digest: add issues for 2026-06-06

Author: github-actions[bot]

src/posts/2026-06-05_biomejs-biome.md

@@ -0,0 +1,30 @@
+---
+date: 2026-06-05
+repo: biomejs/biome
+size: L
+title: "Biome promotes 73 rules and fixes Vue/SCSS linting"
+excerpt: "Major rule promotion lands alongside Vue lint fixes and a SCSS formatter spacing overhaul."
+commits: 5
+authors: [dyc3, ematipico, Netail, denbezrukov]
+commit_authors: {"6642895": ematipico, "a4a294c": dyc3, "72ccf3b": dyc3, "9a5855e": Netail, "03274b9": denbezrukov}
+---
+
+### **Rule promotion v2.5 brings 73 nursery rules stable** (6642895)
+Biome moved 73 nursery rules into stable groups, including several renames such as `noFloatingClasses` → `noUnusedInstantiation`, `useFind` → `useArrayFind`, and `useSpread` → `useSpreadOverApply`. This reshapes rule availability and defaults across the CLI and config surface, so it’s a significant release for users upgrading lint presets or rule names.
+
+### **Added `noRestrictedDependencies` for banned package usage** (9a5855e)
+A new nursery rule now flags restricted imports and `package.json` dependency entries using e18e’s module replacement data. That gives teams a way to steer away from deprecated or suboptimal packages directly in Biome linting.
+
+### **`useVueHyphenatedAttributes` now stays inside Vue, skips SVG** (a4a294c)
+The rule was tightened so it only reports in Vue files and ignores SVG elements and descendants. This avoids false positives on real SVG markup while keeping the Vue-specific attribute style check intact.
+
+### **`useVueConsistentVBindStyle` no longer flags argument-less `v-bind`** (72ccf3b)
+Biome fixed a false positive where shorthand-style guidance was being applied to `v-bind` directives without arguments. Those directives can’t be converted to shorthand, so the rule now leaves them alone.
+
+### **SCSS formatter now normalizes binary-expression spacing** (03274b9)
+The SCSS formatter was refactored to emit more consistent `left <op> right` spacing, replacing a lot of operator-specific special handling. This changes formatting output for several SCSS cases and reduces weird source-tight edge cases.
+
+### Other misc changes
+- Rule migration support updated for `e18e/ban-dependencies`
+- Configuration/generated rule tables refreshed for new and promoted rules
+- Minor test and snapshot updates across HTML, CSS, CLI, and lint specs

src/posts/2026-06-05_denoland-deno.md

@@ -0,0 +1,35 @@
+---
+date: 2026-06-05
+repo: denoland/deno
+size: L
+title: "Deno adds HTTP/1, crypto, and LSP upgrades"
+excerpt: "Major runtime work landed: a Deno-owned HTTP/1.1 serve path, crypto/WebCrypto modern-algorithms support, and substantial LSP improvements."
+commits: 79
+authors: [divybot, bartlomieju, crowlbot, nathanwhitbot, nathanwhit, crowlKats, igorbdl, fallintoplace, magurotuna]
+commit_authors: {"3859156": bartlomieju, "6475783": nathanwhitbot, "9656486": divybot, "2a930df": bartlomieju, "1472e69": divybot, "c0dfd6a": divybot, "b04ec7f": divybot, "92a7dae": nathanwhit, "b7cf076": divybot, "6f16d40": divybot, "42d7ef0": divybot, "987d01d": divybot, "1d51877": divybot, "599007c": divybot, "4a4983b": divybot, "438666d": divybot, "2aa45eb": divybot, "d8991fc": divybot, "dc2d779": bartlomieju, "3a9c991": divybot, "93d6277": divybot, "281be3e": divybot, "82cc57b": fallintoplace, "82514b5": divybot, "bb80cf8": bartlomieju, "9d8e531": divybot, "9d177ea": divybot, "7fc6ca5": divybot, "f93c548": divybot, "1ded28f": divybot, "7b251d9": divybot, "f9078c9": divybot, "4e53408": divybot, "fec485c": divybot, "0816e0d": magurotuna, "60b484b": divybot, "7e29bed": divybot, "4f54897": divybot}
+---
+
+### **Deno takes ownership of HTTP/1.1 serving** (92a7dae)
+Deno now routes `Deno.serve()` HTTP/1 traffic through a new runtime-owned `libs/http_h1` path by default, keeping Hyper for HTTP/2. The change is aimed at tighter integration and lower overhead, with broad plumbing updates across fetch, HTTP handling, and response/request behavior.
+
+### **WebCrypto gets a big modern-algorithms expansion** (c0dfd6a, b04ec7f, d8991fc, 6f16d40, 987d01d, 93d6277, 3a9c991, f93c548)
+Crypto support was extended in several directions: `SubtleCrypto.supports()` landed, ML-KEM/ML-DSA gained missing JWK and seed/raw-public/raw-seed handling, ChaCha20-Poly1305 was brought in line with the modern spec, and key storage moved into Rust-backed handles. This is a major compatibility and API surface update for WebCrypto users, especially for newer post-quantum algorithms.
+
+### **Fetch behavior and decompression were overhauled** (6475783, b7cf076, fec485c, 82cc57b, 0816e0d)
+The fetch stack dropped `tower-http` decompression in favor of a local service, added bad-port blocking per the Fetch Standard, fixed empty gzip/br responses, tightened multipart parsing, and corrected forwarding of partially buffered request bodies. These changes improve standards compliance and remove a class of fetch/runtime failures.
+
+### **The LSP got significantly more capable and faster** (82514b5, 4a4983b, 2aa45eb, 60b484b, 7e29bed, 7fc6ca5, 1d51877, 438666d, 281be3e, c16d80b)
+The language server now diagnoses import maps, surfaces remap info in hovers, offers test ignore/only code actions, reports JSR fast-check diagnostics, caches lint/doc diagnostics per document, and fixes stale on-disk document handling. It also improves import-map remap suggestions and cache graph behavior, making editor feedback more accurate and responsive.
+
+### **Compile and bundle workflows gained important fixes and features** (7b251d9, 599007c, 1472e69, 9d177ea, 1ded28f, dc2d779)
+`deno compile` now supports watch mode and can prune unused npm packages from embedded snapshots, while bundling now properly instantiates `.wasm` imports and handles HTML sourcemap naming correctly. The compiler also fixes `fs.fstatSync` on virtual files and avoids panicking when esbuild is busy or unavailable.
+
+### **Node/runtime compatibility improved in several edge cases** (2a930df, 9656486, 4f54897, 9d8e531, f9078c9, 3859156, bb80cf8, 4e53408, 42d7ef0)
+Several compatibility fixes landed for Node-facing APIs: HTTP servers now notify the control socket when serving starts, workers stay alive with refed `MessagePort`s, TCP keepalive works again on native TCPWrap, scoped IPv6 multicast interfaces are accepted, and a few Node inspection/feature-probe behaviors were aligned. There are also fixes for DNS lookup, websocket auth headers, and Windows process-kill semantics.
+
+### **Other misc changes**
+- Cron parser dependency removed in favor of an internal implementation.
+- `deno x` gained `--ignore-scripts` support.
+- `deno clean --dry-run` now works without `--except`.
+- `--env-file` support expanded to more dependency/registry subcommands.
+- Various smaller fixes: dotenv underscores, special-file permission guards, coverage exclusions, watcher updates, and docs/test-only changes.

src/posts/2026-06-05_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-06-05
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-06-05_jsr-io-jsr.md

@@ -0,0 +1,37 @@
+---
+date: 2026-06-05
+repo: jsr-io/jsr
+size: L
+title: "API split, OTLP export, and key fixes"
+excerpt: "Big infrastructure refactor plus telemetry changes, with several frontend accessibility and usability fixes and a few important backend corrections."
+commits: 16
+authors: [crowlbot, crowlKats]
+commit_authors: {"807cfe3": crowlbot, "a757423": crowlbot, "a7fed01": crowlbot, "f15d566": crowlbot, "4341e3d": crowlbot, "d947d07": crowlKats, "9d89e55": crowlKats}
+---
+
+### **Scaffold workers-rs API worker** (a757423)
+Adds a new `workers-rs/` Cloudflare Worker skeleton for `api.jsr.io`, including a `/health` endpoint and a 501 catch-all. This is the first concrete step in splitting the API between a wasm edge worker and the existing compute service.
+
+### **Refactor shared API types into `jsr_types`** (a7fed01)
+Extracts shared IDs and models out of `api/` into a new wasm-safe `jsr_types` crate so both the native API and the new worker can share one source of truth. The Docker build and workspace setup were updated to support the new crate without pulling native dependencies into the worker path.
+
+### **Switch traces export to OTLP/HTTP** (9d89e55)
+Replaces the API's tracing backend from OTLP/gRPC and Cloud Trace to OTLP/HTTP via `reqwest`, aligning with the managed Grafana Cloud OTLP gateway. Config and Terraform were updated to pass OTLP headers and deployment metadata through to staging and production.
+
+### **Enable native Cloudflare observability export** (d947d07)
+Turns on Cloudflare Workers Observability export for logs and traces on the frontend and load balancer, routing them to configured destinations instead of persisting invocation logs locally. This is a meaningful observability change for the edge runtime.
+
+### **Fix provenance DSSE payload decoding** (f15d566)
+The provenance verifier now accepts URL-safe base64 payloads as well as standard base64, which fixes failures like `Invalid symbol 45` for some clients. That unblocks provenance submission for packages whose DSSE envelopes use the `-`/`_` alphabet.
+
+### **Fix npm tarball file permissions** (807cfe3)
+npm-compat tarballs now emit files with mode `0o644` instead of `0o777`. This prevents installed package files from incorrectly inheriting executable bits, which could break downstream tooling and packaging workflows.
+
+### **Fix README root-relative links** (4341e3d)
+Root-relative links in rendered READMEs now resolve against the repository root instead of being left to 404 on `jsr.io`. This matches GitHub/npm behavior and fixes broken links like `/LICENSE` and `/docs/...`.
+
+### **Other misc changes**
+- Frontend accessibility fixes: decorative service logos got empty alt text, the nav overflow button got an accessible name, and diff version selectors got labels/ARIA.
+- Frontend UX fixes: tooltip stacking order improved; package descriptions now wrap long unbroken strings on mobile; usage selector no longer crashes on unsupported saved preferences.
+- CI/Terraform/build maintenance: docker image build and image existence checks tweaked, frontend Cloud Run removed, and the new worker CI/build scaffolding added.
+- Minor doc/comment and internal cleanup across auth/tracing/config files.

src/posts/2026-06-05_microsoft-typescript-go.md

@@ -0,0 +1,23 @@
+---
+date: 2026-06-05
+repo: microsoft/typescript-go
+size: M
+title: "WebStorm APIs, go-to-impl fix, comment preservation"
+excerpt: "Adds native-preview APIs for WebStorm, fixes go-to-implementation on typed object literals, and preserves param comments in generated d.ts."
+commits: 3
+authors: [navya9singh, piotrtomiak, Andarist]
+commit_authors: {"1f955e9": navya9singh, "bfc3663": piotrtomiak, "23d1c94": Andarist}
+---
+
+**WebStorm integration gets missing native-preview APIs** (bfc3663)
+The native-preview API surface was expanded with new async/sync checker and type hooks, plus matching Go session/proto plumbing. This unblocks WebStorm integration by exposing type assignability and richer type metadata such as fresh/regular types, intrinsic names, alias symbols, and related object fields.
+
+**Go to Implementation now finds typed object literal implementations** (1f955e9)
+A reference-tracking condition was corrected so implementation candidates aren’t skipped when the containing type has already been seen. The update adds coverage for object literals typed as interfaces and broadens the baseline expectations for interface/namespace go-to-implementation results.
+
+**Declaration emit preserves original parameter comments** (23d1c94)
+Pseudo type node generation now carries over comment ranges from original parameter declarations when `removeComments: false` is in effect. That keeps inline JSDoc parameter comments in generated `.d.ts` output instead of dropping them.
+
+### Other misc changes
+- Added/updated fourslash and baseline tests for go-to-implementation and code lenses.
+- Dependency/test baseline housekeeping around submodule accepted outputs.

src/posts/2026-06-05_nodejs-node.md

@@ -0,0 +1,27 @@
+---
+date: 2026-06-05
+repo: nodejs/node
+size: L
+title: "Node fixes addon unload, UTF-8 length, and HTTP idle"
+excerpt: "A security-stability day: fixes a worker addon unload crash, speeds Buffer.byteLength on large strings, and closes idle pre-request sockets correctly."
+commits: 14
+authors: [mohd-akram, addaleax, ndossche, mertcanaltin, semimikoh]
+commit_authors: {"be7ea27": mohd-akram, "215027c": addaleax, "25ffc1a": ndossche, "4035c57": mertcanaltin, "d3a822a": semimikoh}
+---
+
+### **Worker-safe ObjectWrap cleanup prevents addon unload crashes** (215027c)
+`node::ObjectWrap` now registers environment cleanup hooks so legacy addons can be torn down safely in Worker threads and other embedder-controlled Node instances. This fixes a crash where weak callbacks could run after an addon had already been unloaded.
+
+### **Add regression coverage for ObjectWrap in Workers** (be7ea27)
+A new addon test reproduces the unload-after-Worker scenario and verifies the fix under GC-triggered teardown. This locks in the crash prevention for the legacy `ObjectWrap` path.
+
+### **Buffer.byteLength gets a SIMD fast path for large UTF-16 strings** (4035c57)
+`Buffer.byteLength(..., 'utf8')` now uses simdutf for sufficiently large two-byte strings, while keeping V8's path for small or one-byte inputs. The change also adds tests covering lone surrogates and large mixed inputs to ensure byte counts still match `Buffer.from` semantics.
+
+### **closeIdleConnections now catches pre-request sockets** (d3a822a)
+HTTP idle-connection cleanup now tracks sockets that connected but had not yet sent request data, so `server.closeIdleConnections()` can close them too. This fixes a gap that could leave idle pre-request connections hanging open.
+
+### Other misc changes
+- SQLite changeset callback lifetime fix (`25ffc1a`)
+- GitHub Actions dependency bumps and workflow refreshes (6 commits)
+- ESLint toolchain dependency group updates (`26f6c76`)

src/posts/2026-06-05_oven-sh-bun.md

@@ -0,0 +1,44 @@
+---
+date: 2026-06-05
+repo: oven-sh/bun
+size: L
+title: "GC fixes, resolver hardening, and CI guardrails"
+excerpt: "A heavy day of memory-safety fixes, stream/cache correctness, and test infrastructure hardening across Bun’s core runtime."
+commits: 18
+authors: [Jarred-Sumner, robobun, alii, dylan-conway]
+commit_authors: {"6038601": Jarred-Sumner, "a7839df": alii, "08226e2": Jarred-Sumner, "d155a2c": robobun, "a2eaf90": dylan-conway, "82808d4": alii, "a1dd647": Jarred-Sumner, "f500993": Jarred-Sumner, "7ab24e4": robobun, "bf79fe7": Jarred-Sumner, "55f6c89": Jarred-Sumner, "74c709d": robobun, "3360a9e": Jarred-Sumner, "3d125dc": Jarred-Sumner, "b56491b": Jarred-Sumner, "91270aa": robobun, "ef89527": robobun}
+---
+
+### **Bun closes several GC and lifetime holes** (7ab24e4, 3360a9e, 3d125dc, 55f6c89, a1dd647)
+Multiple core subsystems were tightened to avoid use-after-free, aliasing, and lifetime bugs: aggregate-error construction now keeps JS wrappers on the stack during GC-sensitive paths, CSS printing threads real lifetimes instead of erasing them, FFI drops a write-only field with clearer rooting rules, YAML removes raw parser back-pointers, and resolver slot pointers are now derived from the singleton with provenance-safe helpers.
+
+### **ReadableStream locking and cancelation are fixed** (d155a2c)
+`ReadableStream::isLocked` was effectively broken and returned `false` for every stream; the fix aligns native checks with the JS builtins’ actual `$reader`/sentinel behavior. It also avoids mis-routing cancelation for direct streams and marks native cancel promises handled to prevent unhandled rejection noise.
+
+### **Test isolation now cleans up leaked handles and timers** (ef89527)
+`bun test --isolate` now proactively closes leaked watchers/servers and cancels stale timers before swapping globals, so one file’s leftovers don’t pin the next file’s entire module graph. The same change adds a test-only hook to inspect isolated module cache state, improving coverage for the isolation machinery.
+
+### **Bundler output dirs now own their file descriptors** (f500993)
+The bundler’s output-dir handle is converted from a raw duplicated FD into an owning `bun_sys::Dir`, so the descriptor is reliably closed instead of leaking through worker clones and downstream result structs. This is a real resource-management fix for long-running build paths.
+
+### **fs.watch now stores its JS wrapper weakly** (08226e2)
+`FSWatcher` no longer keeps a bare self-reference that could pin the wrapper forever; it now uses `JsRef` with weak semantics and helper accessors. That matches the watcher’s actual liveness model and fixes a GC/rooting hazard around open/closed watcher lifecycle.
+
+### **Zlib GC accounting no longer reads mutable stream state on the marking thread** (74c709d)
+`NativeBrotli` and `NativeZstd` now cache their estimated external size at construction so `estimated_size` can run safely during concurrent GC marking without touching `JsCell`-backed stream state. This removes a thread-safety violation in GC memory accounting.
+
+### **CI now sanity-checks platform tags before tests run** (a7839df)
+Buildkite smoke steps now declare their expected OS/arch/ABI/distro/release, and the runner aborts early if the agent doesn’t match. That prevents entire shards from wasting time on misrouted jobs and makes platform mismatches fail fast.
+
+### **Base64 crash-path encoding no longer overflows on i32::MIN** (91270aa)
+The crash handler’s VLQ encoding path now avoids negating `i32::MIN`, which had been able to trigger a nested panic during crash reporting in debug builds. This hardens Bun’s panic reporting path so the reporter itself is less likely to abort.
+
+### **Bundler and CSS correctness fixes land across minify and grid parsing** (b56491b, 6038601, 3360a9e)
+The minifier reuses parser-owned scratch storage instead of allocating per call, and grid-template-areas now correctly parses `.` null-cell tokens, including runs of dots. CSS module printing also got a safer lifetime model, which matters for emitted chunk generation.
+
+### Other misc changes
+- Intel SDE is baked into the Windows verify-baseline image to avoid flaky job-time downloads (a2eaf90)
+- SQL test now uses `container.host` for remote Docker compatibility (82808d4)
+- Comptime string map refactor replaces workspace `phf` usage (bf79fe7)
+- `bun test --isolate` and various runtime paths got additional cleanup and test coverage (ef89527, 7ab24e4, 74c709d)
+- Resolver, YAML, CSS, FFI, bundler, and parser internal refactors/supporting tests (a1dd647, 55f6c89, 3360a9e, 3d125dc, f500993, b56491b, 6038601)

src/posts/2026-06-05_pnpm-pnpm.md

@@ -0,0 +1,24 @@
+---
+date: 2026-06-05
+repo: pnpm/pnpm
+size: L
+title: "pnpm lockfile bytes now match CLI output"
+excerpt: "Major lockfile serialization work lands alongside pnpr auth and uplink credential forwarding; release and dependency bumps round out the day."
+commits: 6
+authors: [zkochan, juanpicado]
+commit_authors: {"50cb7af": zkochan, "ae212c8": juanpicado, "70554b8": zkochan}
+---
+
+### **Lockfile writer now matches pnpm byte-for-byte** (50cb7af)
+`pnpm-lock.yaml` is now emitted with bytes identical to pnpm’s own writer, via a port of the lockfile-specific YAML dumper behavior. This matters for deterministic diffs and compatibility with tooling that compares lockfiles verbatim, not just semantically.
+
+### **pnpr can forward auth and custom headers to upstream registries** (ae212c8)
+pnpr now attaches per-uplink `Authorization` plus operator-supplied custom headers on every packument and tarball request. That unlocks private upstreams such as CodeArtifact, GitHub Packages, and authed Verdaccio/npm Enterprise registries that previously could fail with 401/403.
+
+### **pnpr auth storage becomes backend-selectable** (70554b8)
+Auth records are refactored behind config-selected async backends, including a networked SQLite/libsql option for shared deployments. This is a major step toward stateless, horizontally scaled pnpr replicas by moving user/token state out of local-only storage.
+
+### Other misc changes
+- Release prep for 11.5.2 and changelog cleanup.
+- Dependency bumps in `packageManager` and GitHub Actions workflows.
+- Snapshot/test updates and small lockfile/internal tweaks.