digest: add issues for 2026-07-17

Author: github-actions[bot]

src/posts/2026-07-16_biomejs-biome.md

@@ -0,0 +1,35 @@
+---
+date: 2026-07-16
+repo: biomejs/biome
+size: L
+title: "Parser fixes and lint refactors land"
+excerpt: "Biome added Angular attribute parsing, fixed Vue and CSS formatting/parser bugs, and sped up several type-aware lint rules."
+commits: 9
+authors: [ematipico, dyc3, Socialpranker, denbezrukov, Netail, dfedoryshchev]
+commit_authors: {"cf263c4": dyc3, "89b6af4": ematipico, "e62f6b6": ematipico, "68c10e6": Socialpranker, "794ccd0": denbezrukov, "98a5f94": Netail, "48a4abb": ematipico}
+---
+
+### **Angular attributes are now parsed and formatted** (98a5f94)
+Biome now recognizes Angular-specific attributes like property bindings, event bindings, structural directives, template refs, and two-way bindings. This expands HTML parsing and formatter support for Angular templates, which should unlock correct handling across the parser, syntax, and formatter stack.
+
+### **Vue `:="props"` shorthand no longer crashes the parser** (68c10e6)
+The HTML/Vue parser now accepts argument-less `v-bind` shorthand and its longhand form instead of panicking while reporting a missing argument. Related analyzers were updated to treat this syntax consistently, so Vue attributes sort and lint correctly too.
+
+### **CSS comments now format correctly before `!important`** (794ccd0)
+Comment placement around declarations was adjusted so block comments between a value and `!important` stay attached to the declaration and render in the expected position. This fixes a visible formatter bug in both CSS and SCSS output.
+
+### **`noThenProperty` is faster and handles commented tokens better** (cf263c4)
+The lint rule was rewritten to use typed syntax tree traversal and token text helpers, improving performance by about 50%. It also now correctly catches `Object.fromEntries`, `Object.defineProperty`, and `Reflect.defineProperty` cases even when comments interrupt the tokens.
+
+### **Type-aware lint rules were ported to the newer inference APIs** (89b6af4)
+Several behavior-sensitive rules were refactored to use the newer inferred-type/stringification utilities and shared typed helpers. The change trims older type plumbing and should make these rules more consistent and maintainable, while preserving behavior through added shadowing and overload tests.
+
+### **Direct type-aware lint rules got the same inference cleanup** (48a4abb)
+More type-driven rules were migrated to the newer inferred-type APIs, with supporting module-graph and type-info changes. This is a broader internal refactor that also includes a small fix for `useArrayFind` recognizing bigint zero indexes.
+
+### **Type inference no longer drops data in cross-module overload cases** (e62f6b6)
+Biome fixed a regression where copying inferred type data could panic or lose information for imported functions with multiple call signatures. This matters for rules like `noFloatingPromises`, which now handle cross-module overload callbacks safely.
+
+### Other misc changes
+- Dependency/workflow cleanup: udeps checks were commented out until the tool stabilizes; changeset/docs-only updates.
+- Minor docs fix for `useIterableCallbackReturn`.

src/posts/2026-07-16_denoland-deno.md

@@ -0,0 +1,39 @@
+---
+date: 2026-07-16
+repo: denoland/deno
+size: L
+title: "Native check lands, plus key runtime fixes"
+excerpt: "Deno adds the native TypeScript compiler path for check and ships several meaningful fixes across errors, TLS, Node crypto, and N-API."
+commits: 19
+authors: [nathanwhit, bartlomieju, nathanwhitbot, mattiasrunge]
+commit_authors: {"7324701": nathanwhit, "426a216": bartlomieju, "6db846b": bartlomieju, "6f570cf": nathanwhit, "091b01c": bartlomieju, "c9b8dca": nathanwhitbot, "a253d1a": nathanwhit, "3aa600e": nathanwhit, "4d05e00": nathanwhit, "803a3c9": mattiasrunge, "e6a0143": nathanwhit, "ea35f49": nathanwhit, "7fcf79c": nathanwhit, "207d7ee": nathanwhit, "e3ec070": nathanwhit, "0e572f4": nathanwhit}
+---
+
+### **Native `deno check` starts using a pinned TypeScript compiler** (6db846b, 426a216)
+Deno now knows how to download a pinned native TypeScript compiler, run it, and map its diagnostics back into Deno’s error format. This is a major step in the `deno check` split: the compiler execution and diagnostic parsing are in place, with an env override for prebuilt binaries and path handling tuned for stable output.
+
+### **Error conversion is now bounded and cycle-safe** (6f570cf, e6a0143)
+The core error tree conversion was hardened against recursive and malformed exception graphs by preserving cycle tracking, capping depth and total nodes, and containing failures from tricky constructors/getters. This reduces the risk of runaway formatting work or pathological crashes when user code throws unusual errors.
+
+### **`deno x` and `deno add/remove` now respect minimum dependency age** (c9b8dca, 091b01c)
+`deno x` now forwards explicit config and minimum-dependency-age settings into its re-run path, so it no longer silently falls back to the default release-age policy. Separate flag support was added for `deno add/remove`, making the dependency-age policy consistent across these package-management flows.
+
+### **WebTransport certificate and datagram handling was tightened** (4d05e00, ea35f49, 7fcf79c)
+WebTransport now validates certificate `notBefore`/`notAfter` timing, handles failed datagram setup cleanly, and avoids a URL parsing panic when `URL.prototype.toString` is overridden. These fixes close correctness and safety gaps in connection setup and teardown.
+
+### **TLS SNI lookups no longer block each other** (207d7ee)
+Dynamic SNI resolution now runs independently so a slow certificate lookup doesn’t stall unrelated handshakes on the same listener. That improves latency for TLS servers that resolve keys asynchronously.
+
+### **N-API callback state is now scoped per invocation** (7324701)
+Callback metadata is no longer shared mutable state across invocations, which prevents nested re-entry from clobbering arguments seen by the outer call. This is an important correctness fix for native addons that synchronously call back into the same exported function.
+
+### **Node crypto gained raw ChaCha20 support** (803a3c9)
+`crypto.createCipheriv`/`createDecipheriv` now recognize `chacha20` alongside existing ChaCha20-Poly1305 support, backed by a Rust implementation and updated polyfill metadata. This expands compatibility with Node APIs that depend on the raw stream cipher.
+
+### **Desktop and HTTP behavior were corrected** (3aa600e, a253d1a, e3ec070, 0e572f4)
+Desktop binding wrappers survive lazy op upgrades, trust-proxy env handling no longer mutates process state, app names drop the runtime extension suffix, and HTTP/2 file responses stop reading after stream close. These are targeted runtime fixes that remove surprising side effects and resource leaks.
+
+### **Other misc changes**
+- Release tooling adjusted for semver ordering and re-stamping promoted binaries.
+- Promoted binaries now use standard executable permissions.
+- Small release/tooling and test updates.

src/posts/2026-07-16_denoland-std.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-16
+repo: denoland/std
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-16_jsr-io-jsr.md

@@ -0,0 +1,10 @@
+---
+date: 2026-07-16
+repo: jsr-io/jsr
+size: N
+title: "No changes"
+excerpt: ""
+commits: 0
+---
+
+

src/posts/2026-07-16_leanprover-lean4.md

@@ -0,0 +1,34 @@
+---
+date: 2026-07-16
+repo: leanprover/lean4
+size: L
+title: "Symmetry fixes and core linting land"
+excerpt: "Major Sym.simp and vcgen fixes landed alongside a new core-internal linter set and a few API cleanups."
+commits: 14
+authors: [ia0, leodemoura, TwoFX, wkrozowski, sgraf812, Garmelon, Kha]
+commit_authors: {"0c8d331": leodemoura, "9eeac71": sgraf812, "52edefc": TwoFX, "3d9b6b8": ia0, "a53ddb3": TwoFX, "acdf5fd": leodemoura}
+---
+
+### **Fix Sym.simp sharing when discharged proofs end up in the result** (0c8d331)
+`Theorem.rewrite` now restores maximal sharing only for discharged hypothesis proofs that are actually spliced into the rewritten RHS. This fixes a `SymM` invariant violation detected by `sym.debug` without paying the sharing cost on unrelated discharges.
+
+### **Improve Sym matcher/unifier support for offsets** (acdf5fd)
+`SymM` can now postpone certain quasi-offset constraints and recognize more arithmetic expressions as natural-number values/offsets. That should make matching/unification succeed in cases that previously got stuck on `t + k`-style patterns.
+
+### **Fix vcgen/mvcgen splitting for `match h : e`** (9eeac71)
+Annotated discriminants are no longer abstracted into the split motive when the alternatives bind equality hypotheses like `h : e = pattern`. This avoids ill-typed VC generation and fixes replay for `match h : ...` cases, including the reported `#12275` failure mode.
+
+### **Enable the coreInternal linter set in core** (52edefc)
+Lean now registers and enables the new `linter.coreInternal` set, which includes `internalModule` checks for declarations that leak out of internal core modules. The rollout required touching a number of builtin simprocs and expected server outputs to explicitly suppress or accommodate the new lint.
+
+### **Add a namespace-pollution linter for core** (a53ddb3)
+A new `internalModule` linter warns when internal modules declare non-internal names, helping keep Lean's own implementation details from accidentally becoming public API. The change adds the linter infrastructure, test coverage, and the new `linter.coreInternal` option gate.
+
+### **Remove the unused `s` parameter from `ExceptCpsT.runK`** (3d9b6b8)
+`runK` no longer takes an unused success-state argument, and the old parameter is now deprecated for compatibility during migration. This is a small public API cleanup that simplifies the CPS exception transformer interface.
+
+### Other misc changes
+- Release script updates and related maintenance tweaks.
+- Docstring/typo fixes in `Nat.mod`, `Exists`, `Except.map`, and `addBuiltinLinterSet`.
+- CMake 4.4 command-line variable handling update.
+- Stage0 and small internal housekeeping changes.

src/posts/2026-07-16_microsoft-typescript-go.md

@@ -0,0 +1,23 @@
+---
+date: 2026-07-16
+repo: microsoft/typescript-go
+size: L
+title: "Hover UX and crash fixes land"
+excerpt: "A new Visual Studio-style hover mode ships alongside two stability fixes for type expansion and signature help."
+commits: 3
+authors: [johnfav03, navya9singh]
+commit_authors: {"b8276f3": johnfav03, "165b58e": johnfav03, "3ff7910": navya9singh}
+---
+
+### **VS enhanced hover adds symbols, icons, and colored text** (3ff7910)
+The LSP hover path now emits a richer VS-specific payload for clients that advertise Visual Studio extensions, including symbol icons and classified/colorized text. This also adds fourslash coverage and baseline rendering support for the new `_vs_rawContent` shape so the richer output can be tested reliably.
+
+### **Fix stack overflow in `checkTypeExpandability()`** (b8276f3)
+A recursion guard was added when expanding types so self-referential type arguments no longer blow the stack during quick info generation. This fixes a fatal hover-time crash on cyclic generic shapes and keeps verbosity expansion terminating.
+
+### **Fix nil pointer dereference in signature help for recovered parameter types** (165b58e)
+The checker now defensively handles copied type nodes whose parent link is missing during signature-label serialization, avoiding a nil pointer dereference in error-recovered signatures. That makes signature help survive partially parsed code instead of crashing.
+
+### Other misc changes
+- Added regression fourslash tests and baselines for the two crash fixes.
+- Updated hover baseline plumbing for the new VSQuickInfo command.

src/posts/2026-07-16_nodejs-node.md

@@ -0,0 +1,30 @@
+---
+date: 2026-07-16
+repo: nodejs/node
+size: L
+title: "QUIC cert compression lands, streams and net polished"
+excerpt: "Node.js adds TLS certificate compression for QUIC, tightens stream iterator validation, and fixes several stream/fs edge cases."
+commits: 9
+authors: [trivikr, Y1D7NG, sxa, bjohansebas, mcollina, PickBas, Renegade334, guybedford]
+commit_authors: {"a27fe21": Y1D7NG, "cc8594a": bjohansebas, "cf882a7": mcollina, "874e96e": trivikr, "608112a": trivikr, "39ed68c": guybedford}
+---
+
+### **QUIC now supports TLS certificate compression** (cc8594a)
+Node.js can now enable RFC 8879 certificate compression via the new `certificateCompression` TLS option, including for QUIC sessions. The change can reduce handshake size and avoid an extra round trip, which is especially valuable under QUIC's anti-amplification limits.
+
+### **Stream iterators now validate `signal` and reject `throw()` properly** (874e96e, 608112a)
+The stream iterator APIs now validate `options.signal` across push, broadcast, classic, and fromWritable paths, instead of silently ignoring bad inputs. Separately, `iterator.throw()` now rejects with the supplied error rather than resolving `{ done: true }`, bringing the behavior in line with consumer cancellation semantics.
+
+### **`net.Socket` from `BoundSocket` now connects synchronously** (39ed68c)
+Connecting a socket built from an adopted `BoundSocket` to a numeric IP literal now issues `connect(2)` synchronously, so `localAddress` and `localPort` are available as soon as `connect()` returns. That makes the new `BoundSocket` path behave more predictably while still surfacing failures asynchronously.
+
+### **VFS read streams no longer race async iteration** (a27fe21)
+`VirtualReadStream` now uses `_construct()` to open the file and emit `open`/`ready`, fixing a race that could break `for await...of` consumption. The accompanying tests cover explicit file descriptors and pipeline/iteration flows.
+
+### **WHATWG writable backpressure update is cheaper** (cf882a7)
+Backpressure is now derived directly inside the update helper instead of being precomputed and passed around, and a couple of redundant assertions/helpers were removed. This trims overhead on hot write paths and improves write-loop and `pipe-to` throughput.
+
+### Other misc changes
+- Windows `fs.cp` symlink/EEXIST handling fixes (1 commit)
+- Merge script wording tweak for PR-URL errors
+- Temporal C API crate path extracted into a gyp variable

src/posts/2026-07-16_oven-sh-bun.md

@@ -0,0 +1,49 @@
+---
+date: 2026-07-16
+repo: oven-sh/bun
+size: L
+title: "TOML rewrite lands; cron and buffers hardened"
+excerpt: "Major parser/API additions plus fixes for cron overflow, fs mkdir on Windows, buffer limits, tty raw mode, and more."
+commits: 36
+authors: [robobun, cirospaciari, Jarred-Sumner, dylan-conway]
+commit_authors: {"3903978": robobun, "4951445": robobun, "7246266": robobun, "8215078": robobun, "dc5748f": robobun, "57e30a5": cirospaciari, "f6f22f1": cirospaciari, "e8404c1": robobun, "a85068c": robobun, "8c170f6": robobun, "2f5e810": robobun, "299cdaf": robobun, "8a68c60": robobun, "000407f": robobun, "7340e5d": robobun, "6ad467f": robobun, "aca54d5": dylan-conway, "0ecd508": robobun, "4bbe075": cirospaciari, "adbaf41": robobun, "57f349f": robobun, "2f4f45e": robobun, "fbe467c": robobun, "c4fad46": robobun, "075f56c": robobun, "36364f7": robobun, "10ff028": robobun, "3057da0": robobun, "d29b050": Jarred-Sumner, "d93b4cc": robobun, "a754790": cirospaciari, "f6f1523": robobun, "7c78335": robobun, "6173d64": robobun}
+---
+
+### **Bun.TOML is now a full v1.1.0 parser with stringify** (aca54d5)
+Bun replaces its old TOML implementation with a spec-exact v1.1.0 parser and adds `Bun.TOML.stringify()`. The new API supports the official conformance suite, broader input types, and clearer errors, which is a meaningful upgrade for config-heavy apps.
+
+### **Bun.cron.parse now rejects out-of-range `from` values safely** (dc5748f)
+`Bun.cron.parse()` now validates `from` against the ECMAScript Date range instead of only checking non-finite numbers, preventing a crash/abort path from extreme inputs. It also returns `null` when the next match would fall outside representable time instead of producing an invalid date.
+
+### **node:fs writev/readv now chunk at IOV_MAX like libuv** (e8404c1)
+Vectored I/O no longer fails as soon as the buffer array exceeds the platform iovec limit. Bun now batches writes and truncates reads to match libuv behavior, fixing compatibility for code that relies on large `readv`/`writev` calls.
+
+### **node:http2 fixes cross-session corked-frame bleed** (a85068c)
+Corked HTTP/2 frames are now kept per session instead of leaking between connections. This addresses a Windows CI backpressure regression and fixes a subtle transport-layer correctness issue.
+
+### **Buffer offsets/toString/write stop wrapping at 2^32** (36364f7)
+Buffer validation and string/write paths now carry `size_t` through instead of truncating to 32 bits. That fixes incorrect empty-string results and out-of-range behavior for extremely large buffers near 4 GiB.
+
+### **Tty raw mode is tracked per handle, not per process** (3057da0)
+`setRawMode()` now preserves state per `tty.ReadStream`, matching libuv’s per-handle behavior. This avoids one stream silently forcing another stream back to cooked mode and breaking interactive apps.
+
+### **Error.captureStackTrace now matches V8’s property semantics** (8215078)
+Captured `.stack` is installed as a non-enumerable property, including on plain objects. That brings Bun in line with Node/V8 and avoids surprising object serialization behavior.
+
+### **Mach-O compile templates are validated before growth** (8c170f6)
+The Mach-O packer now checks that the template’s `__BUN` segment is actually in-bounds before doing size arithmetic, and it rejects shrinking templates rather than panicking. That turns a crashy path in `--compile` into a proper error.
+
+### **node:http/https/http2 compatibility jumps again** (4bbe075)
+Bun syncs the upstream Node v26.3.0 HTTP suites and lands a large set of transport fixes across HTTP, HTTPS, and HTTP/2. Compatibility moves materially closer to Node’s behavior across teardown, TLS, and socket-handling edge cases.
+
+### Other misc changes
+- node:dgram suite/compat sync and UDP internals updates (57e30a5)
+- node:crypto suite sync and compatibility fixes (f6f22f1)
+- wrapAnsi/sliceAnsi formatting edge-case fixes (000407f, 299cdaf, 2f5e810)
+- fs.mkdir Windows read-only directory fix (3903978)
+- child_process stdin EPIPE handling cleanup (075f56c)
+- worker/timer/leak and race fixes; test timeout adjustments (c4fad46, d93b4cc, fbe467c)
+- parser/lexer test expectation and error-message fixes (57f349f, f6f1523, 7c78335, a754790, 6173d64)
+- terminal write/drain behavior fix and related typings (2f4f45e)
+- buffer signal/string-object assertion fixes (4951445)
+- misc build/dependency/test maintenance (0ecd508, d29b050, 7340e5d, 6ad467f, 10ff028, 8a68c60, adbaf41, 7246266)