digest: add issues for 2026-07-18

Author: github-actions[bot]

src/posts/2026-07-17_biomejs-biome.md

@@ -0,0 +1,24 @@
+---
+date: 2026-07-17
+repo: biomejs/biome
+size: M
+title: "Workspace sync fix lands with parser cleanup"
+excerpt: "Biome tightens workspace syncing and logging, fixes a namespace-import inference bug, and refactors token-text usage across analyzers."
+commits: 3
+authors: [dyc3, qzwxsaedc, ematipico]
+commit_authors: {"a2589f9": dyc3, "ceee4f4": qzwxsaedc, "72d309b": ematipico}
+---
+
+### **Workspace sync and logging hardened** (72d309b)
+Biome improved workspace database synchronization and cleaned up CLI logging to reduce noisy output. The logging filter now treats Salsa differently, only showing warn+ events there while preserving the existing behavior for Biome crates and dependencies.
+
+### **Fix inference for default namespace imports** (ceee4f4)
+A type-inference bug was fixed so members of default type-only namespace imports are resolved correctly. This removes a false positive in `noUnnecessaryConditions` for discriminated unions accessed through a default import, which could previously flag valid code.
+
+### **Discourage `Text` in favor of `TokenText`** (a2589f9)
+Biome added Clippy guardrails and updated several CSS/JS analyzers and formatters to avoid the old `Text` API where a token-level text API is preferred. This is a broad internal refactor that should make token handling more precise and reduce misuse in future changes.
+
+### Other misc changes
+- Workspace DB implementation refactor and related synchronization plumbing
+- Logging and lint test updates
+- Dependency lockfile and changeset updates

src/posts/2026-07-17_denoland-deno.md

@@ -0,0 +1,52 @@
+---
+date: 2026-07-17
+repo: denoland/deno
+size: L
+title: "Deno hardens pack, HTTP, and worker runtime"
+excerpt: "Major fixes land across tarball packing, Node HTTP/2 teardown, multipart parsing, and worker stack sizing, plus a native tsc default."
+commits: 13
+authors: [nathanwhit, nathanwhitbot, bartlomieju]
+commit_authors: {"7769013": nathanwhit, "c71e43a": nathanwhitbot, "10344fa": nathanwhit, "c38f394": nathanwhit, "14f8e5c": nathanwhit, "4294be5": nathanwhit, "369ddb7": nathanwhit, "0fd23e7": nathanwhit, "d859c22": nathanwhitbot, "50acfb1": nathanwhitbot, "f5ecd2e": bartlomieju, "7e036ea": bartlomieju, "fe70a4e": bartlomieju}
+---
+
+### **`deno check` now uses native tsc by default** (fe70a4e)
+`deno check` switches from the forked in-isolate TypeScript path to the native compiler flow, including generated tsconfig materialization, dependency type syncing, compiler download, and diagnostic remapping. This is a major behavior change for type-checking and will affect both performance and the shape of check-related output.
+
+### **Tarball packing now handles long paths safely** (c71e43a)
+`deno pack` no longer fails when a packaged file path exceeds the tar header name field, and it now uses GNU long-link entries to preserve reproducible output. The patch also closes a traversal hole by validating normalized tar paths before writing them, so long and short paths are treated consistently.
+
+### **Node HTTP/2 sessions are cleaned up correctly on destroy** (10344fa)
+The Node-compatible HTTP/2 layer now releases native session state and avoids calling back into already-destroyed session objects. That prevents retained allocations and unsafe late-path behavior after teardown, which should improve stability under shutdown and error-heavy workloads.
+
+### **Multipart form parsing is now bounded** (c38f394)
+Multipart part headers are capped at 16 KiB and 128 headers per part, preventing unbounded buffering and parsing work on malformed inputs. This hardens `FormData` parsing against resource exhaustion without changing normal uploads.
+
+### **Rejected dynamic imports stop before loader work** (7769013)
+When import-attribute validation rejects a dynamic import, Deno now stops immediately instead of continuing into loader scheduling. This keeps a rejected promise terminal and avoids wasted module-loading work after a known failure.
+
+### **WebTransport handshake buffering is capped** (0fd23e7)
+Handshake frame accumulation for WebTransport now has a 64 KiB ceiling, with shared bounded decoding across the relevant request/response paths. This prevents incomplete frames from growing unbounded in memory and closes an easy resource-exhaustion vector.
+
+### **Heap snapshots near the limit no longer leak empty files** (d859c22)
+The Node V8 heap-limit callback now writes snapshots straight to disk, fixes the reentrant limit logic that could keep raising the heap ceiling, and avoids leaving behind 0-byte `.heapsnapshot` files. This addresses a serious OOM-path bug that could otherwise let memory growth continue until the machine itself became unstable.
+
+### **Worker isolate threads now get the stack size Deno reports** (50acfb1)
+Worker threads now use the default 4 MiB stack that Deno reports in `resourceLimits.stackSizeMb` unless an explicit override is provided. That aligns behavior with Node expectations and prevents stack overflows in workers that previously ran on Rust's smaller default.
+
+### **V8 upgraded to 150.2.0** (7e036ea)
+Deno bumps its embedded V8, adapting the fast-call plumbing to V8's new requirement that `CFunction`/`CFunctionInfo`-backed data outlive the function template. This is a core runtime dependency upgrade with API-shape implications for the FFI fast path.
+
+### **CJS resolution now handles filesystem edge cases** (369ddb7)
+Node-style CommonJS export analysis now copes with absolute/root paths, non-UTF-8 filenames, and path suffix probing without crashing on unusual filesystem shapes. It also returns structured translation errors instead of failing abruptly when wrapper paths can't be represented cleanly.
+
+### **Windows subprocess pipe names are collision-resistant** (14f8e5c)
+Subprocess stdio pipes on Windows now use a fresh 128-bit random suffix each time instead of a predictable incrementing pattern. That lowers the risk of named-pipe collisions in high-concurrency scenarios.
+
+### **Native window handles now require FFI permission** (4294be5)
+Canvas initialization checks FFI permission before accepting native window handles, closing a permission bypass in a consumer path. The same commit also trims an unused request-handle accessor and adds regression coverage.
+
+### Other misc changes
+- `node:sqlite` backup/deserialize argument validation tightened (f5ecd2e)
+- Windows and worker stack-size/runtime configuration cleanup (50acfb1)
+- CI/cache tweaks for native tsc preडाउनलोड and test jobs (fe70a4e)
+- Dependency bumps and test expectation updates (7e036ea, 4294be5, 14f8e5c, 10344fa, c71e43a)

src/posts/2026-07-17_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-17
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-17_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-17
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-17_leanprover-lean4.md

@@ -0,0 +1,38 @@
+---
+date: 2026-07-17
+repo: leanprover/lean4
+size: L
+title: "Lean4 tightens vcgen, grind, and instance export"
+excerpt: "Major vcgen and grind fixes land alongside a security-ish olean flush fix and a public exposure bug fix for inferInstanceAs."
+commits: 13
+authors: [sgraf812, leodemoura, Kha, eric-wieser]
+commit_authors: {"b9c9129": Kha, "42de364": sgraf812, "51b8e4a": sgraf812, "7d38b3b": eric-wieser, "4f53dd7": leodemoura, "0313a67": leodemoura, "1b89aaf": leodemoura}
+---
+
+### **vcgen now handles conjunctive specs directly** (51b8e4a)
+`vcgen` can now apply specs with conjunctive preconditions without frame inference, keeping the full precondition available to the postcondition. The new `conjunctivePre` flag is detected syntactically at `@[spec]` registration, which removes a whole class of unnecessary framing obligations.
+
+### **grind can discharge `Sym.simp` side conditions** (1b89aaf)
+`Sym.simp` now accepts a `grind` discharger, letting conditional rewrite rules prove their own side conditions via `grind`. This makes `Sym.simp` more powerful in interactive and tactic-generated proof workflows, especially for hypotheses introduced under binders.
+
+### **vcgen equality specs stay generic across cache hits** (42de364)
+The backward-rule cache no longer over-specializes equality specs to the first program they match. This fixes failures where the same cached rule had to apply to multiple concrete programs in one run, such as recursive equations reused at different call sites.
+
+### **inferInstanceAs no longer exposes ill-typed wrapper aux defs** (b9c9129)
+Auxiliary wrapper definitions created during `inferInstanceAs` are now exposed only when their bodies remain well-typed in the exported environment. This fixes public instances for types whose bodies are private/non-exposed, preventing import-time ill-typed declarations.
+
+### **module save now notices flush failures** (7d38b3b)
+Saving compacted `.olean` files now checks for failures after closing the output stream, catching cases where disk-space or flush errors previously caused silent truncation. That’s a real correctness fix for module writes.
+
+### **`grind` filter syntax no longer swallows `match` bars** (4f53dd7)
+The parser now keeps the `|` in `grind => ... | ...` from being eaten by surrounding `match` or `first` syntax. This restores nested tactic parsing in common control-flow patterns.
+
+### **grind preserves theorems with multiple attributes correctly** (0313a67)
+`grind` theorem lookup now scans all theorem buckets so partially activated theorems can’t shadow others with the same symbol. This fixes custom attribute setups where a later theorem could accidentally hide an earlier usable one.
+
+### Other misc changes
+- Refactored lattice-op saturation in vcgen to use `Sym.simp` rewriting instead of a manual rewrite loop.
+- Dropped the structural-combinator fast path in vcgen spec application.
+- Generalized parser forbidden-token tracking to support multiple nested tokens.
+- Moved a CI job from RelWithAssert to Namespace runners.
+- Updated stage0 snapshots and generated artifacts (3 commits).

src/posts/2026-07-17_microsoft-typescript-go.md

@@ -0,0 +1,22 @@
+---
+date: 2026-07-17
+repo: microsoft/typescript-go
+size: M
+title: "Declaration emit fix and checker cleanup"
+excerpt: "Fixed a declaration-emit import specifier bug, reduced false diagnostics in checker paths, and updated baseline triage grouping."
+commits: 4
+authors: [weswigham, RyanCavanaugh]
+commit_authors: {"61aabc2": weswigham, "2d3f632": RyanCavanaugh, "26b9eb1": weswigham}
+---
+
+### **Fix declaration emit for extensionless import() specifiers** (2d3f632)
+TypeScript now falls back to the file’s default resolution mode when no syntax-implied mode is present, which fixes declaration emit under `allowImportingTsExtensions` + `nodenext`. The new baseline shows `import("mylib/lib/Box.js")` being emitted correctly for a relative `.ts` import chain.
+
+### **Reduce spurious checker diagnostics and reference resolution work** (26b9eb1)
+This commit adds more bailout cases in `markLinkedReferences` for identifiers inside grammar-error contexts like invalid computed property names, non-usable `extends` clauses, export assignments, and return statements. It also factors out a couple of helper checks in `checker.go`, which should prevent “Cannot find name” noise and make linked-reference handling more consistent.
+
+### **Fix TS2871 false positive in nullish-coalescing analysis** (da487ee)
+The nullishness semantics for `??` / `??=` now account for both the left and right paths instead of treating them like simple right-controlled operators. That addresses a false positive on expressions like `(a ? b ?? null : null) ?? 0` and `x ??= null`.
+
+### Other misc changes
+- Moved a few baselines from triaged to accepted (61aabc2)

src/posts/2026-07-17_nodejs-node.md

@@ -0,0 +1,29 @@
+---
+date: 2026-07-17
+repo: nodejs/node
+size: L
+title: "HTTP2 UAF fix, TLS docs, glob cache"
+excerpt: "A security-relevant HTTP/2 fix lands alongside glob pattern caching, VFS lchmod behavior, and new TLS socket docs."
+commits: 10
+authors: [beeequeue, pimterry, trivikr, HoonDongKang, Eusgor, aduh95, manNomi, sjungwon03]
+commit_authors: {"5520388": aduh95, "b8f81e9": beeequeue, "0a32b56": beeequeue, "1d4e86e": trivikr, "89df046": pimterry, "050fc39": HoonDongKang, "46de80d": Eusgor, "c1bd1c4": manNomi, "358adc8": sjungwon03, "ed2d7f4": pimterry}
+---
+
+### **http2: avoid use-after-free during rst_stream handling** (46de80d)
+Defers GOAWAY flushing while nghttp2 is receiving data, so RST_STREAM handling can’t race with `nghttp2_session_mem_recv()` and free state still in use. The fix also stops delivering read chunks if JS destroys the stream mid-callback, closing a heap-use-after-free path.
+
+### **fs: cache compiled glob matchers** (b8f81e9)
+`matchGlobPattern()` now reuses compiled matchers from a small cache instead of rebuilding minimatch state for every call. This should reduce overhead for repeated `path.matchesGlob()` checks in hot filesystem paths.
+
+### **vfs: make lchmod update symlink metadata** (1d4e86e)
+`lchmod()` now calls a non-following provider operation, so changing a symlink’s mode updates the link itself rather than the target file. The in-memory and real VFS providers were updated accordingly, and the test suite now verifies the expected symlink mode behavior.
+
+### **TLS docs now document `servername` and `alpnProtocol`** (ed2d7f4)
+The TLS docs now spell out the `tlsSocket.servername` and `tlsSocket.alpnProtocol` properties, including their `null`-before-handshake behavior and final values after negotiation. This clarifies what consumers can expect from SNI and ALPN inspection.
+
+### Other misc changes
+- Added `path.matchesGlob()` benchmarks for posix and win32 (0a32b56)
+- Kept finalization refs alive in a before-exit test fixture (89df046)
+- Fixed typos in contributing docs, comments, and source comments (050fc39, 358adc8)
+- Reused `assignFunctionName` in DNS/inspector internals (5520388)
+- Preserved QUIC session stats after close; added a small test update (c1bd1c4)

src/posts/2026-07-17_oven-sh-bun.md

@@ -0,0 +1,44 @@
+---
+date: 2026-07-17
+repo: oven-sh/bun
+size: L
+title: "SQLite lands, HTTP and parser fixes follow"
+excerpt: "Big day: Bun ships node:sqlite, fixes several HTTP edge cases, hardens Postgres parsing, and patches runtime leaks and hangs."
+commits: 27
+authors: [robobun, cirospaciari, Jarred-Sumner, dylan-conway]
+commit_authors: {"3219883": robobun, "8cac538": robobun, "1fbfe1d": robobun, "39c70a3": robobun, "12fd4f8": robobun, "b5f2d0a": robobun, "2acc042": robobun, "dd21594": robobun, "a215285": cirospaciari, "1b2bb4e": cirospaciari, "6618e7f": dylan-conway, "ea81736": dylan-conway, "6352b79": robobun, "73411ad": robobun, "78aa080": robobun, "bf9927f": robobun, "3655b03": robobun, "e835899": robobun, "3eaadbe": Jarred-Sumner, "8adb8de": robobun, "9d9fe3b": robobun, "8df2aa5": cirospaciari, "1d8b514": Jarred-Sumner}
+---
+
+### **node:sqlite is now fully implemented** (8df2aa5)
+Bun adds the `node:sqlite` module and wires it into the build, shutdown path, and compat docs. The implementation brings the Node v26.3.0 test suite along with native backup/session-related APIs and macOS runtime gating, making SQLite a first-class Node compatibility surface.
+
+### **Postgres row parsing now rejects malformed message overruns** (6352b79)
+`DataRow`, `RowDescription`, and `ParameterDescription` decoding now bounds every read by the enclosing message length instead of treating overruns as a recoverable short read. This closes a protocol bug that could stall queries indefinitely or misparse later wire bytes.
+
+### **HTTP and S3 close-delimited responses keep their metadata intact** (3655b03, 8adb8de)
+The HTTP client now treats close-delimited responses more carefully, avoiding progress callbacks that expose partial bodies before terminal metadata arrives. The S3 response path also preserves response headers across later EOF callbacks, fixing a crashy class of responses without `Content-Length` or `Transfer-Encoding`.
+
+### **HTTP/1.0 no longer gets broken chunked responses** (9d9fe3b)
+When `Content-Length` is removed, Bun now falls back to close-delimited responses for HTTP/1.0 clients instead of advertising chunked encoding it cannot actually frame. That fixes a real interoperability bug with proxies like nginx.
+
+### **`node:test` gets real `mock` access on `TestContext`** (1b2bb4e)
+The test runner’s `TestContext.mock` now returns the shared mock tracker instead of throwing, unlocking more upstream Node test coverage. This is part of the larger push to match Node’s in-process test API.
+
+### Other misc changes
+- TLS half-close handling and TCP FIN behavior in `usockets` (8cac538)
+- Human-readable `bunfig` type mismatch errors (1fbfe1d)
+- `sliceAnsi` ellipsis fallback fix for zero-width-only ranges (12fd4f8)
+- macOS ASAN dyld shim compatibility fix (b5f2d0a)
+- Threading `WaitGroup` race fix on shutdown (2acc042)
+- GC leak fix for `http.ClientRequest` once-wrappers (dd21594)
+- Test runner log grouping improvement (6618e7f)
+- macOS `recvmsg_x`/`sendmsg_x` version gate tightened (ea81736)
+- macOS DNS `FilePoll` slot leak fix (c9d3c6e)
+- Chunk-extension size cap enforced uniformly and related parser cleanup (39c70a3)
+- Multipart form-data parsing compatibility fix (bf9927f)
+- JSX tsconfig automatic-runtime selection fix (e835899)
+- Worker stdout/stderr hang fix when streams are never consumed (3219883)
+- JSCTaskScheduler deferred-work cleanup fix (73411ad)
+- usockets allocator routing under non-ASAN builds (78aa080)
+- `node:http` compatibility fix for malformed chunked responses on HTTP/1.0 (9d9fe3b)
+- Node compatibility test coverage expansion and assorted doc/review updates (a215285, 3eaadbe, 1d8b514)