digest: add issues for 2026-06-26

Author: github-actions[bot]

src/posts/2026-06-25_biomejs-biome.md

@@ -0,0 +1,25 @@
+---
+date: 2026-06-25
+repo: biomejs/biome
+size: M
+title: "Formatter and analyzer fixes land"
+excerpt: "Biome fixes CSS, GritQL, HTML linting, and TS formatter correctness, plus a small dependency bump."
+commits: 5
+authors: [ematipico, Zelys-DFKH, denbezrukov, henrybrewer00-dotcom]
+commit_authors: {"54e8239": ematipico, "0efe244": Zelys-DFKH, "5ec965a": denbezrukov, "e36fd8a": henrybrewer00-dotcom}
+---
+
+### **CSS formatter keeps selector comments inline** (5ec965a)
+Biome now preserves selector lists on one line when a `//` comment follows a comma, instead of reflowing the selector into descendant combinators. This fixes a formatting regression that could significantly change CSS output for comment-heavy selectors.
+
+### **GritQL now accepts positional arguments in calls** (0efe244)
+The Grit parser and pattern compiler were updated so unkeyed arguments are parsed as patterns unless a real `name = value` argument is present. This unblocks valid GritQL patterns that previously failed to parse, including pattern, function, and node calls.
+
+### **`noUndeclaredClasses` handles `is:global` and HTML styles** (54e8239)
+The HTML analyzer was fixed to correctly recognize styles declared inside Astro `is:global` blocks and plain HTML documents. That closes a false-positive gap in class detection for mixed Astro/Svelte content and regular HTML.
+
+### **Formatter keeps parentheses around `await`/`yield` instantiation targets** (e36fd8a)
+TypeScript instantiation expressions now retain parentheses around lower-precedence targets like `await`, `yield`, conditional expressions, and postfix updates. Without this, the formatter could change the meaning of code by letting type arguments attach to the wrong subexpression.
+
+### Other misc changes
+- Dependency bump: `salsa` 0.27.0 → 0.27.2 (2ff160a)

src/posts/2026-06-25_denoland-deno.md

@@ -0,0 +1,53 @@
+---
+date: 2026-06-25
+repo: denoland/deno
+size: L
+title: "Security hardening and key bug fixes"
+excerpt: "Deno shipped npm trust-policy hardening, a default dependency-age cooldown, and several fixes across deploy, desktop, node, LSP, HTTP, and crypto."
+commits: 19
+authors: [divybot, nathanwhitbot, bartlomieju, nathanwhit, crowlbot, denobot, avocet-bot, littledivy, sigmaSd]
+commit_authors: {"2894458": avocet-bot, "8025886": crowlbot, "5a33eed": bartlomieju, "702cafb": bartlomieju, "90d901d": nathanwhitbot, "9eeca7b": divybot, "27a0882": divybot, "5317e3c": divybot, "4068b5b": divybot, "7ba7023": divybot, "2c7612d": divybot, "04ac9f1": nathanwhitbot, "16254ac": nathanwhitbot, "57f4d00": nathanwhit}
+---
+
+### **npm resolver now uses trust-policy metadata and can block downgrades** (702cafb)
+Deno's npm resolver now understands publishing trust signals from the full packument and adds an opt-in `no-downgrade` trust policy. This is a substantial supply-chain hardening change that can affect dependency selection behavior.
+
+### **Default minimum dependency age now skips fresh npm releases** (90d901d)
+The resolver now applies a default 24-hour minimum age when no other setting is configured, reducing exposure to freshly published packages. The change also adjusts precedence and parsing so `0` disables the filter, matching the new fallback behavior.
+
+### **`Deno.serve` compression defaults to off** (57f4d00)
+Automatic response compression is now disabled by default, with explicit opt-in preserved. That changes runtime behavior for served responses and avoids surprising compressed output unless callers request it.
+
+### **Vite projects are now detected for `deno desktop` / `deno compile`** (2c7612d)
+Framework detection now recognizes plain Vite apps, not just Vite SSR setups, and generates a static-site serving entrypoint with SPA fallback when there is no server file. This broadens out-of-the-box support for common Vite projects.
+
+### **`node:vm` no longer panics on `import.meta` in `SourceTextModule`** (9eeca7b)
+The VM module path now wires V8's import-meta callback through to the user's `initializeImportMeta` handler instead of crashing on unknown modules. This fixes a real Node-compatibility panic for `vm.SourceTextModule`.
+
+### **LSP now reports `TS2307` for missing imports in `.d.ts` entrypoints** (27a0882)
+The language server now surfaces unresolved imports in declaration-file entrypoints the same way `deno check` does. That closes a diagnostics gap that could hide missing dependency errors from editor feedback.
+
+### **`node:test` mock timers now support `AbortSignal.timeout`** (5317e3c)
+`mock.timers.enable({ apis: ['AbortSignal.timeout'] })` now works, letting `AbortSignal.timeout()` follow the mocked clock instead of real time. This fills an important gap in the Node test polyfill.
+
+### **WebCrypto now pads JWKs for AES-KW wrapping** (4068b5b)
+`subtle.wrapKey("jwk", ..., "AES-KW")` now pads serialized JWK JSON to an 8-byte boundary before wrapping, matching browser and Node behavior. That fixes a TypeError that previously broke JWK wrapping.
+
+### **`process.resourceUsage()` is now implemented** (7ba7023)
+Deno's Node polyfill now exposes `process.resourceUsage()` with Node-compatible fields on both Unix and Windows. This unblocks code that relies on the API and previously saw it missing entirely.
+
+### **`Headers` inspection preserves duplicate `Set-Cookie` values** (04ac9f1)
+Custom inspection for `Headers` now folds duplicate iterable header names instead of overwriting them, which matters for multi-value headers like `Set-Cookie`. This is a correctness fix for both Deno and Node-compatible behavior.
+
+### **Node console now exposes lazy stdio streams** (16254ac)
+`console._stdout` and `console._stderr` are now present, matching Node's lazy stream properties. That helps compatibility with libraries like `consola` that probe those private fields.
+
+### **Deploy config no longer strips explicit workspace-member includes** (8025886)
+Workspace-root deploy configs now keep `deploy.include` globs that intentionally point at workspace members, instead of dropping them during normalization. This fixes a bug where `deno deploy` could end up with an empty file set from the workspace root.
+
+### Other misc changes
+- 2.9.0 release/version bump and generated workflow lockfile updates (1 commit)
+- `cargo publish` fix for `LAUFEY_VERSION` resolution during tarball verification (5a33eed)
+- `deno deploy` now prefers JSR `latest` for the bundled CLI (2894458)
+- Desktop macOS plist metadata and Wayland launcher tweaks (2 commits)
+- Small HTTP/Desktop config and test fixes, including zero-arg serve compression and a few compat regressions

src/posts/2026-06-25_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-25
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-25_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-25
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-25_leanprover-lean4.md

@@ -0,0 +1,41 @@
+---
+date: 2026-06-25
+repo: leanprover/lean4
+size: L
+title: "Lean4 adds parser option propagation, float patterns"
+excerpt: "Major day for Lean4: doc rendering extensibility, `set_option in` parsing, float matching/equality, VCGen frames, and grind/perf fixes."
+commits: 17
+authors: [nomeata, david-christiansen, hargoniX, algebraic-dev, ia0, Kha, TwoFX, sgraf812, brettkoonce, pevogam, Seasawher]
+commit_authors: {"3061104": david-christiansen, "28c2e86": david-christiansen, "9d0f28f": hargoniX, "c60dff6": Kha, "29db757": nomeata, "4c59d1c": algebraic-dev, "dde9f3e": nomeata, "943e02c": TwoFX, "95176b3": hargoniX, "afe0cec": nomeata, "d96beb4": algebraic-dev, "08c8b6a": sgraf812, "72b149d": brettkoonce, "5a9514e": ia0, "8d50f53": ia0, "e6bfa44": pevogam, "0758b1d": Seasawher}
+---
+
+### **Propagate `set_option ... in ...` into parsing** (28c2e86)
+`set_option` now affects the parser for the scoped body in commands, terms, and tactics, bringing it in line with `open ... in`. This is important for things like enabling/disabling syntax extensions such as Verso exactly where they’re needed.
+
+### **Extend Verso docstrings with custom Markdown rendering** (3061104)
+Docstring lookup now has a Markdown-aware path and supports extensible Markdown rendering for custom inline/block elements instead of falling back to alternate text. This is a sizable LSP/docs upgrade: custom Verso elements can now render cleanly in hover and legacy Markdown clients, with a corresponding simplification of the saved element representation.
+
+### **Add `Float`/`Float32` literals to `match` patterns** (dde9f3e)
+`match` can now use floating-point literals directly as patterns, including negative literals, and it recognizes both `Float` and `Float32` forms. The compiler uses the types’ `DecidableEq` instances, so bit-pattern distinctions like `0.0` vs `-0.0` matter.
+
+### **Introduce `DecidableEq` for `Float` and `Float32`** (943e02c)
+Lean now has propositional equality for floats based on underlying bit patterns, distinct from `BEq`. That unlocks pattern matching on floats and gives users a precise equality notion for `Float`/`Float32`.
+
+### **Add `frames` support to `vcgen`** (08c8b6a)
+`vcgen` gains a new `frames` clause for preserving state assertions across matched programs, along with a frame database and lazy elaboration machinery. This expands the tactic’s expressive power for verified do-notation and introduces a new framing side-goal (`WP.Frames`) when a frame is attached.
+
+### **Teach `grind` about more locals without blocking** (afe0cec)
+`grind`, `exact?`, `apply?`, and `rw?` now iterate local constants via a non-blocking environment API instead of waiting on unrelated async theorem bodies. That should remove editor latency/hangs in long files, while also making local theorem collection more selective and robust.
+
+### **Refine `Std.Time` week types and APIs** (4c59d1c)
+The `Std.Time` week naming/types were reshuffled so month/year ordinals line up more consistently, and the API now distinguishes aligned month weeks from year weeks more clearly. This is a source-level cleanup with some real type-signature impact for downstream time code.
+
+### **Make `Selectable.combine` avoid deadlocks** (d96beb4)
+Async selection was reworked to remove the deadlock around `Selectable.combine` and fix a recursive-mutex issue in `Selectable.one`. This is a meaningful runtime fix for anyone composing async selectors.
+
+### Other misc changes
+- Performance tweak for `Array`/`List.findIdx` e-matching (9d0f28f)
+- Make test snapshots opt-in (c60dff6)
+- Fix tests for #13705 (29db757)
+- Teach `grind` more about `{Array,Vector,List}.count` and membership (95176b3)
+- Docstring typo/wording fixes in `decide`, `Format.nest`, `Format.bracketFill`, `List.foldr`, and time parsing docs (72b149d, 5a9514e, 8d50f53, e6bfa44, 0758b1d)

src/posts/2026-06-25_microsoft-typescript-go.md

@@ -0,0 +1,14 @@
+---
+date: 2026-06-25
+repo: microsoft/typescript-go
+size: M
+title: "Native preview gets CJS root entrypoint"
+excerpt: "@typescript/native-preview now exposes a CommonJS `.` entrypoint for version data, improving package compatibility for CJS consumers."
+commits: 1
+---
+
+### **Add CJS root version entrypoint for @typescript/native-preview** (c080da6)
+The package now exports `.` to a new CommonJS `version.cjs` stub, alongside matching `.d.cts` types. This makes the native-preview package easier to consume from CJS tooling and lets callers read `version` and `versionMajorMinor` from the package root without special handling.
+
+### Other misc changes
+- Package export map updated to point `.` at the new stub entrypoint.

src/posts/2026-06-25_nodejs-node.md

@@ -0,0 +1,31 @@
+---
+date: 2026-06-25
+repo: nodejs/node
+size: M
+title: "V8 promise cleanup and emulator support"
+excerpt: "Node backports V8 promise API removals, improves promise GC behavior, and adds build-time emulator support for cross-platform tool runs."
+commits: 10
+authors: [bakkot, tniessen, aduh95, tie, trivikr]
+commit_authors: {"74567b2": bakkot, "32ae06e": bakkot, "b0fa732": aduh95, "4f177f1": aduh95, "a811c34": tniessen, "652d033": tniessen, "6bda0ab": tniessen, "b087e92": tie, "c612f35": trivikr}
+---
+
+### **Promise resolvers no longer keep resolved Promises alive** (74567b2)
+V8 now stores a single `Promise|Undefined` slot instead of separate promise/already-resolved fields for resolving functions. That lets the GC collect a resolved Promise even if its resolver callbacks are still reachable, reducing accidental retention.
+
+### **V8 promise reject/resolve-after-resolved APIs are removed** (32ae06e)
+This backport removes the deprecated runtime hooks and public V8 API entries for `PromiseRejectAfterResolved` / `PromiseResolveAfterResolved`, and updates internal callers to return `undefined` instead. It’s a cleanup ahead of full removal of these events, so embedders should stop relying on them.
+
+### **Configure can now inject an emulator for build tools** (b087e92)
+A new `--emulator` configure option threads an emulator command through GYP so host-built helpers like `mksnapshot`, `torque`, and other generated-action binaries can run under emulation during cross-platform builds. This addresses a real build constraint for targets whose helper binaries can’t execute natively on the build machine.
+
+### **X.509 parser now handles large RSA exponents** (652d033)
+`GetExponentString()` no longer truncates or returns `null` for RSA public exponents that don’t fit in a single machine word; it now prints the full big integer via OpenSSL. That fixes certificate parsing for unusual but valid keys.
+
+### **DH generator validation fixes very large values** (6bda0ab)
+The DH generator check is adjusted so very large generators aren’t misclassified by `std::optional` ordering quirks. This prevents valid large values from being rejected during crypto parameter validation.
+
+### **Misc crypto cleanup and test/build updates**
+- Shared GitHub Actions workflow conversion for `build-shared` (b0fa732)
+- Libffi updater script refresh (4f177f1)
+- Minor `std::get_if` simplification in crypto DH code (a811c34)
+- Test fixture adjustment to keep a finalization object alive through exit (c612f35)

src/posts/2026-06-25_oven-sh-bun.md

@@ -0,0 +1,32 @@
+---
+date: 2026-06-25
+repo: oven-sh/bun
+size: L
+title: "Bun hardens routers, patches, and markdown"
+excerpt: "Multiple crash fixes and correctness fixes landed, including a patch-applier guard, router panic fix, and a markdown UAF repair."
+commits: 7
+authors: [robobun, cirospaciari]
+commit_authors: {"5621c5d": robobun, "ed700c2": robobun, "de400b1": robobun, "237de94": robobun, "e112ac7": robobun, "d6a20b6": robobun}
+---
+
+### **Fix URLPath::parse panic on `?` and empty-decoding paths** (5621c5d)
+`FileSystemRouter.match()` could crash when handed a bare query string or an input that percent-decodes to nothing, because `URLPath::parse` sliced past the start of an empty/short buffer. The fix clamps the slice bounds and adds coverage for the remote-crash cases.
+
+### **Harden patch application against crafted panics** (e112ac7)
+`bun install` / `patchInternals.apply()` could panic on malformed patch input, including empty file-creation hunks and headers that claimed more deletions than the target file contained. The applier now treats empty hunks as empty files and uses saturating arithmetic for capacity bookkeeping so untrusted patches fail safely instead of crashing.
+
+### **Fix use-after-free in `Bun.markdown.react()` / `render()`** (d6a20b6)
+Reference-style link and image metadata could outlive the temporary span detail they borrowed from, leading to corrupted `href`/`title` data and ASAN-detectable use-after-free. The renderer now stores owned copies for span metadata before building React/render output.
+
+### **Report external crypto wrapper memory to GC** (de400b1)
+Several `node:crypto` wrapper classes were allocating OpenSSL contexts and buffers without telling JSC’s GC about the native memory they retained. This change wires up extra-memory accounting across the wrapper types, which should improve GC behavior under crypto-heavy workloads and reduce hidden native-memory growth.
+
+### **Fix `napi_is_arraybuffer` for `SharedArrayBuffer`** (237de94)
+Bun was returning `true` for `SharedArrayBuffer`, diverging from Node/V8 semantics. The N-API binding now explicitly excludes shared buffers, aligning addon behavior with Node and tightening the API contract.
+
+### **Remove stale `signal.is_dead()` assertion in blob piping** (ed700c2)
+A debug assertion in `pipe_readable_stream_to_blob` was tripping on a synchronous S3-stream failure path, even though the underlying state transition was valid. Removing the assertion prevents the crash; the new test documents the synchronous-close edge case.
+
+### **Other misc changes**
+- Removed the `.zig` porting-reference sources and updated related docs/hooks/tooling (1 commit).
+- Documentation, skill, and hook rename churn tied to the Rust-only cleanup.