v2.9.5

2.9.5 / 2026.08.06

• feat(add): --unscoped flag to alias packages by their unscoped name (#36319)
• feat(task): add --members flag to run tasks in workspace members only (#35748)
• feat: add Blob/Body textStream() (#35616)
• feat: add experimental QuickJS backend (#36194)
• fix(bundle): avoid esbuild protocol deadlock (#36427)
• fix(bundle): respect runtime file permissions (#36107)
• fix(cjs): use loader sources for recursive analysis (#36111)
• fix(cli): escape control characters in external metadata (#36198)
• fix(core): don't resolve internal module imports with the user's import map
  (#36303)
• fix(crypto): add "raw-secret" to KeyFormat type (#35708)
• fix(desktop): handle colored HMR URLs and page loads (#36316)
• fix(desktop): retain update signature verification op (#36152)
• fix(ext/crypto): allow deriveBits with length 0 (#36283)
• fix(ext/napi): polyfill uv_handle_size and uv_strerror (#36308)
• fix(ext/net): release completed QUIC stream resources (#36247)
• fix(ext/net): require --allow-sys for node:dns.getServers() (#35941)
• fix(ext/node): Node compat for web streams (#36285)
• fix(ext/node): apply backpressure in Readable.toWeb() (#36321)
• fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
  (#35867)
• fix(ext/node): don't fire http2 settings callback after session destroy
  (#36230)
• fix(ext/node): gate constrained memory cgroup reads (#36218)
• fix(ext/node): handle pre-quoted shell arguments (#36371)
• fix(ext/node): implement node:test tags (#36292)
• fix(ext/node): implement util.diff (#36289)
• fix(ext/node): implement v8.promiseHooks API (#36281)
• fix(ext/node): sort fs.readdir entries to match Node.js (#36341)
• fix(ext/node): stop http2 file reads after stream close (#36300)
• fix(ext/node): store blocklist ranges compactly (#36212)
• fix(ext/node): support the fs flush option for writes (#36290)
• fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#36326)
• fix(ext/node_crypto): use named group exponent sizes (#36347)
• fix(ext/web): attach Node error codes to WHATWG API validation errors (#36288)
• fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#36327)
• fix(fetch): scope redirect-sensitive headers by origin (#36361)
• fix(ffi): reject resizable buffers in nonblocking calls (#36259)
• fix(fmt): accept xml and svg extensions for stdin (#36149)
• fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#36397)
• fix(http): preserve stripped headers across redirects (#36360)
• fix(inspector): validate request host headers (#36348)
• fix(net): cancel pending writes on stream close (#36369)
• fix(net): clean up concurrently dropped load-balanced listeners (#36246)
• fix(net): handle malformed DNS record text (#36374)
• fix(node): clean up Web Stream finished listeners (#36227)
• fix(node): retain consumed HTTP stream wrapper (#36254)
• fix(npm): ignore invalid package bin targets (#36354)
• fix(npm): tolerate malformed scripts field in packuments (#36324)
• fix(npmrc): match auth configs by authority and path (#36359)
• fix(outdated): don't report JSR pre-release versions as latest (#36325)
• fix(publish): report when the registry rejects a provenance attestation
  (#36404)
• fix(resolver): don't treat deno eval modules as npm package files (#36304)
• fix(runtime): map notify's Windows missing-path error to NotFound (#35864)
• fix(sync-types): add reason to too_many_arguments allows (lint)
• fix(telemetry): handle reentrant attribute conversion (#36256)
• fix(webgpu): own mapped range backing stores (#36257)
• fix(webstorage): preserve Storage constructor name (#35944)
• fix: capitalize IP in help text (#36170)
• fix: upgrade deno_task_shell to 0.33.3 (#36406)
• fix: wire no-legacy-abort unstable flag from deno.json config (#36312)
• perf(core): run the common-path tick drain in Rust (#36157)
• perf(ext/node): bypass dns lookup on literal IPs in udp send (#35909)
• perf(ext/web): implement base64url encode/decode as simdutf ops (#36398)
• perf(fs): open files on the blocking pool in async readFile/writeFile (#36160)
• perf: order startup functions in release builds (#36219)
• perf: reduce eager module evaluation at startup (#36331)
• perf: remove Linux unwind tables from release artifacts (#36265)