DENO-2.9.5 release notes and known issues

Summary

2.9.5 / 2026.08.06 feat(add): --unscoped flag to alias packages by their unscoped name ( #36319 ) feat(task): add --members flag to run tasks in workspace members only ( #35748 ) feat: add Blob/Body textStream() ( #35616 ) feat: add experimental QuickJS backend ( #36194 ) fix(bundle): avoid esbuild protocol deadlock ( #36427 ) fix(bundle): respect runtime file permissions ( #36107 ) fix(cjs): use loader sources for recursive analysis ( #36111 ) fix(cli): escape control characters in external metadata ( #36198 ) fix(core): don't resolve internal module imports with the user's import map ( #36303 ) fix(crypto): add "raw-secret" to KeyFormat type ( #35708 ) fix(desktop): handle colored HMR URLs and page loads ( #36316 ) fix(desktop): retain update signature verification op ( #36152 ) fix(ext/crypto): allow deriveBits with length 0 ( #36283 ) fix(ext/napi): polyfill uv_handle_size and uv_strerror ( #36308 ) fix(ext/net): release completed QUIC stream resources ( #36247 ) fix(ext/net): require --allow-sys for node:dns.getServers() ( #35941 ) fix(ext/node): Node compat for web streams ( #36285 ) fix(ext/node): apply backpressure in Readable.toWeb() ( #36321 ) fix(ext/node): defer TLS write completion callback to avoid reentrancy panic ( #35867 ) fix(ext/node): don't fire http2 settings callback after session destroy ( #36230 ) fix(ext/node): gate constrained memory cgroup reads ( #36218 ) fix(ext/node): handle pre-quoted shell arguments ( #36371 ) fix(ext/node): implement node:test tags ( #36292 ) fix(ext/node): implement util.diff ( #36289 ) fix(ext/node): implement v8.promiseHooks API ( #36281 ) fix(ext/node): sort fs.readdir entries to match Node.js ( #36341 ) fix(ext/node): stop http2 file reads after stream close ( #36300 ) fix(ext/node): store blocklist ranges compactly ( #36212 ) fix(ext/node): support the fs flush option for writes ( #36290 ) fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify ( #36326 ) fix(ext/node_crypto): use named group exponent sizes ( #36347 ) fix(ext/web): attach Node error codes to WHATWG API validation errors ( #36288 ) fix(ext/websocket): disable HTTP/2 server push on wss upgrade path ( #36327 ) fix(fetch): scope redirect-sensitive headers by origin ( #36361 ) fix(ffi): reject resizable buffers in nonblocking calls ( #36259 ) fix(fmt): accept xml and svg extensions for stdin ( #36149 ) fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 ( #36397 ) fix(http): preserve stripped headers across redirects ( #36360 ) fix(inspector): validate request host headers ( #36348 ) fix(net): cancel pending writes on stream close ( #36369 ) fix(net): clean up concurrently dropped load-balanced listeners ( #36246 ) fix(net): handle malformed DNS record text ( #36374 ) fix(node): clean up Web Stream finished listeners ( #36227 ) fix(node): retain consumed HTTP stream wrapper ( #36254 ) fix(npm): ignore invalid package bin targets ( #36354 ) fix(npm): tolerate malformed scripts field in packuments ( #36324 ) fix(npmrc): match auth configs by authority and path ( #36359 ) fix(outdated): don't report JSR pre-release versions as latest ( #36325 ) fix(publish): report when the registry rejects a provenance attestation ( #36404 ) fix(resolver): don't treat deno eval modules as npm package files ( #36304 ) fix(runtime): map notify's Windows missing-path error to NotFound ( #35864 ) fix(sync-types): add reason to too_many_arguments allows (lint) fix(telemetry): handle reentrant attribute conversion ( #36256 ) fix(webgpu): own mapped range backing stores ( #36257 ) fix(webstorage): preserve Storage constructor name ( #35944 ) fix: capitalize IP in help text ( #36170 ) fix: upgrade deno_task_shell to 0.33.3 ( #36406 ) fix: wire no-legacy-abort unstable flag from deno.json config ( #36312 ) perf(core): run the common-path tick drain in Rust ( #36157 ) perf(ext/node): bypass dns lookup on literal IPs in udp send ( #35909 ) perf(ext/web): implement base64url encode/decode as simdutf ops ( #36398 )

Improvements and security content

• 2.9.5 / 2026.08.06 feat(add): --unscoped flag to alias packages by their unscoped name ( #36319 ) feat(task): add --members flag to run tasks in workspace members only ( #35748 ) feat: add Blob/Body textStream() ( #35616 ) feat: add experimental QuickJS backend ( #36194 ) fix(bundle): avoid esbuild protocol deadlock ( #36427 ) fix(bundle): respect runtime file permissions ( #36107 ) fix(cjs): use loader sources for recursive analysis ( #36111 ) fix(cli): escape control characters in external metadata ( #36198 ) fix(core): don't resolve internal module imports with the user's import map ( #36303 ) fix(crypto): add "raw-secret" to KeyFormat type ( #35708 ) fix(desktop): handle colored HMR URLs and page loads ( #36316 ) fix(desktop): retain update signature verification op ( #36152 ) fix(ext/crypto): allow deriveBits with length 0 ( #36283 ) fix(ext/napi): polyfill uv_handle_size and uv_strerror ( #36308 ) fix(ext/net): release completed QUIC stream resources ( #36247 ) fix(ext/net): require --allow-sys for node:dns.getServers() ( #35941 ) fix(ext/node): Node compat for web streams ( #36285 ) fix(ext/node): apply backpressure in Readable.toWeb() ( #36321 ) fix(ext/node): defer TLS write completion callback to avoid reentrancy panic ( #35867 ) fix(ext/node): don't fire http2 settings callback after session destroy ( #36230 ) fix(ext/node): gate constrained memory cgroup reads ( #36218 ) fix(ext/node): handle pre-quoted shell arguments ( #36371 ) fix(ext/node): implement node:test tags ( #36292 ) fix(ext/node): implement util.diff ( #36289 ) fix(ext/node): implement v8.promiseHooks API ( #36281 ) fix(ext/node): sort fs.readdir entries to match Node.js ( #36341 ) fix(ext/node): stop http2 file reads after stream close ( #36300 ) fix(ext/node): store blocklist ranges compactly ( #36212 ) fix(ext/node): support the fs flush option for writes ( #36290 ) fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify ( #36326 ) fix(ext/node_crypto): use named group exponent sizes ( #36347 ) fix(ext/web): attach Node error codes to WHATWG API validation errors ( #36288 ) fix(ext/websocket): disable HTTP/2 server push on wss upgrade path ( #36327 ) fix(fetch): scope redirect-sensitive headers by origin ( #36361 ) fix(ffi): reject resizable buffers in nonblocking calls ( #36259 ) fix(fmt): accept xml and svg extensions for stdin ( #36149 ) fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 ( #36397 ) fix(http): preserve stripped headers across redirects ( #36360 ) fix(inspector): validate request host headers ( #36348 ) fix(net): cancel pending writes on stream close ( #36369 ) fix(net): clean up concurrently dropped load-balanced listeners ( #36246 ) fix(net): handle malformed DNS record text ( #36374 ) fix(node): clean up Web Stream finished listeners ( #36227 ) fix(node): retain consumed HTTP stream wrapper ( #36254 ) fix(npm): ignore invalid package bin targets ( #36354 ) fix(npm): tolerate malformed scripts field in packuments ( #36324 ) fix(npmrc): match auth configs by authority and path ( #36359 ) fix(outdated): don't report JSR pre-release versions as latest ( #36325 ) fix(publish): report when the registry rejects a provenance attestation ( #36404 ) fix(resolver): don't treat deno eval modules as npm package files ( #36304 ) fix(runtime): map notify's Windows missing-path error to NotFound ( #35864 ) fix(sync-types): add reason to too_many_arguments allows (lint) fix(telemetry): handle reentrant attribute conversion ( #36256 ) fix(webgpu): own mapped range backing stores ( #36257 ) fix(webstorage): preserve Storage constructor name ( #35944 ) fix: capitalize IP in help text ( #36170 ) fix: upgrade deno_task_shell to 0.33.3 ( #36406 ) fix: wire no-legacy-abort unstable flag from deno.json config ( #36312 ) perf(core): run the common-path tick drain in Rust ( #36157 ) perf(ext/node): bypass dns lookup on literal IPs in udp send ( #35909 ) perf(ext/web): implement base64url encode/decode as simdutf ops ( #36398 )

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence