v2.7.14

🐛 Bug Fixes

• CSS same-document fragment URLs are now treated as external in bundles.
• Added missing CacheStorage.keys() and Cache.keys() methods.
• Workspace members are no longer excluded from deploy file patterns.
• Transformer-injected helpers are now excluded from coverage reports.
• Removed background from operators in dark mode code blocks in documentation.
• Clearer error when Deno.bundle is called in a compiled binary.
• Throw TypeMismatchError for non-TypedArray in crypto.getRand.
• Deno.createHttpClient no longer mutates caller's options.
• Used byte ReadableStream for Node Readable request bodies in fetch.
• Normalized Deno.watchFs paths to drop ./ segments in events.
• Implemented napi_async_init and napi_async_destroy for napi.
• Default Deno.listenDatagram hostname is now 0.0.0.0.
• Accept X.509v1 server certs in tls.createServer.
• Accept string mode in fs.mkdir and fs.mkdirSync.
• Added Server BlockList, asyncDispose, and misc net improvements to node extension.
• Added _idleStart and _idleTimeout to Timeout object in node extension.
• Aligned crypto random* validation with Node.
• Aligned fs.truncate / ftruncate argument validation with Node.
• Aligned module.builtinModules / getBuiltinModule with Node.
• Aligned node:module behavior with Node.
• Aligned node:test `it`/`describe` with Node, enabling passing compat tests.
• Aligned util.styleText with Node.
• Allow https.Agent() without new, enabling passing compat tests.
• async fs.stat/lstat throwIfNoEntry implemented; fs.Stats deprecated.
• Attached input URL to ERR_INVALID_FILE_URL_PATH errors.
• Attached path/syscall to fs.lstat / realpath / link errors.
• Brand-checked SecureContext._external accessor.
• Cached hash digest to survive stream.pipeline.
• Cancelling Readable.toWeb(req) no longer destroys the socket.
• Closed fd on error in http2 stream respondWithFile.
• Corrected buffer-length check in `Readable._fromList` decoder branch.
• Deferred drain in http2 shutdownWritable so pushStream after end() works.
• Drained pending TLS cleartext in enc_write_cb.
• Emitted Buffer for http2 'goaway' opaqueData.
• Emitted StatWatcher 'stop' event asynchronously.
• Emitted TimeoutNaNWarning for invalid timer durations.
• Emitted http2 frameError on send failure with translated HTTP/2 error code.
• Emitted stream-level PROTOCOL_ERROR in node:http2.
• Emitted tlsClientError instead of crashing on TLS init failure.
• Enabled test-als-defaultvalue-original (AsyncLocalStorage default value).
• Encoded http2 headers as Latin-1 to fix response splitting.
• Encoded more chars in url.pathToFileURL().
• Enforced HTTP/2 server header list size limits.
• Enforced http2 maxSessionInvalidFrames limit.
• Exposed http2 sensitive headers received with NV_FLAG_NO_INDEX flag.
• Fixed EEXIST error and data loss in writeFileSync on Windows.
• Fixed ERR_INVALID_CHAR message & OutgoingMessage.prototype.write.
• Fixed TLS client certificate authentication verification.
• Fixed TLS socket error ordering and app data leak before identity verification.
• Fixed TLS socket lifecycle and readStop backpressure.
• Fixed closeIdleConnections destroying active connections.
• Fixed fs.glob skipping siblings with *_/../_ patterns.
• Fixed spawnSync internal API for monkey-patching and killSignal.
• Flushed GOAWAY before destroying http2 socket and exposed internal/http2/core.
• Flushed HTTP/2 client preface after settings submission.
• Forwarded enableConnectProtocol setting to peer in HTTP/2 SETTINGS frame.
• Handled undefined http2 ping payload and cancelled pending pings on destroy.
• Hid aggregateTwoErrors frame in AggregateError stack.
• Honored http2 strictFieldWhitespaceValidation option.
• Honored requestCert/ca on node:tls server, populated getPeerCertificate().
• Honored weight option in http2 client.request.
• Implemented http2 createConnection support and per-frame socket writes.
• Implemented BlockList.rules / isBlockList / toJSON / from
• Implemented Socket.resetAndDestroy with TCP RST in node:net.
• Implemented StatWatcher.ref() / unref().
• Implemented dns Resolver cancel() and timeout support.
• Implemented dns.reverse() and fixed dns.lookup() family parameter.
• Implemented fs.mkdtempDisposableSync / fsPromises.mkdtempDisposable.
• Implemented node:cluster fork/Worker and worker-side detection.
• Implemented process.debugPort with ToInt32 coercion.
• Imported kIncomingMessage/kServerResponse in http2 allowHTTP1 fallback.
• Improved Node.js timer compatibility.
• Improved perf_hooks timerify and added missing exports.
• Included accepted values in Console colorMode error.
• Isolated parentPort from globalThis in worker_threads.
• Made Buffer.prototype methods generic-callable.
• Made http2 session.origin() round-trip origins and respect TLS servername.
• Made process.constructor a proper instanceof check.
• Named custom-promisified functions after their originals.
• Used null-proto child_process options to block prototype pollution.
• Passed reusePort flags in Server.listen() without host.
• Passed signal name to process signal handlers.
• Passed stream fd to child process stdio instead of inheriting.
• Plumbed llhttp error code, reason, and bytes parsed through HTTPParser.
• Prevented duplicate close emit when http2 client socket.
• Re-armed Windows named pipe server after accept.
• Rebound http2 state buffers post-snapshot, enforced maxHeaderListPairs.
• Rejected non-ArrayBufferView data in fs.writeFileSync.
• Renamed _destroySsl to _destroySSL to match Node.js API.
• Replaced unwrap with error propagation in parallel cp.
• Returned relative path from fs.watch with recursive option.