denoland/deno v2.9.6 → v2.9.7

Deno 2.9.7 is a patch release focused on regressions in 2.9.6, plus a handful of compatibility, security-hardening, and performance improvements. Most upgrades should be straightforward, with fixes spanning the CLI, Node compatibility, networking, desktop, and schema/tooling behavior.

What's new

  • deno audit now uses the configured certificate settings for HTTPS requests, so it honors DENO_CERT, DENO_TLS_CA_STORE, and existing certificate-error configuration. This fixes audit in environments that use a private CA, such as TLS-inspecting proxies, where other npm-related commands already worked. (#36728)

  • JSR prerelease resolution in the LSP now matches CLI resolution for packages that have no stable release. A * requirement can resolve to the newest prerelease only when there is no unyanked stable version at all, which avoids LSP/CLI mismatches on prerelease-only packages. (#36655)

  • Deno’s JSON schemas now identify themselves with the maintained GitHub raw URLs, which fixes broken cross-file $ref resolution in editors. This also clears untrusted-schema warnings and restores newer lint rule lists in VS Code-based validation flows. (#36747, #36774)

  • node:dns compatibility got a broader pass: Deno now returns more Node-like resolver error codes, accepts string ports in dns.lookupService(), and implements Resolver.setLocalAddress() validation/storage behavior instead of throwing ERR_NOT_IMPLEMENTED. It also aligns domainToASCII handling for Unicode, NUL-containing hostnames, and bracketed IPv6 input. (#36552)

  • node:child_process now allows repeated non-terminating signals like SIGSTOP followed by SIGCONT, instead of treating child.killed as a one-shot block. It keeps IPC and stdio alive until the process or channel actually terminates, which restores Node-compatible signal handling for pause/resume and graceful-then-forceful shutdown flows. (#36644)

  • Several core and Node-path performance improvements landed in this patch. Buffer hex encode/decode paths now use V8’s native Uint8Array.prototype.toHex and setFromHex, which substantially speeds up Buffer hex operations, and core op/module metadata now keeps less per-realm/per-runtime state alive. (#36531, #36683, #36693, #36696)

Fixes

  • Fixed deno completions bash generating invalid scripts with literal \n, and fixed zsh completions breaking on short flags like -h. (#36736, #36720)

  • Restored valid parsing for granular --allow-sys and --deny-sys descriptors such as inspector, setuid, and umask. (#36753)

  • Restored deno bundle --sourcemap optional-value behavior: bare --sourcemap works again, attached values are validated, and the entrypoint is no longer swallowed. (#36723)

  • Fixed deno run -- script.ts, deno eval -- code, and similar entrypoint-style commands so -- before the entrypoint works again. (#36835)

  • Fixed duplicated passthrough arguments in deno deploy and deno sandbox, which could make forwarded flags appear twice. (#36722)

  • Fixed desktop regressions from 2.9.6 where the native window close button stopped working, and where deno desktop --hmr could crash on Linux with Vite 8 / Rolldown. (#36718)

  • Fixed deno transpile --declaration reporting type errors from Deno’s own bundled declaration assets when users explicitly set compilerOptions.lib. (#36716)

  • Fixed pnpm lockfile import against real-world lockfiles, including aliases, workspace/link dependencies, and pnpm v6 layout differences. (#36727)

  • Fixed HTTP cache authority encoding so hosts with underscores or explicit ports map to unambiguous cache paths; affected cache entries will be regenerated as needed. (#36356)

  • Fixed SQLite-backed node:sqlite and Deno.openKv to refuse symlink database paths. (#36357)

  • Fixed multicast group joins to check network permissions against the group address and bound port. (#36529)

  • Fixed Unix-socket permission handling on case-insensitive filesystems, and fixed cross-compiling --allow-net=unix:/... from Windows by parsing POSIX-style socket paths correctly. (#36553, #36785)

  • Fixed lockfile tarball validation for both install and npm resolution paths, including origin and registry-path checks. (#36473, #36430)

  • Fixed stale or incorrect behavior in tracing and caching: top-level fetch/cron no longer leak active spans, Deno.serve now reads traceparent regardless of header-name case, and V8 code cache entries are keyed by full source contents to avoid stale cache reuse. (#36757, #36840, #36743)

  • Fixed CompressionStream flushing on every write, which made compressed output chunk-dependent and larger than necessary. (#36744)

  • Fixed several Node compatibility issues, including AsyncLocalStorage.exit() context restoration, IncomingMessage header map prototypes, repeated child process signals, process.resourceUsage().maxRSS on macOS, and prime-size validation in crypto APIs. (#36464, #36438, #36644, #36784, #36400)

Other notable changes

  • Various internal cleanup, test updates, and CI/dependency maintenance also landed in this patch.

Contributors

@tomas-zijdemans, @xz-dev, @MLuc24, @r3wretrhy, @nathanwhit, @bartlomieju, @CertainLach, @taljeon, @cuishuang, @crowlKats, @hugojosefson, @ErikAbele, @pttydou, @lucacasonato, @piscisaureus, @melbinjp, @denobot

View on GitHub →