DENO-2.9.6 release notes and known issues

Summary

2.9.6 / 2026.08.27 feat(compressible): add support for 'text/x-component' content type ( #36450 ) feat(desktop): clipboard api ( #35750 ) feat(desktop): support checked, icon, and tooltip on menu items ( #36649 ) fix(bundle): isolate esbuild downloads from workspace registries ( #36467 ) fix(cache): combine duplicate headers for Vary matching ( #36476 ) fix(cli_parser): remove orphaned sync-types parser fix(core): cap adaptive buffer initial allocations ( #36432 ) fix(core): make Unix pipe fd ownership explicit ( #36353 ) fix(core): make user timer waker state thread-safe ( #36495 ) fix(coverage): compare a range against a line in V8's units ( #36613 ) fix(crypto): preserve RSA-OAEP label bytes ( #36441 ) fix(desktop): keep dots in the app name when resolving the runtime library ( #36006 ) fix(desktop): keep the macOS bundle signature valid unless an update is applied ( #36574 ) fix(desktop): never block the JS thread on the error-report dialog ( #36575 ) fix(desktop): propagate deno.json version and license into packaged installers ( #36577 ) fix(desktop): run Vite-based HMR dev servers inside the desktop runtime ( #36488 ) fix(desktop): transport binding args and results as DesktopValue so Uint8Array survives ( #36573 ) fix(ext/fetch): enforce permissions for proxy transports ( #36217 ) fix(ext/fetch): only retry transport errors on pooled connections ( #36415 ) fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB ( #36558 ) fix(ext/http): keep request body readable after response is sent ( #36629 ) fix(ext/http): route invalid async responses to onError ( #36437 ) fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown ( #36556 ) fix(ext/napi): run JS-calling finalizers safely, NULL string result, and Float16Array ( #36572 ) fix(ext/napi): surface OS error and path on addon load failure ( #36630 ) fix(ext/napi): track pending finalizers by identity ( #36551 ) fix(ext/napi): wake the event loop at the next uv_timer deadline ( #36559 ) fix(ext/net): skip unsupported DNS records in ANY queries ( #36650 ) fix(ext/node): accept string ports in dns.lookupService ( #36546 ) fix(ext/node): build the proxied request target with the URL parser ( #36557 ) fix(ext/node): do not resume client TLS sessions unless requested ( #36592 ) fix(ext/node): fix perf_hooks detail.req.url proxied path duplication ( #36407 ) fix(ext/node): handle readv short reads ( #36211 ) fix(ext/node): require sys permission for inspector.open ( #36465 ) fix(ext/node_sqlite): invalidate sessions on database close ( #36633 ) fix(ext/tls): avoid panic for mismatched client certificate and key ( #36457 ) fix(ext/web): clean up abort handlers when listeners are removed ( #36226 ) fix(ext/web): close transfer MessagePort when a transferred readable is cancelled ( #36270 ) fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode() ( #36611 ) fix(fetch): require an initial multipart boundary ( #36470 ) fix(ffi): validate struct return buffers ( #36373 ) fix(fmt): honor .editorconfig when formatting from stdin ( #36267 ) fix(fs): require write permission for creating opens ( #36497 ) fix(fs): use a private FsFile constructor token ( #36439 ) fix(glob): retain valid gitignore rules after parse errors ( #36478 ) fix(http): preserve keep-alive after reading request body ( #36690 ) fix(http): truncate streaming responses to content length ( #36496 ) fix(lsp): restrict registry completion endpoint schemes ( #36477 ) fix(node): check reads during require resolution ( #36461 ) fix(node): match domain uncaught exception handling ( #36475 ) fix(node): preserve v8 deserializer view offsets ( #36460 ) fix(node): validate Brotli encoder operations ( #36530 ) fix(node): validate raw outgoing HTTP headers ( #36471 ) fix(node/crypto): preserve binary key export passphrases ( #36443 ) fix(node_crypto): apply RFC 7748 scalar decoding for X448 ( #36466 ) fix(node_crypto): size cipher updates by byte length ( #36459 ) fix(node_shim): preserve e

Improvements and security content

• 2.9.6 / 2026.08.27 feat(compressible): add support for 'text/x-component' content type ( #36450 ) feat(desktop): clipboard api ( #35750 ) feat(desktop): support checked, icon, and tooltip on menu items ( #36649 ) fix(bundle): isolate esbuild downloads from workspace registries ( #36467 ) fix(cache): combine duplicate headers for Vary matching ( #36476 ) fix(cli_parser): remove orphaned sync-types parser fix(core): cap adaptive buffer initial allocations ( #36432 ) fix(core): make Unix pipe fd ownership explicit ( #36353 ) fix(core): make user timer waker state thread-safe ( #36495 ) fix(coverage): compare a range against a line in V8's units ( #36613 ) fix(crypto): preserve RSA-OAEP label bytes ( #36441 ) fix(desktop): keep dots in the app name when resolving the runtime library ( #36006 ) fix(desktop): keep the macOS bundle signature valid unless an update is applied ( #36574 ) fix(desktop): never block the JS thread on the error-report dialog ( #36575 ) fix(desktop): propagate deno.json version and license into packaged installers ( #36577 ) fix(desktop): run Vite-based HMR dev servers inside the desktop runtime ( #36488 ) fix(desktop): transport binding args and results as DesktopValue so Uint8Array survives ( #36573 ) fix(ext/fetch): enforce permissions for proxy transports ( #36217 ) fix(ext/fetch): only retry transport errors on pooled connections ( #36415 ) fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB ( #36558 ) fix(ext/http): keep request body readable after response is sent ( #36629 ) fix(ext/http): route invalid async responses to onError ( #36437 ) fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown ( #36556 ) fix(ext/napi): run JS-calling finalizers safely, NULL string result, and Float16Array ( #36572 ) fix(ext/napi): surface OS error and path on addon load failure ( #36630 ) fix(ext/napi): track pending finalizers by identity ( #36551 ) fix(ext/napi): wake the event loop at the next uv_timer deadline ( #36559 ) fix(ext/net): skip unsupported DNS records in ANY queries ( #36650 ) fix(ext/node): accept string ports in dns.lookupService ( #36546 ) fix(ext/node): build the proxied request target with the URL parser ( #36557 ) fix(ext/node): do not resume client TLS sessions unless requested ( #36592 ) fix(ext/node): fix perf_hooks detail.req.url proxied path duplication ( #36407 ) fix(ext/node): handle readv short reads ( #36211 ) fix(ext/node): require sys permission for inspector.open ( #36465 ) fix(ext/node_sqlite): invalidate sessions on database close ( #36633 ) fix(ext/tls): avoid panic for mismatched client certificate and key ( #36457 ) fix(ext/web): clean up abort handlers when listeners are removed ( #36226 ) fix(ext/web): close transfer MessagePort when a transferred readable is cancelled ( #36270 ) fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode() ( #36611 ) fix(fetch): require an initial multipart boundary ( #36470 ) fix(ffi): validate struct return buffers ( #36373 ) fix(fmt): honor .editorconfig when formatting from stdin ( #36267 ) fix(fs): require write permission for creating opens ( #36497 ) fix(fs): use a private FsFile constructor token ( #36439 ) fix(glob): retain valid gitignore rules after parse errors ( #36478 ) fix(http): preserve keep-alive after reading request body ( #36690 ) fix(http): truncate streaming responses to content length ( #36496 ) fix(lsp): restrict registry completion endpoint schemes ( #36477 ) fix(node): check reads during require resolution ( #36461 ) fix(node): match domain uncaught exception handling ( #36475 ) fix(node): preserve v8 deserializer view offsets ( #36460 ) fix(node): validate Brotli encoder operations ( #36530 ) fix(node): validate raw outgoing HTTP headers ( #36471 ) fix(node/crypto): preserve binary key export passphrases ( #36443 ) fix(node_crypto): apply RFC 7748 scalar decoding for X448 ( #36466 ) fix(node_crypto): size cipher updates by byte length ( #36459 ) fix(node_shim): preserve e

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence