v2.9.3

🐛 Bug Fixes

• Preserve raw imports in watch mode for bundling.
• Prevent holding SurfaceData mut borrow over window resize in canvas.
• Reject out-of-range minimum dependency ages in config.
• Block user external imports after resolution in core.
• Deactivate idle TTY write handles in core.
• Restrict extension loaders to internal modules in core.
• Root slow op string coercions in core.
• Prevent op_desktop_send_error_report from targeting caller-supplied URLs in desktop.
• Don't panic recycling cancelled record on native response in ext/http.
• Don't free threadsafe function on abort while refs remain in ext/napi.
• Don't resurrect a released threadsafe function in acquire in ext/napi.
• Guard sqlite deserialize during callbacks in ext/node.
• Handle UTF-16 assert source positions in ext/node.
• Handle sqlite conversion failures in ext/node.
• Respect base64 buffer ranges in ext/node.
• Don't double-close extra stdio pipe handles on Windows in ext/process.
• Respect lint rule exclusion for no-slow-types diagnostics in lsp.
• Stop active read on stream close to avoid leaking Socket/TCPWrap in node.
• Keep header validation enabled in node_http2.
• Validate serialized headers in node_http2.
• Don't fetch registry info for deprecated packages under --cached-only in npm.
• Normalize path in BYONM read permission check in npm.
• Hint about minimumDependencyAge when no version is old enough in pm.
• Only strip Mach-O signature for x86_64-apple-darwin in release.
• Strip Mach-O signature before patchver on apple targets in release.
• Guard usage op output buffers in runtime.
• Handle deserialization exceptions in serde_v8.
• Guard encodeInto fallback result buffer in web.
• Support Event subclasses with readonly toStringTag in web.
• Remove imported ops during bootstrap in worker.
• Don't print duplicate parse diagnostics.