digest: add issues for 2026-06-15

Author: github-actions[bot]

src/posts/2026-06-14_biomejs-biome.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-14
+repo: biomejs/biome
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-14_denoland-deno.md

@@ -0,0 +1,45 @@
+---
+date: 2026-06-14
+repo: denoland/deno
+size: L
+title: "Deno adds declarations, workspaces, and faster runtime"
+excerpt: "Major bundle, install, formatter, and runtime changes landed, plus a few targeted bug fixes and cache improvements."
+commits: 11
+authors: [bartlomieju, lunadogbot, littledivy, divybot]
+commit_authors: {"229ddc0": bartlomieju, "d400a15": littledivy, "bf844be": bartlomieju, "9cf4f7d": lunadogbot, "c6765be": divybot, "af9628d": lunadogbot, "a4e9966": bartlomieju, "e855ab5": bartlomieju, "37c97f4": bartlomieju, "08a3995": bartlomieju}
+---
+
+### **Bundle can now emit rolled-up declaration files** (229ddc0)
+`deno bundle` gained a `--declaration` flag that produces a single `.d.ts` alongside each bundle output. This makes bundling usable for publishing TypeScript libraries without a separate declaration build step.
+
+### **Workspace installs now create member-local node_modules** (a4e9966)
+`deno install` now lays out `node_modules` inside each workspace member, matching npm/pnpm expectations and fixing native Node tooling that runs from within a subpackage. It also prunes stale links and keeps member `.bin` entries in sync, which closes a real workspace resolution gap.
+
+### **Console/inspect moved from JS to Rust** (d400a15)
+The console formatting and inspection stack was ported to Rust, turning `01_console.js` into a thin shim and moving the heavy formatting logic into native code. This is a substantial runtime refactor that should improve performance and reduce JS snapshot weight.
+
+### **Formatter switches HTML/XML/SVG and components to lax-markup** (bf844be)
+`deno fmt` now uses `lax-markup` for markup formatting, replacing the older formatter for HTML, XML, SVG, and component/template cases. The change is aimed at safer, more predictable formatting that preserves text and inline content byte-for-byte unless whitespace changes are provably harmless.
+
+### **Formatter switches CSS to lax-css** (37c97f4)
+CSS, SCSS, and Less formatting now go through `lax-css` instead of `malva`, and `malva` is removed from the dependency tree. This should fix long-standing CSS formatting issues while keeping formatting whitespace-only and syntax-preserving.
+
+### **CSS module imports are now supported behind an unstable flag** (08a3995)
+Deno added a prototype for `import ... with { type: "css" }`, returning a `CSSStyleSheet` for browser-style module graphs. This is a notable new capability for SSR/testing web components and unmodified browser modules, though it remains behind `--unstable-raw-imports`.
+
+### **Install now caches workspace member resolution more accurately** (e855ab5)
+Remote 404 responses are now negatively cached with a short TTL instead of being re-requested on every start. That should reduce repeated fetches for missing JSR or dynamic-import targets and avoid unnecessary network churn.
+
+### **Test output now shows sub-millisecond durations** (af9628d)
+Test reporters and related plumbing were updated so timings can display below the millisecond. This is a small but user-facing improvement to test diagnostics.
+
+### **Coverage summary no longer panics without a common root** (9cf4f7d)
+The coverage summary reporter now handles inputs that don’t share a common root instead of crashing. This is a targeted robustness fix for a real reporter edge case.
+
+### **REPL regex literal highlighting was fixed** (c6765be)
+The REPL editor now highlights regex literals correctly. It’s a focused UX fix, but not a broad functional change.
+
+### Other misc changes
+- Lockfile auto-resolves git merge conflicts in `deno.lock`.
+- Dependency/version bumps and formatter/test updates for the new markup/CSS tooling.
+- Internal plumbing updates for CSS module imports and bundle declaration emission.

src/posts/2026-06-14_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-14
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-14_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-14
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-14_leanprover-lean4.md

@@ -0,0 +1,23 @@
+---
+date: 2026-06-14
+repo: leanprover/lean4
+size: M
+title: "Lake cache overwrite controls land"
+excerpt: "Lake adds overwrite flags and prefers trace outputs, while Lean gains BitVec cpop/setWidth lemmas and Nat.reprFast folding."
+commits: 3
+authors: [hargoniX, tydeu]
+commit_authors: {"9f1e802": hargoniX, "49bb203": hargoniX, "7778d70": tydeu}
+---
+
+### **Lake cache gets conditional overwrite behavior** (7778d70)
+Lake now distinguishes between preserving and replacing cached data, adding `--no-overwrite` and `--force-overwrite` with different defaults across cache subcommands. It also prefers outputs from a local trace file before falling back to cached mappings, and updates module/ltar handling to write cache data more carefully when artifacts are rebuilt.
+
+### **BitVec cpop/setWidth lemmas added** (9f1e802)
+New theorems relate `BitVec.cpop` to `setWidth`, including monotonicity bounds and an equality result when the target width is at least the original width. These lemmas make it easier to reason about popcount behavior across width changes in downstream proofs.
+
+### **Constant folding now handles `Nat.reprFast`** (49bb203)
+The compiler’s LCNF constant folder now folds `Nat.reprFast`, which should improve generated code for expressions that reduce to that function. A regression test was added to lock in the behavior.
+
+### Other misc changes
+- Cache CLI help text and option docs updated
+- `lake cache` staging/online test scripts adjusted

src/posts/2026-06-14_microsoft-typescript-go.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-14
+repo: microsoft/typescript-go
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-14_nodejs-node.md

@@ -0,0 +1,24 @@
+---
+date: 2026-06-14
+repo: nodejs/node
+size: M
+title: "Crypto, QUIC, and immediates get fixes"
+excerpt: "A mix of correctness fixes landed across crypto, QUIC exports, and the native-immediate fast path, plus new util tests."
+commits: 4
+authors: [haramj, pimterry, gurgunday, watilde]
+commit_authors: {"120c2a4": haramj, "2b75078": pimterry, "4fb667e": gurgunday}
+---
+
+### **Fix Hash stream errors when native update fails** (120c2a4)
+`Hash._transform()` now checks the return value from the native `update()` call and forwards `ERR_CRYPTO_HASH_UPDATE_FAILED` instead of silently continuing. This fixes an unhandled error path in hash streams and adds a regression test covering the failure case.
+
+### **Fast-path empty native-immediate drains** (4fb667e)
+Node now skips the native-immediate drain work when there is nothing queued, and avoids entering the immediate check path when both JS immediates and native immediates are empty. That reduces needless work in the event loop and comes with a C++ test proving empty scopes are ignored while queued native immediates still run.
+
+### **Export QUIC listEndpoints correctly** (2b75078)
+`listEndpoints` is now re-exported from `lib/quic.js`, restoring the public QUIC API entry point. The same change also adjusts QUIC internals and callback coverage so the internal set-callbacks test matches the current session callback surface.
+
+### **Other misc changes**
+- Added util tests for `_exceptionWithHostPort()` and `getCallSites()` source-map behavior.
+- QUIC include/export cleanup and callback test updates.
+- New source-map fixtures for util call-site tests.

src/posts/2026-06-14_oven-sh-bun.md

@@ -0,0 +1,19 @@
+---
+date: 2026-06-14
+repo: oven-sh/bun
+size: M
+title: "SQL validation and pool safety fixes"
+excerpt: "Bun tightened SQL helper validation, hardened pool scans against unassigned slots, and extended a few container test timeouts."
+commits: 3
+authors: [robobun, alii]
+commit_authors: {"4d79cf8": robobun, "eb98fd8": robobun}
+---
+
+### **SQL helpers now reject degenerate inputs cleanly** (4d79cf8)
+Bun's `sql()` helpers now throw clear `SyntaxError`s for invalid helper payloads instead of surfacing raw `TypeError`s or backend syntax errors. The fix also tightens the TypeScript signature so bare `null`/`undefined` are rejected at compile time, while preserving valid array bindings like `[null]` for `WHERE IN`.
+
+### **Pool scans no longer blow up on unfilled connection slots** (eb98fd8)
+The SQL pool now tolerates holes in its connection array during startup, which matters because user code can re-enter pool methods while a `password` callback is still filling slots. This prevents a raw `TypeError` during connection management and makes the pool-start path resilient under reentrant callbacks.
+
+### Other misc changes
+- Increased `beforeAll` timeouts for container-backed tests to 120s to avoid cold-start hook kills (3 commits).

src/posts/2026-06-14_pnpm-pnpm.md

@@ -0,0 +1,51 @@
+---
+date: 2026-06-14
+repo: pnpm/pnpm
+size: L
+title: "Pacquet gets faster, safer, and more consistent"
+excerpt: "Big pnpm/pacquet updates: end-to-end delegation, Windows fixes, auth scoping, and a real speedup for failed exits."
+commits: 20
+authors: [zkochan, tsushanth, davidbarratt, dasa, felipecrs, mcmxcdev, kimulaco, AhmedBaset]
+commit_authors: {"a6d485a": zkochan, "3a27141": davidbarratt, "5f63458": zkochan, "74a2dc9": zkochan, "23716ed": felipecrs, "0fe6ea9": zkochan, "7cdf9f8": mcmxcdev, "681b593": zkochan, "2da0444": kimulaco, "ab0b7d1": AhmedBaset, "baf1502": zkochan}
+---
+
+### **pnpm install can now delegate resolution to pacquet too** (74a2dc9)
+When `pacquet` is configured in `configDependencies` and is new enough, pnpm no longer has to resolve the graph itself first — pacquet can resolve, write `pnpm-lock.yaml`, and materialize `node_modules` in one pass. That reduces duplicated work on non-frozen installs and makes the Rust engine the primary install path when available.
+
+### **Scope-specific registry auth tokens are now supported** (681b593)
+pnpm can now pick auth tokens by both registry URL and package scope, so different orgs on the same registry can use different credentials. This fixes a real limitation for registries that issue per-scope tokens, and `pnpm login --scope` now writes the matching scoped auth entry.
+
+### **Windows failed commands exit faster instead of hanging** (5f63458)
+A failed pnpm command on Windows could stall for tens of seconds while enumerating descendant processes during error cleanup. The lookup is now bounded, which avoids the long exit hang and also unblocks Windows CI suites that were getting stuck.
+
+### **Lockfile and pacquet Windows install tests are stabilized** (a6d485a)
+pnpm now waits for lockfile reads to close deterministically and aligns pacquet’s virtual store length handling with pnpm on Windows. It also forwards the effective virtual-store max length into delegated pacquet installs, preventing mismatched `.modules.yaml` output on Windows.
+
+### **Locked peer pinning no longer leaks across siblings** (3a27141)
+A pinned locked peer provider could bleed into sibling resolution when the node had no children of its own, making lockfile output depend on resolution order. The fix scopes the pinned state to the current node, eliminating intermittent `pnpm dedupe --check` failures.
+
+### **Pacquet preserves executable files on copy fallback** (2da0444)
+When pacquet fell back to copying instead of hardlinking/reflinking, executable binaries could lose their exec bit and fail to spawn with `EACCES`. The copy path now preserves executable status based on CAFS path metadata, fixing a class of CI and overlayfs install failures.
+
+### **Pacquet now matches pnpm’s lockfile and metadata behavior more closely** (baf1502)
+This is a broad correctness pass over pacquet’s resolver and installer behavior, including syncing package-manager dependency metadata, better optional-dependency and platform handling, and improved mirror/cache support. It narrows the remaining gaps between pacquet and pnpm, especially for installs that depend on exact lockfile output.
+
+### **Lifecycle scripts now preserve user-defined `npm_config_*` env vars** (23716ed)
+pnpm previously stripped all `npm_config_*` environment variables during lifecycle execution, which also removed user-provided settings like `npm_config_platform_arch`. The env filter now keeps user-defined config vars while still stripping auth-related ones.
+
+### **`pnpm publish` now forwards `strictSsl` correctly** (7cdf9f8)
+Publishing to self-signed or otherwise non-standard registries now respects `strictSsl: false` from config. That restores parity with npm registry fetch behavior and fixes publishes that were failing behind custom certificate setups.
+
+### **`pnpm setup` skips unnecessary `@pnpm/exe` build scripts** (0fe6ea9)
+The standalone executable’s self-install path no longer triggers `preinstall`/`prepare` scripts for `@pnpm/exe`. That avoids a pointless build-approval prompt and makes setup workable on hosts without Node tooling.
+
+### **`pnpm link` gains `--trust-lockfile`** (ab0b7d1)
+`pnpm link` now accepts the same trust-lockfile flag that other install flows already support. This brings the command in line with the rest of pnpm’s install surface.
+
+### Other misc changes
+- CI performance upload / bencher workflow updates (4 commits)
+- AI review guidance and config docs tweaks (1 commit)
+- Interactive prompt summary and test determinism fixes (2 commits)
+- Windows test workflow cache and setup adjustments (2 commits)
+- Lockfile stream close fix in `lockfile.fs` (1 commit)
+- View command tarball size calculation fix (1 commit)

src/posts/2026-06-14_tc39-ecma262.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-14
+repo: tc39/ecma262
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+