v2.9.6

🐛 Bug Fixes

• Isolated esbuild downloads from workspace registries.
• Combined duplicate headers for Vary matching in cache.
• Removed orphaned sync-types parser.
• Capped adaptive buffer initial allocations.
• Made Unix pipe fd ownership explicit.
• Made user timer waker state thread-safe.
• Compared a range against a line in V8's units for coverage.
• Preserved RSA-OAEP label bytes.
• Kept dots in the app name when resolving the runtime library for desktop.
• Kept the macOS bundle signature valid unless an update is applied for desktop.
• Never blocked the JS thread on the error-report dialog for desktop.
• Propagated deno.json version and license into packaged installers for desktop.
• Ran Vite-based HMR dev servers inside the desktop runtime.
• Transported binding args and results as DesktopValue so Uint8Array survives for desktop.
• Enforced permissions for proxy transports in ext/fetch.
• Only retried transport errors on pooled connections in ext/fetch.
• Raised default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB in ext/fetch.
• Kept request body readable after response is sent in ext/http.
• Routed invalid async responses to onError in ext/http.
• Did not invoke napi_wrap finalizer twice at teardown in ext/napi.
• Ran JS-calling finalizers safely, handled NULL string result, and Float16Array in ext/napi.
• Surfaced OS error and path on addon load failure in ext/napi.
• Tracked pending finalizers by identity in ext/napi.
• Woke the event loop at the next uv_timer deadline in ext/napi.
• Skipped unsupported DNS records in ANY queries in ext/net.
• Accepted string ports in dns.lookupService in ext/node.
• Built the proxied request target with the URL parser in ext/node.
• Did not resume client TLS sessions unless requested in ext/node.
• Fixed perf_hooks detail.req.url proxied path duplication in ext/node.
• Handled readv short reads in ext/node.
• Required sys permission for inspector.open in ext/node.
• Invalidated sessions on database close in ext_node_sqlite.
• Avoided panic for mismatched client certificate and key in ext/tls.
• Cleaned up abort handlers when listeners are removed in ext/web.
• Closed transfer MessagePort when a transferred readable is cancelled in ext/web.
• Snapped SharedArrayBuffer input in TextDecoder.decode() in ext/web.
• Required an initial multipart boundary for fetch.
• Validated struct return buffers for ffi.
• Honored .editorconfig when formatting from stdin.
• Required write permission for creating opens in fs.
• Used a private FsFile constructor token in fs.
• Retained valid gitignore rules after parse errors in glob.
• Preserved keep-alive after reading request body in http.
• Truncated streaming responses to content length in http.
• Restricted registry completion endpoint schemes in lsp.
• Checked reads during require resolution in node.
• Matched domain uncaught exception handling in node.
• Preserved v8 deserializer view offsets in node.
• Validated Brotli encoder operations in node.
• Validated raw outgoing HTTP headers in node.
• Preserved binary key export passphrases in node/crypto.
• Applied RFC 7748 scalar decoding for X448 in node_crypto.
• Sized cipher updates by byte length in node_crypto.
• Preserved explicit argument delimiters in node_shim.
• Flattened single-resolution peers when building package ids in npm.
• Matched peer fallbacks when checking peer resolution cache in npm.
• Removed arrayref dependency.
• Resolved bare npm specifier when latest is too new for min dependency age in npm.
• Used cached abbreviated metadata under --cached-only in npm.
• Validated tar paths before extraction in npm.
• Serialized process environment updates in os.
• Checked resolved IP against import deny list for permissions.
• Rejected NULs in Windows arguments.
• Validated whitespace-only loader environment values.
• Authenticated the package existence check so private packages work for publish.
• Memoized publish order depth.
• Rejected invalid JSR package names for publish.
• Skipped regex literals when validating input in repl.
• Unregistered dropped signal resources.
• Kept MessagePort resource identifiers private in web.
• Fixed bugs in primordials related to `ObjectCreate` and `ObjectDefineProperties`.
• Prevented threadpool starvation with concurrent file locks.