denoland/deno v2.7.12 → v2.7.13

Deno 2.7.13 is a compatibility-heavy patch release with a lot of work in Node and N-API support, plus a few targeted runtime and CLI fixes. The biggest themes are a rewritten node:http stack, a working node:repl, and a long list of correctness fixes for HTTP/2, TLS, workers, and native addons.

What's new

  • Deno now ships a working node:repl implementation instead of a stub. It adds a REPLServer built on readline, supports TTY usage, built-in commands like .help, .load, .save, and .editor, and handles multiline input and REPL context state such as _ and _error. (#32799)

  • node:http has been rewritten around Node’s llhttp parser and a native TCPWrap, replacing the previous hyper-based implementation. The new stack more closely mirrors Node.js structure and behavior, and this release also layers on follow-up compatibility work for parser error handling, maxHeaderSize, client behavior, upgrade/connect handling, and faster parser paths. (#33208, #33299, #33306, #33337, #33351, #33354)

  • deno upgrade can now install binaries built from a pull request with deno upgrade pr <number>. It uses GitHub CLI to find the PR’s CI artifacts, downloads the matching binary for the current platform, verifies it with deno -V, and can also write to a custom path or run in --dry-run mode. (#33252)

  • N-API compatibility improved substantially for native modules. Handle scopes and callback scopes are now real V8 scopes instead of no-ops, weak finalizers are deferred to the event loop instead of running during GC, and external Latin-1 strings can use true zero-copy buffers when a finalize callback is provided. (#33281, #33260, #33283)

Fixes

  • deno audit now uses npm’s supported bulk advisory endpoint, fixing failures caused by the retired audit API and inconsistent responses. (#33292)

  • console.log and Deno.inspect now honor Symbol.for("nodejs.util.inspect.custom") on Proxy objects that expose the symbol through get but hide it from has, fixing output for cases like nodejs-polars. (#33265)

  • Deno.serve() now treats an empty Host: header as missing, so request.url stays valid instead of producing malformed URLs or promoting the path into the hostname. (#33234)

  • Web Worker() now warns when passed node-specific options like env or workerData, and worker startup failures return a JS error instead of panicking the process. (#33310)

  • Linux release binaries work again on systems with glibc older than 2.27, including environments like AWS Lambda on Amazon Linux 2. (#33259)

  • Deno.Command.output() now avoids the large RSS growth seen in tight loops by bypassing ReadableStream setup on this collection path. ChildProcess.output() is unchanged. (#33335)

  • node:fs.writeFileSync(..., { flag: "wx" }) on Windows no longer throws a spurious EEXIST while truncating the existing file, which could previously corrupt data. (#33253)

  • require.resolve, require.resolve.paths, and Module._resolveLookupPaths now behave more like Node.js, including built-in module handling, argument validation, and relative path resolution. (#33261)

  • ChildProcess.kill() now returns false when the process has already exited, matching Node.js and letting callers detect that no signal was delivered. (#33305)

  • node:tls fixes include server-side STARTTLS now automatically beginning the handshake, TLS over Unix domain sockets, better validation of TLS options, and safer behavior for JS-backed streams. These changes also address regressions seen with npm:pg and encrypted mssql usage. (#33303, #33331, #33304)

  • node:http2 got a broad set of compatibility fixes, including missing constants and error codes, client request header flushing, createSecureServer({ allowHTTP1: true }), empty-response bugs, and stricter settings validation. (#33300, #33315, #33332)

  • crypto.verify(null, ...) now works with RSA-PSS keys that carry explicit PSS parameters, including PEM inputs that Node accepts but stricter parsers rejected. (#33314)

  • spawnSync now supports Node-style FD-indexed stdio inheritance from sparse stdio arrays. (#33341)

Other notable changes

  • Several Node compatibility hot paths were optimized, including HTTP parsing, timer async-hooks overhead, writev, and core I/O polling. (#33349, #33352, #33355)

  • The bundled v8 crate was updated to 147.2.1, including a fix for an FFI mismatch affecting external one-byte string creation. (#33318)

  • JSX and TSX code blocks now get Prism support in generated docs. (#33255)

Contributors

@bartlomieju, @nathanwhit, @JimmyBowcott, @jeanibarz, @crowlKats

View on GitHub →