2.9.7 / 2026.09.16
- fix(audit): honor configured CA stores (#36728)
- fix(cache): make HTTP authority paths unambiguous (#36356)
- fix(cli): accept all valid sys permission descriptors (#36753)
- fix(cli): don't duplicate passthrough args for deno deploy/sandbox (#36722)
- fix(cli): generate valid bash completions (#36736)
- fix(cli): preserve double dash before the entrypoint (#36835)
- fix(cli): restore optional-value semantics for deno bundle --sourcemap
(#36723) - fix(completions): keep the dash on short flags in zsh completions (#36720)
- fix(desktop): complete deferred window close and fix NAPI symbol export on
Linux (#36718) - fix(ext/http): extract traceparent from Deno.serve regardless of header name
case (#36840) - fix(ext/node): allow repeated child process signals (#36644)
- fix(ext/node): check resolved IP against net deny list in tcp_wrap bind
(#36482) - fix(ext/node): don't panic on prime sizes below 2 bits (#36400)
- fix(ext/node): improve node:dns error codes and lookupService/setLocalAddress
compat (#36552) - fix(ext/node): normalize resourceUsage maxRSS on macOS (#36784)
- fix(install): validate lockfile tarball registry paths (#36473)
- fix(lsp): resolve the newest prerelease of jsr packages that have no stable
release (#36655) - fix(net): check permissions for multicast membership (#36529)
- fix(node): align IncomingMessage header map prototypes (#36438)
- fix(node): preserve AsyncLocalStorage exit context (#36464)
- fix(npm): correct the pnpm lockfile import against real-world lockfiles
(#36727) - fix(npm): validate lockfile tarball origins (#36430)
- fix(permissions): fold unix socket paths for case-insensitive filesystems
(#36553) - fix(permissions): parse unix: net rules as POSIX paths (#36785)
- fix(process): clear supplementary groups before changing identity (#36433)
- fix(sqlite): refuse symlink database paths (#36357)
- fix(transpile): don't report diagnostics from bundled assets in declaration
emit (#36716) - fix(web): avoid flushing compression streams on every write (#36744)
- fix: add missing property desktop.app.identifier (#36774)
- fix: hash source contents for V8 code cache (#36743)
- fix: point JSON schema $id values at the maintained GitHub raw endpoint
(#36747) - fix: toplevel fetch/cron leak its spans (#36757)
- fix: validate --ignore-scripts package selectors (#36742)
- perf(core): drop dead module-graph retention (#36683)
- perf(core): make extension op tables const in static memory (#36696)
- perf(core): split OpCtx into shared OpCommonCtx + borrowed op declarations
(#36693) - perf(ext/node): Buffer hex paths via native Uint8Array toHex/setFromHex
(#36531)