digest: add issues for 2026-08-01

Author: github-actions[bot]

src/posts/2026-07-31_biomejs-biome.md

@@ -0,0 +1,20 @@
+---
+date: 2026-07-31
+repo: biomejs/biome
+size: M
+title: "CLI docs polish and linter fixes"
+excerpt: "Biome clarified CLI help/reporting docs and fixed `noUnnecessaryConditions` regressions around optional chains and overload selection."
+commits: 2
+authors: [yanthomasdev, ematipico]
+commit_authors: {"2fa0a62": yanthomasdev, "8c2c6bd": ematipico}
+---
+
+### **`noUnnecessaryConditions` stops misreporting optional-chain cases and overloads** (8c2c6bd)
+Biome fixed a regression where the rule could flag optional chains/nullish coalescing even when the receiver could actually be nullish, and it now matches TypeScript’s overload selection more closely for callback-style calls. This should reduce false positives in real-world type-heavy code.
+
+### **CLI help and reporter docs were reworked** (2fa0a62)
+The CLI’s option descriptions, reporter help text, and snapshot output were cleaned up and clarified, including better wording for colors, diagnostics limits, and reporter destinations. The changes are mostly documentation-facing, but they improve discoverability and make the command-line UX easier to understand.
+
+### Other misc changes
+- Dependency/changelog updates for the above fixes
+- Test snapshot refreshes for CLI help and JSON reporter output

src/posts/2026-07-31_denoland-deno.md

@@ -0,0 +1,16 @@
+---
+date: 2026-07-31
+repo: denoland/deno
+size: M
+title: "Redirect auth handling fixed in Deno HTTP client"
+excerpt: "Deno now preserves stripped redirect headers across hops, preventing Authorization from being accidentally restored mid-chain."
+commits: 1
+authors: [nathanwhit]
+commit_authors: {"fbe07f1": nathanwhit}
+---
+
+### **Preserve stripped headers across redirect chains** (fbe07f1)
+Deno’s HTTP client now carries redirect headers forward as chain state instead of rebuilding them from the original request on each hop. This fixes a bug where an `Authorization` header removed on one redirect could be accidentally restored on later redirects, while still preserving same-origin and same-host upgrade behavior.
+
+### Other misc changes
+- Added a deterministic multi-hop redirect test using ephemeral local listeners.

src/posts/2026-07-31_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-31
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-31_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-31
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-31_leanprover-lean4.md

@@ -0,0 +1,33 @@
+---
+date: 2026-07-31
+repo: leanprover/lean4
+size: L
+title: "Lean tightens kernel invariants and adds cbv at"
+excerpt: "Kernel checks got stricter around nested inductives and Prop detection, while `cbv at` returned with safe local-hypothesis reduction."
+commits: 9
+authors: [leodemoura, Rob23oba, wkrozowski, sgraf812, tydeu]
+commit_authors: {"23393b9": Rob23oba, "448dc44": leodemoura, "02a57df": leodemoura, "21b167c": wkrozowski, "34a43df": leodemoura, "17dbc81": leodemoura}
+---
+
+### **Kernel now re-checks nested-inductive declarations** (448dc44)
+Lean’s kernel now re-validates the constructor types plus generated recursor types and equations after nested inductive elimination and name restoration. These extra checks are redundant in the happy path, but they harden the environment against soundness bugs if nested-inductive rewriting misses something.
+
+### **`cbv` now supports `at` locations safely** (21b167c)
+`cbv` can now reduce the goal, a hypothesis, or both via standard location syntax like `cbv at h`, `cbv at h |-`, and `cbv at *`. The implementation isolates each hypothesis reduction in its own `SymM` session, preserving incrementality invariants while restoring a useful tactic feature.
+
+### **Kernel fixes universe-normalized `Prop` detection** (17dbc81)
+The kernel now recognizes propositions up to universe normalization, so sorts like `Sort (imax 1 0)` are treated as `Prop`. This closes a serious soundness hole where non-proof data could be projected out of something that should have been proof-irrelevant.
+
+### **Inductive checking now normalizes `Prop`-like result levels** (34a43df)
+The inductive checker now treats `Sort (imax 1 0)` and `Sort 0` equivalently when deciding whether an inductive is a predicate, including K-like reduction and elimination restrictions. That makes metaprogrammed declarations consistent with what the elaborator already normalizes before the kernel sees them.
+
+### **`grind` canonicalizes bit-vector and `Fin` literals in patterns** (02a57df)
+Ground e-matching patterns now normalize literals before entering the E-graph, preventing malformed `BitVec.ofNat` / `Fin.mk` spellings from violating `grind`’s interpreted-node invariants. This fixes a regression where a quantified goal with `#`-syntax bit-vector literals could crash with a kernel error instead of solving.
+
+### **`MonadTail (StateT σ m)` no longer needs `Nonempty σ`** (23393b9)
+The `MonadTail` instance for `StateT` was generalized so it works even when the state type has no `Nonempty` instance. That unblocks `while` specifications over `StateT` monads whose state type is only inhabited locally, which is a meaningful ergonomic improvement for proofs.
+
+### Other misc changes
+- Kernel rejects declarations that refer to `_nested` auxiliary types, closing a metaprogramming-only soundness hole.
+- vcgen benchmark driver now reports sub-ms timings as fractional milliseconds.
+- Lake docstring fix for `buildLeanSharedLibSync`.

src/posts/2026-07-31_microsoft-typescript-go.md

@@ -0,0 +1,14 @@
+---
+date: 2026-07-31
+repo: microsoft/typescript-go
+size: S
+title: "Composite mapper allocations trimmed"
+excerpt: "A small checker optimization avoids building temporary composite mappers during type instantiation, reducing allocation overhead."
+commits: 1
+authors: [jakebailey]
+commit_authors: {"5b1047d": jakebailey}
+---
+
+### Other misc changes
+- Avoid temporary composite mapper allocations in the checker’s object type instantiation path (#4798) (5b1047d).
+- Added a helper to map a type through two mappers without eagerly combining them, preserving behavior while cutting intermediate work.

src/posts/2026-07-31_nodejs-node.md

@@ -0,0 +1,29 @@
+---
+date: 2026-07-31
+repo: nodejs/node
+size: L
+title: "QUIC, sqlite, streams, and coverage land"
+excerpt: "Notable fixes and features: test coverage expansion, a QUIC crash fix, sqlite state checks, and a streams BYOB speedup."
+commits: 9
+authors: [avivkeller, trivikr, mcollina, nodejs-github-bot, pimterry, soulee-dev]
+commit_authors: {"8a1ca0f": avivkeller, "a0d1911": avivkeller, "b7d29fe": avivkeller, "c543cfb": mcollina, "756a023": nodejs-github-bot, "67af6d1": pimterry, "598693b": soulee-dev, "bec3d0b": trivikr, "a58aad7": trivikr}
+---
+
+### **Test runner gains `--test-coverage-include-all`** (b7d29fe)
+Adds a new experimental coverage option that includes source files never loaded during a test run, reporting them as zero-coverage entries. This makes coverage reports more complete and is wired through CLI docs, the test runner API, option parsing, and coverage collection.
+
+### **Streams BYOB pending reads now use the ring buffer** (c543cfb)
+`ReadableByteStreamController` switches its pending BYOB pull-into descriptor queue from a plain array to the same ring-buffer `Queue` used elsewhere in WHATWG streams. That removes repeated `Array.prototype.shift()` overhead on BYOB reads and should improve byte-stream performance without changing behavior.
+
+### **QUIC avoids a segfault on fragmented ClientHello** (67af6d1)
+The session code now defers `PostReceive()` until an application is actually selected, instead of assuming ALPN is ready during packet processing. This fixes a crash path when a ClientHello spans multiple QUIC Initial packets, and the new test covers the multi-packet handshake case.
+
+### **SQLite methods now reject calls on closed databases** (a58aad7)
+`enableLoadExtension()` and `setAuthorizer()` now check that the database is still open before passing control to SQLite, matching the existing defensive behavior in related APIs. Calls after `close()` now throw `ERR_INVALID_STATE` instead of risking process termination.
+
+### Other misc changes
+- Backported V8 inspector promise-lifetime fix and bumped `v8_embedder_string` (a0d1911)
+- Updated WPT URL fixtures (756a023)
+- Moved a flaky REPL inspector test out of the flaky list (8a1ca0f)
+- Documentation cleanup for cctest source listing instructions (598693b)
+- Faster setup for a recursive vfs test (bec3d0b)

src/posts/2026-07-31_oven-sh-bun.md

@@ -0,0 +1,50 @@
+---
+date: 2026-07-31
+repo: oven-sh/bun
+size: L
+title: "Bun fixes fetch memory, redirects, and more"
+excerpt: "Major fetch and stream memory improvements landed alongside several notable correctness and crash fixes across networking, SQL, TLS, and FFI."
+commits: 44
+authors: [robobun, Jarred-Sumner]
+commit_authors: {"5f65d37": robobun, "30032c6": robobun, "5b7c3ca": robobun, "e03e8cf": robobun, "b7fef25": robobun, "b78a50d": robobun, "c999bf6": robobun, "26f65fa": robobun, "997739f": robobun, "12ab112": robobun, "37a7767": robobun, "9ad23e2": robobun, "d9f53ed": robobun, "fe473ea": robobun, "f0c4263": robobun, "15feee1": robobun, "3ec728d": robobun, "45ccba4": robobun, "90da0f9": robobun, "081b614": robobun, "af5e88d": robobun, "befd269": robobun, "fadf10e": robobun, "ff512ea": Jarred-Sumner, "78bf500": Jarred-Sumner, "d370057": robobun, "34bcd29": robobun, "ceddc66": robobun, "503b01c": robobun, "11e09c7": robobun, "4454cc5": robobun, "cbe3e18": robobun, "529adec": robobun, "84416cf": robobun, "468dac3": robobun, "2fbb08a": robobun, "f70a5eb": robobun}
+---
+
+### **Fetch bodies now stream with much lower peak memory** (5f65d37)
+Buffered consumers like `.arrayBuffer()`, `.bytes()`, and `.text()` now avoid the old over-allocation pattern and the streaming path can hand response bytes through as borrowed slices. The change should materially cut RSS for large fetches and concurrent streaming workloads, especially when bodies are read incrementally.
+
+### **`fetch(..., { redirect: 'error' })` now only rejects real redirect codes** (b7fef25)
+Bun was treating every `300..399` status as a redirect, so responses like `300`, `304`, `305`, and `306` were incorrectly rejected. This brings redirect handling in line with the WHATWG spec and avoids breaking callers that need to observe non-redirect 3xx responses.
+
+### **`Response.clone()` no longer multiplies stream chunk copies** (5b7c3ca)
+Stream tee branches now share chunk references instead of deep-copying each chunk through structured clone per branch. That removes a major memory blow-up for clone chains and makes cloned streamed bodies far cheaper to retain.
+
+### **`bytes()` / `arrayBuffer()` single-chunk fast paths now copy safely** (e03e8cf)
+The single-chunk consumer fast path used to return the producer’s backing storage by identity, which could alias or transfer the live source buffer. This fixes the correctness hole by copying binary chunks even in the one-chunk case.
+
+### **`fs.watch(..., { recursive: true })` now reports subtree watch failures** (9ad23e2)
+On Linux, failures from `inotify_add_watch` on nested directories were previously swallowed, leaving partially-watched trees with no error signal. The watcher now surfaces those failures as `'error'` events so applications can detect incomplete coverage.
+
+### **`fs.statfs` no longer truncates large filesystems on non-bigint paths** (ceddc66)
+The non-बigint `statfs` implementation was storing fields in `i32`, which overflowed on larger volumes and returned negative counts. Large filesystems now report correct values instead of wrapping.
+
+### **FFI `toBuffer()` stops freeing caller-owned memory** (45ccba4)
+`bun:ffi` now borrows caller-owned bytes unless a finalizer is provided, avoiding accidental GC-time frees of foreign memory. This closes a serious use-after-free / bad-free footgun for native integrations.
+
+### **TLS session helpers now return resume-capable tickets on TLS 1.3** (60bee4f)
+`getSession()` and `getTLSTicket()` now return the ticket-bearing session on TLS 1.3 connections, matching Node’s behavior. That restores session resumption for callers that cache the accessor result.
+
+### **`Bun.serve` preserves handler `Content-Length` on 304 responses** (37a7767)
+304 responses previously had their handler-supplied length replaced with `0`, which is not valid framing for this status. Bun now forwards the handler value correctly and avoids synthesizing an invalid length.
+
+### **`server.stop(true)` no longer crashes when a close handler closes a sibling** (529adec)
+The uSockets teardown walk has been hardened against handlers that close other sockets during shutdown, eliminating a use-after-free in bursty TLS teardown scenarios. This is a real stability fix for concurrent connection shutdown paths.
+
+### **SQL result rows no longer silently drop columns on structure mismatch** (997739f)
+The row builder now asserts the structure/column offset invariant instead of skipping writes when it fails. That turns a silent data loss bug into an explicit failure and protects row shape integrity.
+
+### Other misc changes
+- CI allowlist regenerated from newer parallel-build data (30032c6)
+- `spawn` stdio cleanup and overlapped shorthand support fixes (c999bf6, af5e88d)
+- `AbortSignal.any()` exception-handling fix (12ab112)
+- `bun test` / timer / shell / inspect / zlib / crypto / websocket compatibility fixes (d9f53ed, 11e09c7, fe473ea, 468dac3, 081b614, 84416cf, 26f65fa, b78a50d)
+- Install/catalog/postinstall and bundle tree-shaking / dead-code cleanup work (f0c4263, cbe3e18, fadf10e, 78bf500, d370057, 503b01c, 34bcd29, 15feee1, ff512ea, 3ec728d, befd269, 2fbb08a, f70a5eb, 90da0f9, 4454cc5)

src/posts/2026-07-31_pnpm-pnpm.md

@@ -0,0 +1,26 @@
+---
+date: 2026-07-31
+repo: pnpm/pnpm
+size: M
+title: "Napi build tracking and reporter cleanup"
+excerpt: "pnpm added a new N-API install option for build tracking, plus a few refactors and dependency bumps."
+commits: 8
+authors: [zkochan]
+commit_authors: {"a99b852": zkochan, "d3556f6": zkochan, "c2b7cfb": zkochan, "7f81da3": zkochan}
+---
+
+### **Track deps that require build scripts in N-API installs** (c2b7cfb)
+`@pnpm/napi` now supports `returnListOfDepsRequiringBuild`, mirroring the TypeScript engine’s option. When enabled, installs report every package with install scripts that would require a build, even if script execution is allowed, fixing empty build lists for embedders that need to persist this metadata.
+
+### **Default reporter no longer pulls in config.reader at runtime** (7f81da3)
+The default reporter now depends on a small structural `ReporterPnpmConfig` type instead of `@pnpm/config.reader`, trimming its runtime dependency tree. That should make embedding the reporter cheaper and avoid dragging in config-reader transitive dependencies unnecessarily.
+
+### **Move internal string/config utilities into the monorepo** (d3556f6)
+`lexCompare` and `nerfDart` were republished under clearer in-repo package names: `@pnpm/text.ordinal-comparator` and `@pnpm/config.registry-auth-key`. This is mostly a refactor and packaging cleanup, but it also makes the utilities easier to reuse without Bit workspace naming collisions.
+
+### **Re-resolve stale hoisted `@types/node` peers** (a99b852)
+Hoisted optional peers are now bounded by the workspace root’s own specifier instead of being maximized across the whole graph. That fixes stale `@types/node` hoists landing in lockfiles when optional peers were declared as `*`.
+
+### Other misc changes
+- Release 11.19.0 changelog generation
+- Rust dependency bumps: `serde`, `futures-util`, `napi`

src/posts/2026-07-31_tc39-ecma262.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-31
+repo: tc39/ecma262
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+