digest: add issues for 2026-06-30

Author: github-actions[bot]

src/posts/2026-06-29_biomejs-biome.md

@@ -0,0 +1,19 @@
+---
+date: 2026-06-29
+repo: biomejs/biome
+size: M
+title: "LSP typing gets smoother"
+excerpt: "Biome debounces LSP diagnostics on rapid edits, while also refreshing snapshots and bumping a few dependencies and workflows."
+commits: 4
+authors: [ematipico]
+commit_authors: {"dd1429c": ematipico}
+---
+
+### **Debounced LSP diagnostics to avoid editor lag** (dd1429c)
+Biome now schedules diagnostics after edits instead of running them immediately, so typing in large files should feel much less blocked. The change also closes pending diagnostics when a document is shut, and the new test coverage verifies that rapid successive changes only publish the latest diagnostics.
+
+### Other misc changes
+- Updated `anyhow` to 1.0.103.
+- Refreshed CLI snapshots for config-extending and monorepo-related cases.
+- Bumped several GitHub Actions and release workflow pins, plus Node.js in beta workflows.
+- Other CI/dependency maintenance updates (1 commit).

src/posts/2026-06-29_denoland-deno.md

@@ -0,0 +1,57 @@
+---
+date: 2026-06-29
+repo: denoland/deno
+size: L
+title: "Deno tightens npm, Node, and Jupyter fixes"
+excerpt: "Major npm resolver and node-compat bug fixes landed, plus Jupyter prompt handling and several security/behavior fixes."
+commits: 22
+authors: [bartlomieju, nathanwhit, tomas-zijdemans, LeSingh1, Medo-ID, Vallabh-1504, kapil971390, minato32, crowlbot, nathanwhitbot, hugoalh, sectore]
+commit_authors: {"1d08c79": nathanwhit, "96cedb7": tomas-zijdemans, "ede442b": LeSingh1, "9b23333": bartlomieju, "38e00aa": bartlomieju, "4c2f662": bartlomieju, "6ddc9d7": Vallabh-1504, "c815982": kapil971390, "4216f2b": bartlomieju, "ed07e25": bartlomieju, "3a8ae3f": minato32, "0532e63": nathanwhitbot, "3ca0e08": bartlomieju}
+---
+
+### **Fix min-age npm dist-tags by falling back to <= tagged version** (1d08c79)
+When a dist-tag points to a version that is too new for the configured dependency-age policy, Deno now retries resolution with a semver range capped at the tagged version instead of failing outright. This brings behavior in line with npm-pick-manifest/pnpm for tags like `latest`, `canary`, and `next`, while still preserving the original error when no acceptable version exists.
+
+### **Preserve TLS close_notify on JS-backed Node sockets** (96cedb7)
+`node:tls` now flushes the TLS shutdown alert for JS stream-backed sockets so peers actually observe EOF instead of hanging until timeout. This fixes a class of shutdown bugs seen in JS-duplex integrations like tedious/mssql and aligns Deno’s behavior with native TLS sockets.
+
+### **Fix Jupyter stdin handshake ordering for prompt()/confirm()** (3ca0e08)
+The kernel now waits until the ZMTP handshake completes before registering a stdin peer for sending. That prevents early `input_request` frames from corrupting the handshake, which was causing frontends like VS Code to kill the kernel when a cell prompted for input.
+
+### **Harden node:sqlite attach limits under scoped permissions** (38e00aa)
+Deno now keeps `ATTACH DATABASE` capped at zero when the process lacks full filesystem permissions for the database path, even if `limits.attach` is set. The fix closes a permission bypass where opening a database with custom limits could re-enable attach and reach files outside the intended boundary.
+
+### **Make Deno’s doc extractor strip quoted JSDoc code fences correctly** (ede442b)
+JSDoc extraction now removes leading `>` blockquote markers from code blocks so generated docs render the code as intended. This fixes malformed documentation output for quoted examples.
+
+### **Node child_process now recognizes more Deno subcommands** (9b23333)
+Spawning the Deno executable through `node:child_process` now passes through Deno subcommands like `bundle` and `serve` correctly instead of misclassifying them as scripts. That restores compatibility for Node-style process spawning of Deno CLI commands.
+
+### **Make URL and URLSearchParams non-serializable** (4c2f662)
+`URL` objects now throw during `structuredClone()` and `postMessage()` instead of silently turning into empty objects. This matches browser/Node behavior and fixes a standards mismatch in Deno’s web platform implementation.
+
+### **Fix `node:process` export of `report`** (6ddc9d7)
+`report` is now exported as a named value from `node:process`, matching the Node API surface. This corrects a compatibility gap for code that imports the property directly.
+
+### **Use case-insensitive matching for `trust-policy-exclude`** (c815982)
+npm trust-policy exclusions now compare package names case-insensitively, matching npm’s package-name rules. This fixes exclusions that failed to apply when `.npmrc` and registry names used different casing.
+
+### **Reject unpermitted `node:net` unix socket binds** (4216f2b)
+Binding a Unix-domain socket through `node:net` now checks filesystem permissions before the socket is created. The underlying libuv compatibility layer also records the bound path only after a successful bind, preventing cleanup logic from acting on a path that never bound.
+
+### **Decode percent-encoded npm subpaths** (ed07e25)
+npm specifiers now correctly decode percent-encoded subpaths, fixing resolution for packages that contain non-ASCII or otherwise encoded path segments. That makes imports like encoded Unicode subpaths resolve the actual target file.
+
+### **Show scoped-registry auth hint on tarball 404s** (3a8ae3f)
+Deno now surfaces the “No auth for tarball URI, but present for scoped registry” hint not just on 401s but also on 404s from private registries. This improves diagnostics for registries like GitLab that intentionally return 404 for private packages.
+
+### **Normalize npm bin names that contain path separators** (0532e63)
+Bin entry names are now canonicalized so embedded `/` or `\` segments don’t create nested paths inside `node_modules/.bin`. This avoids malformed bin shims and fixes cases where package metadata used scoped or path-like bin names.
+
+### **Other misc changes**
+- Bumped `denokv_*` crates to 0.14.0 and updated `rusqlite`/SQLite linking pins.
+- Fixed `mock.reset()` to also reset Node mock timers.
+- Corrected a JSX schema property name.
+- Adjusted a flaky streams test assertion.
+- Defaulted the desktop window title to the app name.
+- Nix/flake tooling updates for rust-analyzer and non-NixOS builds.

src/posts/2026-06-29_denoland-std.md

@@ -0,0 +1,23 @@
+---
+date: 2026-06-29
+repo: denoland/std
+size: M
+title: "Nightly CI lands; YAML emoji fix"
+excerpt: "Adds scheduled Deno canary/stable CI, updates YAML to preserve emoji, and refreshes tests for Deno v2.9."
+commits: 5
+authors: [bartlomieju, minato32, dsherret]
+commit_authors: {"cac00a1": bartlomieju, "6d5aea1": minato32, "e28fa81": dsherret, "f0431c2": bartlomieju}
+---
+
+### **Nightly CI now runs daily on stable and canary** (cac00a1)
+A new scheduled workflow runs the full test, lint, and format suite every day against stable v2.x and canary Deno, helping catch runtime regressions even when no PRs or pushes are landing. On failure, it opens or updates a tracking issue and pings @bartlomieju so breakages don’t sit unnoticed.
+
+### **YAML stringification now keeps astral characters literal** (e28fa81)
+The YAML dumper now iterates by Unicode code point instead of UTF-16 code unit, so emoji and other astral characters are treated as printable characters rather than surrogate halves. That means strings like `🐱` are emitted literally instead of being escaped, matching the updated test expectations.
+
+### **Tests and helpers updated for Deno v2.9** (f0431c2)
+Several tests were relaxed or adjusted to account for runtime behavior and interface changes in newer Deno releases, including the addition of `Deno.TestContext.assertSnapshot` and version-dependent crypto error text. This keeps the suite compatible as Deno evolves.
+
+### Other misc changes
+- Speeded up `ProgressBarStream` tests by removing randomized delays and using a short fixed interval (6d5aea1).
+- Updated `actions/checkout` to v7 across CI and release workflows (094f127).

src/posts/2026-06-29_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-29
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-29_leanprover-lean4.md

@@ -0,0 +1,23 @@
+---
+date: 2026-06-29
+repo: leanprover/lean4
+size: M
+title: "List lemmas land; impossible tactic fixed"
+excerpt: "Lean adds round-trip lemmas for `idxOf`, `finRange` ordering facts, and fixes `impossible`/grind goal handling, while reverting a parser tweak."
+commits: 5
+authors: [kim-em, b-mehta, david-christiansen, nomeata]
+commit_authors: {"c81da09": kim-em, "82730f7": kim-em, "bf75564": nomeata}
+---
+
+### **Round-trip lemmas for `List.idxOf` and indexing** (c81da09)
+Lean now proves that `xs[xs.idxOf x] = x` when `x` occurs in the list, plus the nodup converse `idxOf xs[i] xs = i` for duplicate-free lists. These fill a common gap in core and make list search/index reasoning much smoother.
+
+### **`impossible` no longer cleans up the goal first** (bf75564)
+The `impossible` tactic combinator now uses `revertAll` directly instead of running `cleanup` before negating the goal, which avoids erasing the very structure it needs to prove impossibility. The change also moves `revertAll` into `Revert.lean` and adjusts grind’s internal imports, fixing #14201.
+
+### **`finRange` gets monotonicity and `Nodup` facts** (82730f7)
+Core now has `pairwise_lt_finRange`, `pairwise_le_finRange`, and `nodup_finRange` for `List.finRange n`. These basic ordering facts should simplify proofs that need to treat `finRange` as an increasing, duplicate-free list.
+
+### Other misc changes
+- Made `Nat.ne_of_gt` protected and updated internal references (1 commit).
+- Reverted a parser extension change from #14193 (1 commit).

src/posts/2026-06-29_microsoft-typescript-go.md

@@ -0,0 +1,30 @@
+---
+date: 2026-06-29
+repo: microsoft/typescript-go
+size: L
+title: "Build checks, AST dispatch, and type fixes"
+excerpt: "Conditional type recursion is capped, build up-to-date checks now track package.jsons, and AST traversal/signature help bugs were fixed."
+commits: 6
+authors: [jakebailey, ahejlsberg]
+commit_authors: {"288f23d": ahejlsberg, "042a471": jakebailey, "e190472": jakebailey, "04c7848": jakebailey}
+---
+
+### **Build up-to-date checks now track package.json inputs** (042a471)
+The incremental/build pipeline now consults package.json cache entries when deciding whether outputs are stale, so dependency/package metadata changes can trigger the right rebuilds. This tightens up up-to-date detection around project references and dependency updates.
+
+### **Conditional type base-constraint recursion is capped** (288f23d)
+`computeBaseConstraint` now routes conditional types through a dedicated constraint path with a recursion-depth guard, preventing runaway base-constraint expansion on distributive conditionals. This addresses a real compiler correctness/stability issue around deeply recursive conditional types.
+
+### **AST child iteration is devirtualized for speed** (e190472)
+`Node.ForEachChild` is now generated as a kind-switch dispatch to concrete node implementations, and `IterChildren` is implemented directly on `Node` to avoid interface-based escape-analysis penalties. The change is explicitly aimed at keeping visitors/closures on the stack and making child traversal cheaper.
+
+### **Internal symbol names are no longer leaked in help/printing** (04c7848)
+Signature help and symbol rendering now suppress internal marker prefixes like `\xFEtype` and escape internal names more consistently, so anonymous/contextual types and synthetic symbols show cleaner user-facing labels. This fixes confusing output in signature help and node printing.
+
+### **RemoteNode child traversal no longer double-visits arrays** (f7acbad)
+The native-preview `RemoteNode.forEachChild` logic was fixed so array children aren’t visited twice when a `visitList` callback is supplied. That prevents duplicate traversal in editor/API consumers and is covered by new async/sync tests.
+
+### Other misc changes
+- Submodule update for bundled TypeScript and lib definition refreshes (1 commit)
+- JSDoc wording/signature cleanup in bundled lib files
+- Test baseline updates for the above behavior changes

src/posts/2026-06-29_nodejs-node.md

@@ -0,0 +1,30 @@
+---
+date: 2026-06-29
+repo: nodejs/node
+size: M
+title: "Tracing refactor, path fix, and vm bugfix"
+excerpt: "A tracing-agent refactor lands alongside a vm property copy fix and a Windows path normalization correction."
+commits: 11
+authors: [nodejs-github-bot, legendecas, aduh95, trivikr, joyeecheung, watilde, samuel871211]
+commit_authors: {"787912e": legendecas, "d95cbc2": legendecas, "b0a4f16": watilde}
+---
+
+### **Tracing agent abstraction refactors legacy/perfetto support** (d95cbc2)
+Node’s tracing internals were reworked to route environment and inspector integration through a shared agent abstraction, with legacy handling split into dedicated `agent_legacy` sources. This is a substantial internal refactor that lays groundwork for supporting both the old tracing path and Perfetto more cleanly.
+
+### **Fix vm `PropertyDescriptor` copying during defineProperty** (787912e)
+`vm` now preserves partial `PropertyDescriptor` updates correctly instead of accidentally turning missing values into `undefined` when defining properties in a contextified sandbox. This fixes a long-standing bug that could corrupt property definitions, and the new regression test covers enumerable/configurable/value combinations.
+
+### **Fix false positives for reserved names in `path.win32.normalize()`** (b0a4f16)
+Windows path normalization no longer treats strings like `CONx` or `NULs` as reserved device names unless a colon is actually present. That avoids incorrectly rewriting ordinary filenames to `.
+ame`, while preserving the reserved-name behavior for true device-path cases like `CON:`.
+
+### Other misc changes
+- Added a GitHub Actions benchmark runner workflow.
+- Updated the release-proposal commit-message lint to validate version numbers.
+- Tweaked test runner execArgv filtering for child tests.
+- Improved LCOV reporter snapshot diagnostics.
+- Updated HTTP/2 close() docs.
+- Marked strategic-initiative status updates.
+- Refreshed WPT fixtures for urlpattern.
+- Updated collaborator emeritus metadata.

src/posts/2026-06-29_oven-sh-bun.md

@@ -0,0 +1,53 @@
+---
+date: 2026-06-29
+repo: oven-sh/bun
+size: L
+title: "Bun lands stream, WebSocket, and runtime fixes"
+excerpt: "Major runtime polish: HTMLRewriter refactor, stream/error semantics, WebSocket delivery fixes, Buffer bounds parity, and more."
+commits: 18
+authors: [robobun, Jarred-Sumner, pxseu]
+commit_authors: {"86d32c8": robobun, "d843870": robobun, "daa4473": robobun, "a0f922a": robobun, "0640273": robobun, "f789198": robobun, "20d649f": robobun, "e323e73": robobun, "a401ba3": robobun, "15a5926": robobun, "c6c4210": robobun, "d1e8adf": robobun}
+---
+
+### **HTMLRewriter switches to the Rust lol_html crate** (86d32c8)
+Bun’s HTMLRewriter was refactored to use `lol_html` directly instead of going through its C API, cutting out a large FFI layer and a lot of unsafe binding code. This is a substantial internal simplification that should make the HTML stack easier to maintain and safer to evolve.
+
+### **Streams now reject, not throw, when already errored** (d843870)
+The `Bun.readableStreamTo*` helpers now return rejected promises for already-errored streams instead of throwing synchronously. That aligns them with the rest of the API surface and prevents `.catch()` handlers from being bypassed.
+
+### **Bun.color now treats 24-bit number inputs as opaque** (daa4473)
+Number inputs like `0xff0000` now serialize with an opaque alpha channel instead of being treated as fully transparent. This fixes a user-visible mismatch between `Bun.color` output and the documented behavior.
+
+### **Buffer.from(arrayBuffer, byteOffset, length) matches Node bounds rules** (a0f922a)
+Bun now mirrors Node’s handling of fractional, negative, NaN, and out-of-bounds offsets/lengths when slicing an `ArrayBuffer`. This closes a compatibility gap for code that computes defensive lengths and expects empty views rather than exceptions.
+
+### **stringWidth ignores bidi controls and invisible format chars** (0640273)
+`Bun.stringWidth` now counts bidi control characters and other invisible format characters as zero-width, matching terminal width expectations. That improves TUI layout for text containing RTL markers and similar formatting code points.
+
+### **FormData multipart serialization now normalizes lone CR/LF** (f789198)
+Multipart form-data encoding now follows the spec more closely by normalizing lone CR and LF to CRLF for names and string values before escaping. This fixes malformed serialization differences that could affect interoperability with servers.
+
+### **Linux fs.watch now emits the missing self-delete rename events** (20d649f)
+On Linux, Bun now delivers both self-events when a watched path is deleted, including the basename for the watched file or directory. That brings `fs.watch` closer to Node/libuv behavior for an important edge case.
+
+### **WebSocket publish() works from sockets with no subscriptions** (a401ba3)
+A socket that has never subscribed to anything can now still call `publish()` and deliver to other subscribers, instead of silently no-oping. This fixes a real messaging bug in Bun.serve WebSocket servers.
+
+### **WebSocket unsubscribe() no longer drops queued publish() messages** (e323e73)
+Queued publishes are now delivered even if a socket unsubscribes from its last topic in the same tick. The fix preserves messages that had already been accepted by the publish path, avoiding silent loss.
+
+### **Shell IOWriter stops accepting chunks after fatal write errors** (15a5926)
+After a fatal write failure, the shell writer now rejects new enqueued chunks instead of letting them pile onto a dead writer. This closes a state-machine hole that could surface in fault/fuzz scenarios.
+
+### **console.table only reads getters once per cell** (c6c4210)
+`console.table` and `Bun.inspect.table` now format each cell exactly once, matching Node and avoiding duplicate getter invocations. That removes a subtle correctness issue for objects with observable getters or custom inspect behavior.
+
+### **node:dgram now throws ERR_SOCKET_DGRAM_NOT_RUNNING after close()** (d1e8adf)
+Several `dgram.Socket` methods now check for a closed socket up front and throw the proper Node error code instead of an internal TypeError. That tightens API compatibility and improves error clarity after shutdown.
+
+### Other misc changes
+- Docs updates: base64 guide, runtime docs, and “Bun is written in Rust” wording.
+- `bun pm pack --quiet` no longer prints a leading newline.
+- `bun-plugin-svelte` test loosened to avoid pinning wrapper syntax.
+- `bun_core::strings` alias cleanup and related internal refactors.
+- Formatter/config/test maintenance around the lol_html migration and assorted docs tweaks.