v2.9.4

🐛 Bug Fixes

• Support `--minimum-dependency-age` flag in `deno add`/`remove`.
• Store Web Cache under origin data.
• Require FFI permission for native window handles in canvas.
• Reject symlinked `node_modules` cleanup roots.
• Bump `libsui` to 0.16.4 to fix Windows `Resource SizeOfImage`.
• Allow dynamic imports during cached module evaluation.
• Bound error graph conversion.
• Enforce JSON requests in `FsModuleLoader`.
• Handle malformed error constructors.
• Stop rejected dynamic imports before loading.
• Make `BrowserWindow` bindings typeable in desktop builds.
• Preserve binding wrappers after lazy op upgrade in desktop builds.
• Strip runtime extension from app name in desktop builds.
• Cancel async sends after close in N-API extensions.
• Scope callback info per invocation in N-API extensions.
• Apply backpressure to `http2` stream writes in Node.js extensions.
• Avoid leaving 0-byte `.heapsnapshot` files near the heap limit in Node.js extensions.
• Implement `worker_threads.locks` via Web Locks in Node.js extensions.
• Validate `backup()` and `deserialize()` arguments for `node:sqlite` in Node.js extensions.
• Retry DNS query when its per-attempt timeout fires in Node.js extensions.
• Stop `http2` file reads on stream close in Node.js extensions.
• Handle failed `WebTransport` datagram setup.
• Implement `async_sequence` for `ReadableStream.from` in WebIDL extensions.
• Bound multipart part headers in fetch.
• Keep embedded CSS custom property indentation stable in formatting.
• Require sys permission for `umask`.
• Preserve `trust proxy` environment setting in http.
• Validate temporary `node_modules` parent.
• Report `codemirror_mode` as a string in Jupyter.
• Reject non-JSON modules for JSON imports in loader.
• Synchronize external string finalizers in N-API.
• Clean up cancellation resources on early errors in net.
• Limit `WebTransport` handshake frame buffering.
• Clean up destroyed sessions in `node_http2`.
• Handle CJS filesystem path edge cases in `node_resolver`.
• Handle Web Stream adapter errors in `node_stream`.
• Avoid following lock poll symlinks in npm.
• Download tarballs from the configured registry instead of `registry.npmjs.org` in npm.
• Reject symlinked package materialization directories in npm.
• Keep type-only dependencies in the lockfile when outdated.
• Support file paths longer than the tar name field in pack.
• Escape bidi controls in prompts for permissions.
• Avoid collisions in Windows stdio pipe names.
• Constrain generated source rewrites in publish.
• Insert into `versions.json` in semver order.
• Isolate extracted native addons in runtime.
• Bridge console to the inspector regardless of `--inspect` flag in runtime.
• Give worker isolate threads the stack size we report in runtime.
• Escape control characters in test names.
• Make npm test registry tolerate a bad advisories request body.
• Resolve SNI requests concurrently in TLS.
• Don't downgrade lockfile when npm cache is stale.
• Avoid URL parse panic in `webtransport`.
• Validate certificate dates in `webtransport`.
• Honor `--minimum-dependency-age` and `deno.json` `minimumDependencyAge`.
• Discover config file for JSR entrypoints.
• Handle UTF-16 diagnostic columns.