolution work for settings like `dedupePeers` or `injectWorkspacePackages` on unaffected projects.
+
+### **`pnpm version -r --json` now stays machine-readable** (ecd540b)
+The no-pending-changes path now emits an empty JSON array instead of a human-readable sentence. Pacquet also aligns its applied-release JSON shape with the TypeScript CLI, fixing broken automation around `--json` output.
+
+### **`pnpm update --no-save` respects the kept manifest range** (3b85f07)
+Version bumps without saving now refuse to record versions outside the manifest’s retained range, avoiding lockfiles that contradict `package.json`. The update flow now warns on out-of-range requests and keeps `--latest` bounded by the actual specifier.
+
+### **Interactive global update can select whole package groups** (25437e2)
+`pnpm update --global --interactive` now lets users pick global package groups as atomic units instead of failing as unsupported. The selection is wired through both the Rust and TypeScript paths so only the chosen group hashes are updated.
+
+### **npm held-back warnings now account for release-age filtering** (acb28ad)
+The “held back” warning no longer blames manifests when `minimumReleaseAge` is what blocked a newer version. The baseline pick now applies the same publish-age cutoff as the real resolver, preventing misleading override advice.
+
+### **Empty version ranges are treated as `*`** (f2fa9c)
+An omitted semver range now resolves like “any version” instead of being misclassified as a dist-tag. That fixes installs for packages that publish empty ranges, which previously failed because the resolver looked for an impossible tag.
+
+### **`pnpm version -r --dry-run` now matches the applied plan** (7490284)
+The release preview path is now covered and pinned to the same plan as a real run, so dry-run output can’t drift from the actual version bump behavior. That closes a correctness gap in release tooling.
+
+### **`allowUnusedPatches` is exposed through the NAPI installer API** (cba0df1)
+Embedder-driven installs can now opt into allowing unused patches, matching the CLI’s workspace setting. The flag is threaded through the NAPI config path into the fresh-lockfile verification flow.
+
+### **Global virtual store slot materialization is deduplicated** (74577d7)
+The deps restorer now materializes each shared global-virtual-store slot only once, avoiding races when peer variants collapse to the same hashed directory. This fixes concurrent import failures for mutable `file:` sources that assumed exclusive ownership of a slot.
+
+### Other misc changes
+- Memory reduction for registry metadata caching by reading mirror-file spans on demand (ea90e2d)
+- Cross-realm missing `.pnpmfile` error handling fix (afe0aa9)
+- Security docs updated to state the untrusted-repository trust boundary (2d10d1f)
+- Various test coverage, lockfile, and CI/build updates across resolver, versioning, and update flows