digest: add issues for 2026-07-20

Author: github-actions[bot]

src/posts/2026-07-19_biomejs-biome.md

@@ -0,0 +1,17 @@
+---
+date: 2026-07-19
+repo: biomejs/biome
+size: M
+title: "Type inference fix strengthens promise lint"
+excerpt: "Biome improved tuple and generic inference for noMisusedPromises, plus two dependency bumps."
+commits: 3
+authors: [ematipico]
+commit_authors: {"4bf9b21": ematipico}
+---
+
+### **Promise callback inference now catches tuple-spread cases** (4bf9b21)
+The `noMisusedPromises` lint now reports Promise-returning callbacks in calls that use tuple spreads or tuple rest parameters, including generic and deeply nested tuples. It also handles constructor signatures from interface and object types, with a conservative fallback for recursive or overly nested tuple spreads so analysis terminates.
+
+### Other misc changes
+- Dependency bumps: `rustc-hash` to 2.1.3, `quote` to 1.0.47
+- Added/updated internal agent guidance docs and comments

src/posts/2026-07-19_denoland-deno.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-19
+repo: denoland/deno
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-19_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-19
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-19_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-19
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-19_leanprover-lean4.md

@@ -0,0 +1,24 @@
+---
+date: 2026-07-19
+repo: leanprover/lean4
+size: L
+title: "Grind gains homomorphism attrs"
+excerpt: "Lean4 adds `grind homo_pred`, validates `grind homo` rules, and ships a broad set of homomorphism lemmas for numeric types and `BitVec`/`Fin`."
+commits: 5
+authors: [leodemoura]
+commit_authors: {"5772089": leodemoura, "263276d": leodemoura, "2cf39b8": leodemoura}
+---
+
+### **Grind gets a new eager predicate mechanism** (2cf39b8)
+Lean now supports `[grind homo_pred]`, a separate attribute for eager fact injection keyed by a theorem’s head symbol. It complements `[grind homo]` by letting `grind` derive facts as soon as matching terms enter the E-graph, which is especially useful for range and relation lemmas.
+
+### **`[grind homo]` rules are now validated and enforced** (263276d)
+`grind` now rejects homomorphism theorems that would require conditional rewriting or otherwise can’t be instantiated from the left-hand side. The reset command also clears both homo-related extensions, tightening correctness and making attr state resets complete.
+
+### **Core `grind` gains a full homomorphism library** (5772089)
+A new `Init.Grind.Homo` module wires `grind` to homomorphism lemmas for `BitVec`, `Fin`, `Nat`, `Int`, fixed-width signed/unsigned integers, `USize`/`ISize`, and `List`. This broadens the tactic’s ability to normalize and reason across machine integers and embedded representations without manual bridging lemmas.
+
+### Other misc changes
+- Stage0 updates (2 commits)
+- Minor attr/parser plumbing for new `grind` modifiers
+- Tests added/expanded for homo and homo_pred attributes

src/posts/2026-07-19_microsoft-typescript-go.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-19
+repo: microsoft/typescript-go
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-19_nodejs-node.md

@@ -0,0 +1,22 @@
+---
+date: 2026-07-19
+repo: nodejs/node
+size: M
+title: "Node help gets styled; ALS leak fixed"
+excerpt: "Help output is now colorized when appropriate, timers stop retaining async stores, and WebCrypto adds a KT customization limit."
+commits: 4
+authors: [bitpshr, edsadr, mcollina, panva]
+commit_authors: {"c286592": bitpshr, "0bcc6ef": edsadr, "d25cde4": mcollina, "d90d9d5": panva}
+---
+
+### **Style `node --help` output with colors and emphasis** (0bcc6ef)
+`node --help` now uses `util.styleText` to highlight headings, option names, environment variables, and the docs URL when the output stream supports color. This makes the built-in help easier to scan without changing plain-text output for redirected pipes or `NO_COLOR`.
+
+### **Stop timers from retaining AsyncLocalStorage state** (d25cde4)
+Timers are now cleaned up after firing so they no longer hold on to an async store reference. That fixes a memory-retention issue in AsyncLocalStorage and is backed by a regression test for store leakage.
+
+### **Limit KangarooTwelve customization strings to 512 bytes** (d90d9d5)
+WebCrypto now enforces a 512-byte maximum for `KangarooTwelveParams.customization`, matching the intended OpenSSL limit. Requests over the limit fail with a clear `OperationError`, and the docs and tests were updated accordingly.
+
+### Other misc changes
+- Docs: note that `--env-file` does not apply to commands run via `--run` (c286592)

src/posts/2026-07-19_oven-sh-bun.md

@@ -0,0 +1,39 @@
+---
+date: 2026-07-19
+repo: oven-sh/bun
+size: L
+title: "Bun hardens GC and HTTP/socket lifetimes"
+excerpt: "Major fixes for refcount/GC lifetime bugs, HTTP double-delivery/UAFs, and several protocol/runtime correctness issues landed alongside CI and test harness work."
+commits: 31
+authors: [robobun]
+commit_authors: {"3821241": robobun, "99fc2f8": robobun, "37ed95f": robobun, "d8dadda": robobun, "f5ba155": robobun, "8d85482": robobun, "7bf888e": robobun}
+---
+
+### **Fix redis refcount over-release causing heap UAF** (99fc2f8)
+Refactors the Valkey/Redis client’s lifetime handling to use a scoped ref guard instead of manual ref/deref pairs, and adds a `forget()` helper to safely hand off ownership. This addresses a heap-use-after-free from refcount over-release and includes regression coverage around GC churn.
+
+### **Prevent HTTP final-result double delivery after failures** (3821241)
+Hardens `HTTPClient` so terminal failure states stay terminal even after internal state reset, preventing late events from dispatching a second final result into freed memory. It also tightens retry and timeout handling so failed clients don’t re-enter start/fail paths after their AsyncHTTP backing has already been released.
+
+### **Root TLS upgraded-duplex callbacks on the wrapper, not Strong handles** (37ed95f)
+Moves the TLS duplex origin and listener thunks off native `StrongOptional` roots and onto GC-traced wrapper slots, which better matches the object’s real lifetime. This reduces retention/leak risk and protects against re-entrant close paths that could otherwise run while the wrapper is becoming unreachable.
+
+### **Fix a UUIDv7 explicit-timestamp monotonicity bug** (8d85482)
+Separates clock-driven and caller-supplied UUIDv7 state so explicit timestamps are encoded verbatim without disturbing the default monotonic sequence. That makes `randomUUIDv7(timestamp)` deterministic and sortable across repeated calls while preserving the normal clock-path behavior.
+
+### **Keep HTTP/2 writable/close callbacks alive across JS re-entry** (d8dadda)
+Adds keepalives around `on_native_writable`, `on_native_close`, and frame dispatch paths so JS callbacks can destroy sessions without leaving the parser or socket dangling mid-loop. This is a concrete UAF fix for ASAN-fuzzed HTTP/2 paths.
+
+### **Fix Bun.mmap to honor the requested offset** (f5ba155)
+Changes `Bun.mmap` to return a view at the caller’s requested offset instead of silently page-aligning it. That restores correctness for code depending on exact mapping offsets and aligns behavior with the documented API.
+
+### **Preserve 404 behavior for falsey Bun.serve routes without a fetch handler** (7bf888e)
+Adjusts server routing so `false` routes correctly resolve to a 404 when no fetch handler exists. This fixes a public-facing routing edge case that could otherwise return the wrong response shape.
+
+### Other misc changes
+- CI retry / quarantine / shard-threshold tweaks, including a new musl lane and baked install caches
+- Test harness and reliability doc updates
+- Node API compatibility fixes: `events`, `http`, `http2`, `sqlite`, `path`, `fs`, `dotenv`, `util.parseArgs`
+- Shell I/O and FIFO redirect fixes
+- CSS tokenizer underflow fix and TLS/terminal retention cleanup
+- Misc build/docs/dependency/test-only changes

src/posts/2026-07-19_pnpm-pnpm.md

@@ -0,0 +1,33 @@
+---
+date: 2026-07-19
+repo: pnpm/pnpm
+size: L
+title: "Pacquet lands runtimes, GVS, and install parity"
+excerpt: "A dense day of pacquet feature work: runtime installs, global virtual store parity, repeat-install reconciliation, and several correctness fixes."
+commits: 22
+authors: [zkochan, kairosci, aqeelat]
+commit_authors: {"6f83d81": zkochan, "5e0788a": zkochan, "f8e0f3c": zkochan, "9843b4f": zkochan, "62ab9cb": zkochan, "00855bb": zkochan}
+---
+
+### **Runtime installation parity lands for Node, Deno, and Bun** (9843b4f)
+Pacquet now threads runtime failure policy and runtime-derived Node versions through config and install paths, and selects the right archive variant from `supportedArchitectures`. It also resolves `engines.runtime` on dependency manifests without cloning full manifests in the resolver hot path, while preserving explicit runtime deps when engine entries don’t match.
+
+### **Global virtual store behavior gets much closer to pnpm** (f8e0f3c)
+This ports the full global-virtual-store suite and adds a new `virtualStoreOnly` mode that populates the virtual store without linking, hoisting, or lifecycle scripts. It also tightens cleanup and slot-state handling so failed builds are discarded correctly, side-effects cache hits don’t reuse stale slot state, and `.modules.yaml` records the build-approval set used during install.
+
+### **Repeat installs now reconcile existing `node_modules`** (62ab9cb)
+Pacquet now prunes stale direct-dep links, bin shims, and hoisted aliases before linking on repeat installs, so deleted or hand-removed packages are re-evaluated instead of being silently left behind. This also wires the install pipeline to distinguish “install-only” flows more consistently across commands, reducing drift in add/remove/rebuild behavior.
+
+### **Pending builds are tracked and rebuildable** (6f83d81)
+`pnpm install --ignore-scripts` now records skipped builds in `.modules.yaml`, and `pnpm rebuild --pending` drains that queue instead of doing nothing. The change covers both dependency build scripts and workspace project scripts, so deferred work survives install/rebuild boundaries the way users expect.
+
+### **Proxy, auth, and registry URL handling are fixed** (5e0788a)
+Global and CLI proxy settings now flow through config and request setup with pnpm-compatible precedence, including bootstrap and optimistic install requests. The day also fixes auth command URL normalization for subpath registries so tokens and endpoints aren’t written against truncated paths.
+
+### **Large-install memory retention is reduced** (00855bb)
+Resolver metadata is now condensed before it stays cached, which prevents full packuments from lingering in memory across multiple resolution paths. That matters for large workspaces: the change targets the multi-GB heap growth that could OOM plain installs.
+
+### Other misc changes
+- Pacquet test-porting continued aggressively across git-hosted installs, progress reporting, optional dependencies, patchedDependencies, current lockfile, catalog, multi-importer, and lockfile-verification suites.
+- New coverage and fixes for `team`, deprecation events, patch verification, setup/self-update shim cleanup, and various repeat-install / hoist / architecture edge cases.
+- Release/version churn and lockfile updates (2 commits).

src/posts/2026-07-19_tc39-ecma262.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-19
+repo: tc39/ecma262
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+