DENO-2.9.4 release notes and known issues

Summary

2.9.4 / 2026.07.23 feat(desktop): enable --hmr for React Router ( #35900 ) feat(ext/node): add a byteLength/length parameter to Buffer.indexOf/lastIndexOf/includes ( #35872 ) feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv ( #36016 ) feat: upgrade V8 to 150.2.0 ( #36098 ) fix(add): support --minimum-dependency-age flag in deno add/remove ( #36099 ) fix(cache): store Web Cache under origin data ( #36145 ) fix(canvas): require FFI permission for native window handles ( #36080 ) fix(clean): reject symlinked node_modules cleanup roots ( #36190 ) fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage ( #36242 ) fix(core): allow dynamic imports during cached module evaluation ( #36258 ) fix(core): bound error graph conversion ( #36070 ) fix(core): enforce JSON requests in FsModuleLoader ( #36137 ) fix(core): handle malformed error constructors ( #36071 ) fix(core): stop rejected dynamic imports before loading ( #36136 ) fix(desktop): make BrowserWindow bindings typeable ( #35907 ) fix(desktop): preserve binding wrappers after lazy op upgrade ( #36065 ) fix(desktop): strip runtime extension from app name ( #36060 ) fix(ext/napi): cancel async sends after close ( #36077 ) fix(ext/napi): scope callback info per invocation ( #36076 ) fix(ext/node): apply backpressure to http2 stream writes ( #36044 ) fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit ( #36113 ) fix(ext/node): implement worker_threads.locks via Web Locks ( #35963 ) fix(ext/node): node:sqlite backup() and deserialize() argument validation ( #36127 ) fix(ext/node): retry DNS query when its per-attempt timeout fires ( #35955 ) fix(ext/node): stop http2 file reads on stream close ( #36061 ) fix(ext/web): handle failed webtransport datagram setup ( #36067 ) fix(ext/webidl): implement async_sequence for ReadableStream.from ( #35976 ) fix(fetch): bound multipart part headers ( #36096 ) fix(fmt): keep embedded CSS custom property indentation stable ( #35949 ) fix(fs): require sys permission for umask ( #36222 ) fix(http): preserve trust proxy environment setting ( #36073 ) fix(init): validate temporary node_modules parent ( #36142 ) fix(jupyter): report codemirror_mode as a string ( #36241 ) fix(loader): reject non-JSON modules for JSON imports ( #36135 ) fix(napi): synchronize external string finalizers ( #36078 ) fix(net): clean up cancellation resources on early errors ( #36229 ) fix(net): limit WebTransport handshake frame buffering ( #36068 ) fix(node_http2): clean up destroyed sessions ( #36043 ) fix(node_resolver): handle CJS filesystem path edge cases ( #36112 ) fix(node_stream): handle Web Stream adapter errors ( #36193 ) fix(npm): avoid following lock poll symlinks ( #36192 ) fix(npm): download tarballs from the configured registry instead of registry.npmjs.org ( #36187 ) fix(npm): reject symlinked package materialization dirs ( #36191 ) fix(outdated): keep type-only dependencies in the lockfile ( #36140 ) fix(pack): support file paths longer than the tar name field ( #36105 ) fix(permissions): escape bidi controls in prompts ( #36195 ) fix(process): avoid collisions in Windows stdio pipe names ( #36081 ) fix(publish): constrain generated source rewrites ( #36109 ) fix(release): insert into versions.json in semver order ( #36097 ) fix(rt): isolate extracted native addons ( #36144 ) fix(runtime): bridge console to the inspector regardless of --inspect flag ( #35795 ) fix(runtime): give worker isolate threads the stack size we report ( #36114 ) fix(test): escape control characters in test names ( #36196 ) fix(tests): make npm test registry tolerate a bad advisories request body ( #36138 ) fix(tls): resolve sni requests concurrently ( #36062 ) fix(update): don't downgrade lockfile when npm cache is stale ( #35904 ) fix(webtransport): avoid url parse panic ( #36066 ) fix(webtransport): validate certificate dates ( #36069 ) fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge ( #36025 ) fix: d

Improvements and security content

• 2.9.4 / 2026.07.23 feat(desktop): enable --hmr for React Router ( #35900 ) feat(ext/node): add a byteLength/length parameter to Buffer.indexOf/lastIndexOf/includes ( #35872 ) feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv ( #36016 ) feat: upgrade V8 to 150.2.0 ( #36098 ) fix(add): support --minimum-dependency-age flag in deno add/remove ( #36099 ) fix(cache): store Web Cache under origin data ( #36145 ) fix(canvas): require FFI permission for native window handles ( #36080 ) fix(clean): reject symlinked node_modules cleanup roots ( #36190 ) fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage ( #36242 ) fix(core): allow dynamic imports during cached module evaluation ( #36258 ) fix(core): bound error graph conversion ( #36070 ) fix(core): enforce JSON requests in FsModuleLoader ( #36137 ) fix(core): handle malformed error constructors ( #36071 ) fix(core): stop rejected dynamic imports before loading ( #36136 ) fix(desktop): make BrowserWindow bindings typeable ( #35907 ) fix(desktop): preserve binding wrappers after lazy op upgrade ( #36065 ) fix(desktop): strip runtime extension from app name ( #36060 ) fix(ext/napi): cancel async sends after close ( #36077 ) fix(ext/napi): scope callback info per invocation ( #36076 ) fix(ext/node): apply backpressure to http2 stream writes ( #36044 ) fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit ( #36113 ) fix(ext/node): implement worker_threads.locks via Web Locks ( #35963 ) fix(ext/node): node:sqlite backup() and deserialize() argument validation ( #36127 ) fix(ext/node): retry DNS query when its per-attempt timeout fires ( #35955 ) fix(ext/node): stop http2 file reads on stream close ( #36061 ) fix(ext/web): handle failed webtransport datagram setup ( #36067 ) fix(ext/webidl): implement async_sequence for ReadableStream.from ( #35976 ) fix(fetch): bound multipart part headers ( #36096 ) fix(fmt): keep embedded CSS custom property indentation stable ( #35949 ) fix(fs): require sys permission for umask ( #36222 ) fix(http): preserve trust proxy environment setting ( #36073 ) fix(init): validate temporary node_modules parent ( #36142 ) fix(jupyter): report codemirror_mode as a string ( #36241 ) fix(loader): reject non-JSON modules for JSON imports ( #36135 ) fix(napi): synchronize external string finalizers ( #36078 ) fix(net): clean up cancellation resources on early errors ( #36229 ) fix(net): limit WebTransport handshake frame buffering ( #36068 ) fix(node_http2): clean up destroyed sessions ( #36043 ) fix(node_resolver): handle CJS filesystem path edge cases ( #36112 ) fix(node_stream): handle Web Stream adapter errors ( #36193 ) fix(npm): avoid following lock poll symlinks ( #36192 ) fix(npm): download tarballs from the configured registry instead of registry.npmjs.org ( #36187 ) fix(npm): reject symlinked package materialization dirs ( #36191 ) fix(outdated): keep type-only dependencies in the lockfile ( #36140 ) fix(pack): support file paths longer than the tar name field ( #36105 ) fix(permissions): escape bidi controls in prompts ( #36195 ) fix(process): avoid collisions in Windows stdio pipe names ( #36081 ) fix(publish): constrain generated source rewrites ( #36109 ) fix(release): insert into versions.json in semver order ( #36097 ) fix(rt): isolate extracted native addons ( #36144 ) fix(runtime): bridge console to the inspector regardless of --inspect flag ( #35795 ) fix(runtime): give worker isolate threads the stack size we report ( #36114 ) fix(test): escape control characters in test names ( #36196 ) fix(tests): make npm test registry tolerate a bad advisories request body ( #36138 ) fix(tls): resolve sni requests concurrently ( #36062 ) fix(update): don't downgrade lockfile when npm cache is stale ( #35904 ) fix(webtransport): avoid url parse panic ( #36066 ) fix(webtransport): validate certificate dates ( #36069 ) fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge ( #36025 ) fix: d

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence