[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	pinDigest	→ d23441a
actions/setup-node	action	pinDigest	→ 2499707
deno	uses-with	minor	v2.x → 2.9.8
oven-sh/setup-bun	action	pinDigest	→ 0c5077e

---

Release Notes

denoland/deno (deno)

v2.9.8

Compare Source

2.9.8 / 2026.10.21

• fix(compile): check read permission for dynamically imported local files
  (#​36925)
• fix(completions): complete script paths for bare deno run in zsh (#​36976)
• fix(core): keep op contexts alive until the isolate is disposed (#​37026)
• fix(coverage): skip the V8 code cache while collecting coverage (#​36901)
• fix(ext/fetch): bump hyper-util to 0.1.21 and hyper to 1.11.1 to cancel idle
  interval when pool empties (#​36968)
• fix(ext/napi): check napi_create_dataview bounds for overflow (#​36962)
• fix(ext/napi): ignore the callback return value while an exception is pending
  (#​36942)
• fix(ext/node): align X.509v1 certificate handling with OpenSSL (#​36933)
• fix(ext/node): mock.reset() restores mock.method() implementations (#​36886)
• fix(ext/node): support assert message functions and format arguments (#​36944)
• fix(npm): validate package link names (#​37047)
• fix(tls): distrust compromised eMudhra certificate authorities (#​37046)
• fix: bump rand 0.9.x to patched version

v2.9.7

Compare Source

2.9.7 / 2026.09.16

• fix(audit): honor configured CA stores (#​36728)
• fix(cache): make HTTP authority paths unambiguous (#​36356)
• fix(cli): accept all valid sys permission descriptors (#​36753)
• fix(cli): don't duplicate passthrough args for deno deploy/sandbox (#​36722)
• fix(cli): generate valid bash completions (#​36736)
• fix(cli): preserve double dash before the entrypoint (#​36835)
• fix(cli): restore optional-value semantics for deno bundle --sourcemap
  (#​36723)
• fix(completions): keep the dash on short flags in zsh completions (#​36720)
• fix(desktop): complete deferred window close and fix NAPI symbol export on
  Linux (#​36718)
• fix(ext/http): extract traceparent from Deno.serve regardless of header name
  case (#​36840)
• fix(ext/node): allow repeated child process signals (#​36644)
• fix(ext/node): check resolved IP against net deny list in tcp_wrap bind
  (#​36482)
• fix(ext/node): don't panic on prime sizes below 2 bits (#​36400)
• fix(ext/node): improve node:dns error codes and lookupService/setLocalAddress
  compat (#​36552)
• fix(ext/node): normalize resourceUsage maxRSS on macOS (#​36784)
• fix(install): validate lockfile tarball registry paths (#​36473)
• fix(lsp): resolve the newest prerelease of jsr packages that have no stable
  release (#​36655)
• fix(net): check permissions for multicast membership (#​36529)
• fix(node): align IncomingMessage header map prototypes (#​36438)
• fix(node): preserve AsyncLocalStorage exit context (#​36464)
• fix(npm): correct the pnpm lockfile import against real-world lockfiles
  (#​36727)
• fix(npm): validate lockfile tarball origins (#​36430)
• fix(permissions): fold unix socket paths for case-insensitive filesystems
  (#​36553)
• fix(permissions): parse unix: net rules as POSIX paths (#​36785)
• fix(process): clear supplementary groups before changing identity (#​36433)
• fix(sqlite): refuse symlink database paths (#​36357)
• fix(transpile): don't report diagnostics from bundled assets in declaration
  emit (#​36716)
• fix(web): avoid flushing compression streams on every write (#​36744)
• fix: add missing property desktop.app.identifier (#​36774)
• fix: hash source contents for V8 code cache (#​36743)
• fix: point JSON schema $id values at the maintained GitHub raw endpoint
  (#​36747)
• fix: toplevel fetch/cron leak its spans (#​36757)
• fix: validate --ignore-scripts package selectors (#​36742)
• perf(core): drop dead module-graph retention (#​36683)
• perf(core): make extension op tables const in static memory (#​36696)
• perf(core): split OpCtx into shared OpCommonCtx + borrowed op declarations
  (#​36693)
• perf(ext/node): Buffer hex paths via native Uint8Array toHex/setFromHex
  (#​36531)

v2.9.6

Compare Source

2.9.6 / 2026.08.27

• feat(compressible): add support for 'text/x-component' content type (#​36450)
• feat(desktop): clipboard api (#​35750)
• feat(desktop): support checked, icon, and tooltip on menu items (#​36649)
• fix(bundle): isolate esbuild downloads from workspace registries (#​36467)
• fix(cache): combine duplicate headers for Vary matching (#​36476)
• fix(cli_parser): remove orphaned sync-types parser
• fix(core): cap adaptive buffer initial allocations (#​36432)
• fix(core): make Unix pipe fd ownership explicit (#​36353)
• fix(core): make user timer waker state thread-safe (#​36495)
• fix(coverage): compare a range against a line in V8's units (#​36613)
• fix(crypto): preserve RSA-OAEP label bytes (#​36441)
• fix(desktop): keep dots in the app name when resolving the runtime library
  (#​36006)
• fix(desktop): keep the macOS bundle signature valid unless an update is
  applied (#​36574)
• fix(desktop): never block the JS thread on the error-report dialog (#​36575)
• fix(desktop): propagate deno.json version and license into packaged installers
  (#​36577)
• fix(desktop): run Vite-based HMR dev servers inside the desktop runtime
  (#​36488)
• fix(desktop): transport binding args and results as DesktopValue so Uint8Array
  survives (#​36573)
• fix(ext/fetch): enforce permissions for proxy transports (#​36217)
• fix(ext/fetch): only retry transport errors on pooled connections (#​36415)
• fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB
  (#​36558)
• fix(ext/http): keep request body readable after response is sent (#​36629)
• fix(ext/http): route invalid async responses to onError (#​36437)
• fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#​36556)
• fix(ext/napi): run JS-calling finalizers safely, NULL string result, and
  Float16Array (#​36572)
• fix(ext/napi): surface OS error and path on addon load failure (#​36630)
• fix(ext/napi): track pending finalizers by identity (#​36551)
• fix(ext/napi): wake the event loop at the next uv_timer deadline (#​36559)
• fix(ext/net): skip unsupported DNS records in ANY queries (#​36650)
• fix(ext/node): accept string ports in dns.lookupService (#​36546)
• fix(ext/node): build the proxied request target with the URL parser (#​36557)
• fix(ext/node): do not resume client TLS sessions unless requested (#​36592)
• fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#​36407)
• fix(ext/node): handle readv short reads (#​36211)
• fix(ext/node): require sys permission for inspector.open (#​36465)
• fix(ext/node_sqlite): invalidate sessions on database close (#​36633)
• fix(ext/tls): avoid panic for mismatched client certificate and key (#​36457)
• fix(ext/web): clean up abort handlers when listeners are removed (#​36226)
• fix(ext/web): close transfer MessagePort when a transferred readable is
  cancelled (#​36270)
• fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode()
  (#​36611)
• fix(fetch): require an initial multipart boundary (#​36470)
• fix(ffi): validate struct return buffers (#​36373)
• fix(fmt): honor .editorconfig when formatting from stdin (#​36267)
• fix(fs): require write permission for creating opens (#​36497)
• fix(fs): use a private FsFile constructor token (#​36439)
• fix(glob): retain valid gitignore rules after parse errors (#​36478)
• fix(http): preserve keep-alive after reading request body (#​36690)
• fix(http): truncate streaming responses to content length (#​36496)
• fix(lsp): restrict registry completion endpoint schemes (#​36477)
• fix(node): check reads during require resolution (#​36461)
• fix(node): match domain uncaught exception handling (#​36475)
• fix(node): preserve v8 deserializer view offsets (#​36460)
• fix(node): validate Brotli encoder operations (#​36530)
• fix(node): validate raw outgoing HTTP headers (#​36471)
• fix(node/crypto): preserve binary key export passphrases (#​36443)
• fix(node_crypto): apply RFC 7748 scalar decoding for X448 (#​36466)
• fix(node_crypto): size cipher updates by byte length (#​36459)
• fix(node_shim): preserve explicit argument delimiters (#​36435)
• fix(npm): flatten single-resolution peers when building package ids (#​36608)
• fix(npm): match peer fallbacks when checking peer resolution cache (#​36607)
• fix(npm): remove arrayref dependency (#​36653)
• fix(npm): resolve bare npm specifier when latest is too new for min dependency
  age (#​36619)
• fix(npm): use cached abbreviated metadata under --cached-only (#​36526)
• fix(npm): validate tar paths before extraction (#​36468)
• fix(os): serialize process environment updates (#​36074)
• fix(permissions): check resolved IP against import deny list (#​36486)
• fix(process): reject NULs in Windows arguments (#​36436)
• fix(process): validate whitespace-only loader environment values (#​36431)
• fix(publish): authenticate the package existence check so private packages
  work (#​36656)
• fix(publish): memoize publish order depth (#​36215)
• fix(publish): reject invalid JSR package names (#​36474)
• fix(repl): skip regex literals when validating input (#​36375)
• fix(runtime): unregister dropped signal resources (#​36213)
• fix(web): keep MessagePort resource identifiers private (#​36440)
• fix: bugs in primordials related to ObjectCreate and
  ObjectDefineProperties (#​36541)
• fix: prevent threadpool starvation with concurrent file locks (#​32789)
• perf(core): grow the op driver's future arena on demand (#​36678)
• perf(core): uncontended-borrow fast path for AsyncRefCell (#​36679)
• perf(core): use index-based SafeArrayIterator in primordials (#​36543)
• perf(core): zero-copy snapshot rehydration, drop bincode (#​36680)
• perf(ext/web): apply the base64url op design to standard base64 (#​36422)
• perf(ext/websocket): shrink the op_ws_create future (#​36681)

v2.9.5

Compare Source

2.9.5 / 2026.08.06

• feat(add): --unscoped flag to alias packages by their unscoped name (#​36319)
• feat(task): add --members flag to run tasks in workspace members only (#​35748)
• feat: add Blob/Body textStream() (#​35616)
• feat: add experimental QuickJS backend (#​36194)
• fix(bundle): avoid esbuild protocol deadlock (#​36427)
• fix(bundle): respect runtime file permissions (#​36107)
• fix(cjs): use loader sources for recursive analysis (#​36111)
• fix(cli): escape control characters in external metadata (#​36198)
• fix(core): don't resolve internal module imports with the user's import map
  (#​36303)
• fix(crypto): add "raw-secret" to KeyFormat type (#​35708)
• fix(desktop): handle colored HMR URLs and page loads (#​36316)
• fix(desktop): retain update signature verification op (#​36152)
• fix(ext/crypto): allow deriveBits with length 0 (#​36283)
• fix(ext/napi): polyfill uv_handle_size and uv_strerror (#​36308)
• fix(ext/net): release completed QUIC stream resources (#​36247)
• fix(ext/net): require --allow-sys for node:dns.getServers() (#​35941)
• fix(ext/node): Node compat for web streams (#​36285)
• fix(ext/node): apply backpressure in Readable.toWeb() (#​36321)
• fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
  (#​35867)
• fix(ext/node): don't fire http2 settings callback after session destroy
  (#​36230)
• fix(ext/node): gate constrained memory cgroup reads (#​36218)
• fix(ext/node): handle pre-quoted shell arguments (#​36371)
• fix(ext/node): implement node:test tags (#​36292)
• fix(ext/node): implement util.diff (#​36289)
• fix(ext/node): implement v8.promiseHooks API (#​36281)
• fix(ext/node): sort fs.readdir entries to match Node.js (#​36341)
• fix(ext/node): stop http2 file reads after stream close (#​36300)
• fix(ext/node): store blocklist ranges compactly (#​36212)
• fix(ext/node): support the fs flush option for writes (#​36290)
• fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#​36326)
• fix(ext/node_crypto): use named group exponent sizes (#​36347)
• fix(ext/web): attach Node error codes to WHATWG API validation errors (#​36288)
• fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#​36327)
• fix(fetch): scope redirect-sensitive headers by origin (#​36361)
• fix(ffi): reject resizable buffers in nonblocking calls (#​36259)
• fix(fmt): accept xml and svg extensions for stdin (#​36149)
• fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#​36397)
• fix(http): preserve stripped headers across redirects (#​36360)
• fix(inspector): validate request host headers (#​36348)
• fix(net): cancel pending writes on stream close (#​36369)
• fix(net): clean up concurrently dropped load-balanced listeners (#​36246)
• fix(net): handle malformed DNS record text (#​36374)
• fix(node): clean up Web Stream finished listeners (#​36227)
• fix(node): retain consumed HTTP stream wrapper (#​36254)
• fix(npm): ignore invalid package bin targets (#​36354)
• fix(npm): tolerate malformed scripts field in packuments (#​36324)
• fix(npmrc): match auth configs by authority and path (#​36359)
• fix(outdated): don't report JSR pre-release versions as latest (#​36325)
• fix(publish): report when the registry rejects a provenance attestation
  (#​36404)
• fix(resolver): don't treat deno eval modules as npm package files (#​36304)
• fix(runtime): map notify's Windows missing-path error to NotFound (#​35864)
• fix(sync-types): add reason to too_many_arguments allows (lint)
• fix(telemetry): handle reentrant attribute conversion (#​36256)
• fix(webgpu): own mapped range backing stores (#​36257)
• fix(webstorage): preserve Storage constructor name (#​35944)
• fix: capitalize IP in help text (#​36170)
• fix: upgrade deno_task_shell to 0.33.3 (#​36406)
• fix: wire no-legacy-abort unstable flag from deno.json config (#​36312)
• perf(core): run the common-path tick drain in Rust (#​36157)
• perf(ext/node): bypass dns lookup on literal IPs in udp send (#​35909)
• perf(ext/web): implement base64url encode/decode as simdutf ops (#​36398)
• perf(fs): open files on the blocking pool in async readFile/writeFile (#​36160)
• perf: order startup functions in release builds (#​36219)
• perf: reduce eager module evaluation at startup (#​36331)
• perf: remove Linux unwind tables from release artifacts (#​36265)

v2.9.4

Compare Source

2.9.4 / 2026.07.23

• feat(desktop): enable --hmr for React Router (#​35900)
• feat(ext/node): add a byteLength/length parameter to
  Buffer.indexOf/lastIndexOf/includes (#​35872)
• feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv (#​36016)
• feat: upgrade V8 to 150.2.0 (#​36098)
• fix(add): support --minimum-dependency-age flag in deno add/remove (#​36099)
• fix(cache): store Web Cache under origin data (#​36145)
• fix(canvas): require FFI permission for native window handles (#​36080)
• fix(clean): reject symlinked node_modules cleanup roots (#​36190)
• fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage
  (#​36242)
• fix(core): allow dynamic imports during cached module evaluation (#​36258)
• fix(core): bound error graph conversion (#​36070)
• fix(core): enforce JSON requests in FsModuleLoader (#​36137)
• fix(core): handle malformed error constructors (#​36071)
• fix(core): stop rejected dynamic imports before loading (#​36136)
• fix(desktop): make BrowserWindow bindings typeable (#​35907)
• fix(desktop): preserve binding wrappers after lazy op upgrade (#​36065)
• fix(desktop): strip runtime extension from app name (#​36060)
• fix(ext/napi): cancel async sends after close (#​36077)
• fix(ext/napi): scope callback info per invocation (#​36076)
• fix(ext/node): apply backpressure to http2 stream writes (#​36044)
• fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit
  (#​36113)
• fix(ext/node): implement worker_threads.locks via Web Locks (#​35963)
• fix(ext/node): node:sqlite backup() and deserialize() argument validation
  (#​36127)
• fix(ext/node): retry DNS query when its per-attempt timeout fires (#​35955)
• fix(ext/node): stop http2 file reads on stream close (#​36061)
• fix(ext/web): handle failed webtransport datagram setup (#​36067)
• fix(ext/webidl): implement async_sequence for ReadableStream.from (#​35976)
• fix(fetch): bound multipart part headers (#​36096)
• fix(fmt): keep embedded CSS custom property indentation stable (#​35949)
• fix(fs): require sys permission for umask (#​36222)
• fix(http): preserve trust proxy environment setting (#​36073)
• fix(init): validate temporary node_modules parent (#​36142)
• fix(jupyter): report codemirror_mode as a string (#​36241)
• fix(loader): reject non-JSON modules for JSON imports (#​36135)
• fix(napi): synchronize external string finalizers (#​36078)
• fix(net): clean up cancellation resources on early errors (#​36229)
• fix(net): limit WebTransport handshake frame buffering (#​36068)
• fix(node_http2): clean up destroyed sessions (#​36043)
• fix(node_resolver): handle CJS filesystem path edge cases (#​36112)
• fix(node_stream): handle Web Stream adapter errors (#​36193)
• fix(npm): avoid following lock poll symlinks (#​36192)
• fix(npm): download tarballs from the configured registry instead of
  registry.npmjs.org (#​36187)
• fix(npm): reject symlinked package materialization dirs (#​36191)
• fix(outdated): keep type-only dependencies in the lockfile (#​36140)
• fix(pack): support file paths longer than the tar name field (#​36105)
• fix(permissions): escape bidi controls in prompts (#​36195)
• fix(process): avoid collisions in Windows stdio pipe names (#​36081)
• fix(publish): constrain generated source rewrites (#​36109)
• fix(release): insert into versions.json in semver order (#​36097)
• fix(rt): isolate extracted native addons (#​36144)
• fix(runtime): bridge console to the inspector regardless of --inspect flag
  (#​35795)
• fix(runtime): give worker isolate threads the stack size we report (#​36114)
• fix(test): escape control characters in test names (#​36196)
• fix(tests): make npm test registry tolerate a bad advisories request body
  (#​36138)
• fix(tls): resolve sni requests concurrently (#​36062)
• fix(update): don't downgrade lockfile when npm cache is stale (#​35904)
• fix(webtransport): avoid url parse panic (#​36066)
• fix(webtransport): validate certificate dates (#​36069)
• fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge
  (#​36025)
• fix: discover config file for jsr: entrypoints (#​35838)
• fix: handle UTF-16 diagnostic columns (#​36028)
• perf(core): avoid duplicating lazy ESM snapshot sources (#​36262)
• perf(snapshot): mangle internal source identifiers (#​36263)
• perf: compress bundled AppImage runtimes (#​36261)
• perf: use FxHash for hot internal hash maps (#​36100)

v2.9.3

Compare Source

2.9.3 / 2026.07.15

• feat(cli): deno add --no-save and --save-optional (#​36039)
• feat(cli): add --min-dep-age alias (#​35914)
• feat(compile): support aarch64-pc-windows-msvc target (#​36004)
• feat(ext/fetch): add http2MaxHeaderListSize option to
  Deno.createHttpClient (#​33194)
• fix(bundle): preserve raw imports in watch mode (#​36040)
• fix(canvas): don't hold SurfaceData mut borrow over window resize (#​35993)
• fix(config): reject out-of-range minimum dependency ages (#​36051)
• fix(core): block user ext imports after resolution (#​36012)
• fix(core): deactivate idle TTY write handles (#​35886)
• fix(core): restrict extension loaders to internal modules (#​36013)
• fix(core): root slow op string coercions (#​36018)
• fix(desktop): don't let op_desktop_send_error_report target caller-supplied
  URLs (#​35940)
• fix(ext/http): don't panic recycling cancelled record on native response
  (#​36053)
• fix(ext/napi): don't free threadsafe function on abort while refs remain
  (#​36032)
• fix(ext/napi): don't resurrect a released threadsafe function in acquire
  (#​36054)
• fix(ext/node): add deprecation warning for Duplex.toWeb({ type }) DEP0201
  (#​35972)
• fix(ext/node): guard sqlite deserialize during callbacks (#​36023)
• fix(ext/node): handle UTF-16 assert source positions (#​36029)
• fix(ext/node): handle sqlite conversion failures (#​36024)
• fix(ext/node): respect base64 buffer ranges (#​36030)
• fix(ext/process): don't double-close extra stdio pipe handles on Windows
  (#​36005)
• fix(lsp): respect lint rule exclusion for no-slow-types diagnostics (#​35924)
• fix(node): stop active read on stream close to avoid leaking Socket/TCPWrap
  (#​35898)
• fix(node_http2): keep header validation enabled (#​36042)
• fix(node_http2): validate serialized headers (#​36041)
• fix(npm): don't fetch registry info for deprecated packages under
  --cached-only (#​35903)
• fix(npm): normalize path in BYONM read permission check (#​35882)
• fix(pm): hint about minimumDependencyAge when no version is old enough
  (#​35890)
• fix(release): only strip Mach-O signature for x86_64-apple-darwin (#​35902)
• fix(release): strip Mach-O signature before patchver on apple targets (#​35897)
• fix(runtime): guard usage op output buffers (#​36020)
• fix(serde_v8): handle deserialization exceptions (#​36021)
• fix(web): guard encodeInto fallback result buffer (#​36019)
• fix(web): support Event subclasses with readonly toStringTag (#​35920)
• fix(worker): remove imported ops during bootstrap (#​36014)
• fix: don't print duplicate parse diagnostics (#​35933)
• perf(ext/crypto): batch randomUUID generation (#​35953)
• perf(ext/fetch): remove quadratic line buffering in EventSource (#​35881)
• perf(ext/node): cache compiled glob matchers + bump bundled minimatch to
  10.2.5 (#​35873)
• perf(ext/node): fast path fs cp (#​35856)
• perf(ext/node): right-size small socket reads instead of pinning the 64KB slab
  (#​35779)
• perf(ext/node): speed up sqlite.StatementSync.all() and run() (#​35863)
• perf(ext/web): avoid copy-back in op_base64_atob large path (#​35862)

v2.9.2

Compare Source

2.9.2 / 2026.07.08

• feat(desktop): autodetect React Router framework (#​35557)
• feat(desktop): enable --hmr for Vite and Nuxt (#​35851)
• feat(desktop): run HMR by framework dev server (#​35722)
• feat(desktop): window opacity and transparency APIs (#​35646)
• feat(desktop): wire --exclude-unused-npm through to compile (#​35740)
• feat(ext/node): implement v8.setHeapSnapshotNearHeapLimit (#​35694)
• feat(ext/telemetry): honor OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT (#​35068)
• feat(inspector): start inspector server on SIGUSR1 (#​35738)
• feat(node): implement getTestContext() in node:test (#​35678)
• feat: support wildcard patterns in minimumDependencyAge.exclude (#​35746)
• fix(check): don't interleave errors with "Check" lines in a workspace (#​35687)
• fix(compile): bump libsui to 0.16.1 to survive eu-strip in flatpak (#​35699)
• fix(compile): bump libsui to 0.16.3 to fix segfault under gVisor/Cloud Run
  (#​35701)
• fix(core): don't drain microtasks in mod_evaluate_sync mid-evaluation (#​35707)
• fix(coverage): count a branch-junction line as covered when either arm runs
  (#​35858)
• fix(coverage): don't count V8 block-boundary gaps as branches (#​35767)
• fix(coverage): don't let a trailing comment change a line's hit count (#​35741)
• fix(deploy): disable config discovery and refresh the cached CLI version
  (#​35754)
• fix(desktop): attribute bind calls to the registering window id (#​35654)
• fix(desktop): honor desktop.backend from deno.json (#​35815
• fix(desktop): pin @​std/http in generated Vite SPA entrypoint + add hermetic
  compile test (#​35676)
• fix(desktop): rename launcher to so it self-loads the runtime (#​35709)
• fix(desktop): run framework build step before bundling output (#​35603)
• fix(desktop): surface compiled-app startup errors instead of exiting silently
  (#​35567)
• fix(dprint): exclude tools/lzld submodule (#​35778)
• fix(ext): throw DataCloneError when posting non-serializable values (#​35604)
• fix(ext/cache): implement Cache.keys() (#​35455)
• fix(ext/fetch): reject transport failures with Node's "fetch failed" shape
  (#​35618)
• fix(ext/http): error non-Uint8Array response streams (#​35783)
• fix(ext/http): honor explicit content-length header on HEAD responses (#​35728)
• fix(ext/http): point legacy abort warning at docs.deno.com/go link (#​35713)
• fix(ext/napi): add uv_cond_* polyfills for native addons (#​35536)
• fix(ext/net): abort pending Deno.connect during DNS resolution (#​35729)
• fix(ext/node): allow adopting inherited extra stdio TCP fds (#​35805)
• fix(ext/node): don't panic when main module path has invalid percent-encoding
  (#​35534)
• fix(ext/node): don't schedule a pause in inspector.waitForDebugger() (#​35796)
• fix(ext/node): flush StringDecoder in cipher final() for stream ciphers
  (#​35800)
• fix(ext/node): mark TLSWrap dead on teardown before tls_conn check (#​35706)
• fix(ext/node): report all active resources from process.getActiveResourcesInfo
  (#​35532)
• fix(ext/node): require --allow-net=unix for node:net unix sockets (#​35835)
• fix(ext/node): support fd 3 pipes in spawned Deno children (#​34133)
• fix(ext/signals): unregister handler when SignalStream is dropped (#​35832)
• fix(ext/web): resolve pending BYOB read when teeing a byte stream that closes
  (#​35828)
• fix(fmt): format Astro inline scripts as TypeScript (#​35852)
• fix(fs): support pre-1970 (negative) timestamps in FsStat (#​35517)
• fix(inspector): close WebSocket connections when the runtime is torn down
  (#​35791)
• fix(install): don't panic on jsr specifier with a tag like @​latest (#​35605)
• fix(install): don't write through hardlinks when copying package files
  (#​35735)
• fix(install): make setup cache packages hash deterministic (#​35825)
• fix(install): resolve lifecycle script dependency bins against the hoisted
  layout (#​35762)
• fix(install): support uninstalling multiple global packages (#​29352)
• fix(lint): don't error on non-analyzable package exports like CSS files
  (#​35732)
• fix(lint): include config file in workspace member invalid version error
  (#​35759)
• fix(lsp): fix CPU busy loop by creating tokio runtime before JsRuntime in TSC
  thread (#​35595)
• fix(node/fs): implement followSymlinks option for fs.glob() (#​35524)
• fix(npm): don't re-fetch packuments on every run when registry has no time
  data (#​35834)
• fix(npm): don't retain full npm exports value + fix --watch memory leak
  (#​35677)
• fix(npm): widen node_modules lock staleness margin to avoid false preemption
  (#​35806)
• fix(permissions): split comma-separated paths in --ignore-read (#​35661)
• fix(test): run Node-API finalizers at test worker shutdown (#​35695)
• fix(watch): accept watch paths in fmt/lint/bench --watch (#​35720)
• fix(watch): execute preload modules under --watch (#​35792)
• fix(watch): terminate on Ctrl+C while blocked in synchronous code (#​35826)
• fix: enable rusqlite "fallible_uint" feature in workspace deps (#​35681)
• perf(config): literal-suffix reject and prune irrelevant globs per base
  (#​35688)
• perf(core): defer residual lazy source registration (#​35731)
• perf(ext/fetch): stream wasm bytes to the compiler from Rust (#​35704)
• perf(ext/node): remove per-chunk copying on TLSWrap data paths (#​35705)
• perf(ext/node): zero-copy async Buffer writes on the stream_wrap path (#​35780)
• perf(ext/web): identity pipeThrough writable bypass (#​35799)
• perf(ext/web): persistent pump for the generic pipeTo loop (#​35813)
• perf(ext/web): pump readableStreamCollectIntoUint8Array with a persistent read
  request (#​35790)
• perf(ext/web): reduce per-chunk allocations on stream read and tee paths
  (#​35786)
• perf(ext/web): reduce per-chunk overhead in Web Streams (#​35773)
• perf(ext/web): run synchronous pull completion without a microtask hop
  (#​35788)
• perf(ext/web): shared underlying-source algorithms, hoist resource-bridge read
  request (#​35810)
• perf(ext/web): sync fast path for ReadableStream async iterator next()
  (#​35842)
• perf(ext/web): synchronous transform fast path for TransformStream (#​35844)
• perf(npm): index packuments with SIMD JSON scanner (#​35698)
• perf(streams): offload resource-backed pipeTo to Rust via op_pipe (#​35689)
• perf(workers): optimize message passing (#​35110)
• perf(workers): return raw buffer from receive ops for no-transferable messages
  (#​35756)
• perf: use V8 native queueMicrotask instead of op (#​35787)

v2.9.1

Compare Source

2.9.1 / 2026.07.01

• feat(check): add --desktop flag to type-check for deno desktop (#​35644)
• feat(desktop): register deep-link URL schemes at bundle time (#​35466)
• feat: update laufey to 0.5.0 (#​35663)
• fix(bundle): emit CSSStyleSheet for CSS raw imports (#​35598)
• fix(cache): skip checksums for cached 404 entries (#​35526)
• fix(config): don't strip workspace-member includes from deploy config (#​34788)
• fix(core): apply deferred fast-call op upgrade to the captured bootstrap clone
  (#​35630)
• fix(core): prevent shared-buffer timer expiry race from losing timers (#​35312)
• fix(desktop): default window title to app name instead of laufey_webview
  (#​35541)
• fix(desktop): detect SvelteKit adapter-node and error on unsupported adapters
  (#​35533)
• fix(desktop): discover deno.json in the project dir for deno desktop .
  (#​35660)
• fix(desktop): don't delete user directories that collide with app name
  (#​35513)
• fix(desktop): repair webview and raw backends on Windows (laufey v0.4.1)
  (#​35566)
• fix(desktop): resolve launcher symlink so .deb/.rpm apps find the backend
  (#​35632)
• fix(desktop): set LAUFEY_RUNTIME_PATH in Linux app launcher (#​35580)
• fix(desktop): show macOS tray icon in bundled .app launched via Finder
  (#​35626)
• fix(desktop): use zstd for appimage squashfs (#​35506)
• fix(doc): strip blockquote > prefixes from JSDoc code blocks ([#&

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ce3cc95-805b-4e61-a4b4-13da575ac66f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}