2.8.3 / 2026.06.11

• feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate (#34756)
• feat(cli): support --env-file in dependency and registry subcommands (#34843)
• feat(compile): support watch mode (#34860)
• feat(config): support globs in links (#34849)
• feat(ext/crypto): implement SubtleCrypto.supports() static method (#34903)
• feat(ext/crypto): support ML-DSA JWK import/export (#34914)
• feat(ext/fetch): support priority in RequestInit (#34716)
• feat(ext/node): auto-instrument node:http2 with OpenTelemetry (#34510)
• feat(ext/node): notify control socket when node:http server starts serving (#34949)
• feat(ext/telemetry): honor OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT (#34787)
• feat(ext/telemetry): honor OTEL_SPAN_EVENT_COUNT_LIMIT (#34795)
• feat(ext/telemetry): support OTEL_TRACES_SAMPLER (#34764)
• feat(fmt): add JSON trailing comma config (#33383)
• feat(info): add localPath to npm packages in deno info --json (#34806)
• feat(info): support --minimum-dependency-age flag (#34762)
• feat(lsp): add "Debug" code lens for test steps (#34742)
• feat(lsp): add Deno.test ignore and only code actions (#34861)
• feat(lsp): diagnose import map files (#34864)
• feat(lsp): provide hover info for import map resolutions (#34854)
• feat(lsp): report deno doc --lint diagnostics (#34733)
• feat(lsp): show no-slow-types diagnostics for JSR packages (#34740)
• feat(outdated): warn about packages skipped due to registry errors (#34974)
• feat(test): forward shebang permissions into deno test --doc (#35052)
• feat(workspace): auto-discover external deno.json import maps (#34803)
• feat(x): add deno x --ignore-scripts (#34952)
• feat: bump-version -c to handle deno.json + package.json in same dir (#34770)
• fix(add): accept npm version ranges on the command line (#34799)
• fix(bundle): apply node-style CJS interop on all platforms (#34939)
• fix(bundle): don't panic when esbuild binary is busy or unavailable (#34845)
• fix(bundle): instantiate .wasm imports instead of emitting raw bytes (#34923)
• fix(bundle): rename sourcemap for HTML entrypoints (#34901)
• fix(bundle): respect --check and run the type checker (#33514)
• fix(cache): retry locked cache database instead of deleting it (#34873)
• fix(check): honor ts suppressions for unresolved imports (#34163)
• fix(check): ignore doc comment dynamic imports (#34888)
• fix(check): surface unresolved imports in .d.ts entrypoints (#34168)
• fix(check): treat .d.ts in ESM-supporting npm packages as ESM (#34613)
• fix(clean): keep cleaning when cache files are locked and report holders (#34946)
• fix(clean): support deno clean --dry-run without --except (#34846)
• fix(cli): accept allow-import for deno add (#35019)
• fix(cli): check worker's own permissions for dynamic asset imports (#34707)
• fix(cli): collect re-exported names for deno test --doc injection (#33511)
• fix(cli): don't let --env-file set Deno's own runtime control vars (#35032)
• fix(cli): don't suggest non-existent subcommand-flag combinations (#34810)
• fix(cli): generate type-only doc-test imports under verbatimModuleSyntax (#33508)
• fix(cli): include the typed name in unrecognized subcommand error (#34882)
• fix(cli): strip trailing CR from args so CRLF shebangs work (#34968)
• fix(compile): prune managed npm snapshot to graph-reachable packages (#34741)
• fix(compile): resolve bare npm imports in --bundle worker sources (#34967)
• fix(compile): run forked child's module instead of entrypoint (#34687)
• fix(compile): support fs.fstatSync on vfs (#34892)
• fix(console): %c colors with same red component as previous color (#34784)
• fix(core): don't set ERR_MODULE_NOT_FOUND code on module linking errors (#34800)
• fix(core): externalize lazy loaded sources (#34936)
• fix(core): silence too_many_arguments on Callable trait method (#33475)
• fix(core): use isolate_unchecked accessors for fast &v8::Isolate args (#33474)
• fix(coverage): exclude linked/patched packages from coverage report (#34834)
• fix(coverage): improve HTML report PageSpeed score (#34980)
• fix(dotenv): include underscore in unbraced variable names (#34797)
• fix(ext/crypto): ChaCha20-Poly1305 uses raw-secret format and iv param (#34915)
• fix(ext/crypto): ML-KEM raw-seed, seed-form PKCS#8, and JWK (#34924)
• fix(ext/crypto): align WebCrypto modern algorithms with the spec (#34941)
• fix(ext/crypto): move getPublicKey to SubtleCrypto and validate usages (#34913)
• fix(ext/crypto): support raw-public format for existing asymmetric keys (#34920)
• fix(ext/crypto): use outputLength for SHAKE/cSHAKE/TurboSHAKE digests (#34911)
• fix(ext/fetch): block requests to bad ports per Fetch Standard (#34863)
• fix(ext/fetch): don't decompress empty body advertised as gzip/br (#34880)
• fix(ext/fetch): only match multipart delimiter lines (#34587)
• fix(ext/fetch): preserve empty multipart filenames (#35009)
• fix(ext/ffi): accept Uint8Array in FFI buffer types (#34999)
• fix(ext/fs): clarify that Deno.symlink() needs unscoped permissions (#34991)
• fix(ext/fs): report broken symlink read as NotFound, not FilesystemLoop (#34833)
• fix(ext/fs): stream Deno.readDir entries (#35130)
• fix(ext/http): don't crash server on dead streaming-body resource (#34933)
• fix(ext/http): include buffered request bytes in size hint (#34831)
• fix(ext/http): join split request headers consistently (#35081)
• fix(ext/http): prefer brotli for equal compression q-values (#35011)
• fix(ext/http): surface errors thrown while streaming a Deno.serve body (#35104)
• fix(ext/io): cancel pending readable stream reads (#34986)
• fix(ext/kv): update access_token error message to new deno deploy console (#34918)
• fix(ext/kv): validate batchSize and expireIn inputs (#34782)
• fix(ext/net): handle missing port and path in listen and listenDatagram (#31681)
• fix(ext/node): accept non-canonical RSA SPKI keys (#34134)
• fix(ext/node): accept scoped IPv6 interface in dgram addMembership (#34899)
• fix(ext/node): bump emulated Node version to v24.15.0 (#34804)
• fix(ext/node): clear nonblocking fd stdio for child pipes (#34962)
• fix(ext/node): count forked child process sockets (#34096)
• fix(ext/node): don't cache a pointer to the zlib result buffer (#35043)
• fix(ext/node): don't expose Module.register stub (#34894)
• fix(ext/node): enforce maxBuffer in child_process.spawnSync (#34053)
• fix(ext/node): export runMain from node:module (#35065)
• fix(ext/node): fix asciiSlice & ucs2Slice & hexSlice being too slow (#34525)
• fix(ext/node): fix broken encoding validation in indexOfBuffer (#33393)
• fix(ext/node): guard TCPWrap.open against adopting tracked fds (#35045)
• fix(ext/node): guard sqlite authorizer reentrant replacement (#34983)
• fix(ext/node): handle EMFILE in child_process.spawn and compound shell commands (#33544)
• fix(ext/node): implement mock.property() in node:test (#34959)
• fix(ext/node): implement setKeepAlive on native TCPWrap (#34865)
• fix(ext/node): implement url.fileURLToPathBuffer (#34883)
• fix(ext/node): keep node:vm ContextifyContext wrapper alive with its context (#35090)
• fix(ext/node): keep sqlite iterator callbacks alive (#34982)
• fix(ext/node): keep v8.serialize output readable by Node.js (#35118)
• fix(ext/node): keep worker alive while holding a refed MessagePort (#34877)
• fix(ext/node): match Node's UTF-8 replacement for invalid bytes in Buffer decode (#34947)
• fix(ext/node): match Node.js when dns.lookup hostname is falsy (#34887)
• fix(ext/node): propagate nextLoad(newUrl) redirect to default loader (#35027)
• fix(ext/node): read proxy env vars without --allow-env (#34807)
• fix(ext/node): replay direct writes on stale http retry (#34992)
• fix(ext/node): support ChildProcess.send with net.Server handles (#34948)
• fix(ext/node): throw ERR_UNKNOWN_BUILTIN_MODULE for unknown node: builtins (#34766)
• fix(ext/node): trace v8 deserializer delegate (#34981)
• fix(ext/node): transfer TCP handle ownership in http2 consumeStream (#35047)
• fix(ext/node): unblock static module loads when registerHooks is active (#35026)
• fix(ext/node): wire ConnectionsList hooks so headersTimeout doesn't spuriously fire (#34356)
• fix(ext/node_crypto): support PBES2/AES-CBC bags in tls.createSecureContext pfx (#34438)
• fix(ext/os): don't expose invalid env var keys from Deno.env.toObject() (#34711)
• fix(ext/process): run shebang-less scripts via /bin/sh on ENOEXEC (#34945)
• fix(ext/process): treat Windows kill on exited process as NotFound (#34889)
• fix(ext/web): URL.createObjectURL throws ERR_INVALID_ARG_TYPE for non-Blob args (#34878)
• fix(ext/web): clearer error when a resource-backed stream is consumed after close (#34964)
• fix(ext/web): don't trip debugger on handled stream writer-release rejection (#35100)
• fix(ext/web): fire FileReader progress events as tasks (#34763)
• fix(ext/web): friendlier URLPattern construction errors (#35102)
• fix(ext/web): repair text_decoder_stream bench after BlobStoreTrait change (#35044)
• fix(ext/web): show state and supportsBYOB in ReadableStream inspect (#34932)
• fix(ext/web): support SharedArrayBuffer over BroadcastChannel (#34961)
• fix(ext/web): writableStreamForRid accepts any ArrayBufferView/ArrayBuffer (#35020)
• fix(ext/webgpu): bounds-check + view-aware setBindGroup Uint32Array fast path (#33980)
• fix(ext/webgpu): update published crate repository url (#33916)
• fix(ext/websocket): send URL userinfo as Basic auth header (#34708)
• fix(fmt): align singleBodyPosition schema values (#34304)
• fix(fmt): pass newlineKind option to JSON and Markdown formatters (#32579)
• fix(http): handle raw h1 serve regressions (#35049)
• fix(info): normalize trailing spaces in file path args on Windows (#35008)
• fix(inspector): attribute idle event-loop wait to (idle) in CPU profiles (#35034)
• fix(install): handle ETXTBSY when setting up node_modules (#33311)
• fix(install): preserve workspace member resolution in global install (#34989)
• fix(install): suppress peer dependency warnings for overridden packages (#34935)
• fix(jupyter): handle completion cursor_pos as Unicode codepoints (#35098)
• fix(jupyter): verify HMAC signatures on incoming kernel messages (#34825)
• fix(lint): helpful error for Deno.lint.runPlugin outside deno test (#35018)
• fix(lint): name the offending plugin in lint plugin load errors (#35067)
• fix(lockfile): write through deno.lock symlink instead of replacing it (#34826)
• fix(lsp): cache JSR type roots (#34886)
• fix(lsp): evict on-disk documents from cache when deleted or changed (#34858)
• fix(lsp): ignore relative import map remaps (#34856)
• fix(lsp): prefer exact import map remaps (#34855)
• fix(lsp): start rename after extract refactors (#34832)
• fix(lsp): suggest import map aliases for remaps (#34857)
• fix(lsp): update cache after workspace folder changes (#32823)
• fix(net): preserve unix abstract socket paths (#34874)
• fix(npm): resolve workspace members with prerelease versions (#34928)
• fix(npm): run workspace package lifecycle scripts (#34615)
• fix(npm): support workspace: dependencies with an alias in package.json (#34990)
• fix(ops): build fast-call errors without re-entering JS (#35042)
• fix(outdated): include catalog dependencies in deno outdated/update (#34977)
• fix(outdated): send npm Accept header when fetching package metadata (#35012)
• fix(permissions): allow non-recursive reads/writes on ancestors of deny (#34504)
• fix(permissions): correct -A wording in raw-mode prompt message (#35070)
• fix(permissions): don't hang prompt when stdin is in raw mode (#34457)
• fix(permissions): run special-file guard for no-follow ops (#34393)
• fix(publish): allow stable text imports (#34692)
• fix(publish): catch banned triple slash directives anywhere in file during dry-run (#35010)
• fix(publish): detect circular workspace dependencies before authorization (#34823)
• fix(publish): ignore unused type parameter diagnostics from fast check (#35017)
• fix(publish): improve error reporting for JSR manifest verification (#34690)
• fix(publish): preserve default export of export * re-exported module (#34709)
• fix(repl): print uncaught exceptions from timers at the prompt (#35002)
• fix(repl): report descriptive syntax error instead of "Unexpected token '<'" (#35016)
• fix(repl): show tab completions for navigator.gpu (#35006)
• fix(repl): treat trailing . as incomplete input (#35101)
• fix(resolver): collapse redundant slashes in file specifiers (#34713)
• fix(resolver): don't treat a linked deno.json package as an npm link (#34841)
• fix(resolver): prefer deno jsx options over tsconfig (#34141)
• fix(run): error instead of panicking when watch flags are used with stdin (#34785)
• fix(runtime): cancel prompt on esc (#35004)
• fix(runtime): don't panic on missing SnapshotOptions when no snapshot (#34929)
• fix(runtime): keep lazy Deno namespace APIs writable (#35050)
• fix(runtime): serialize terminal permission prompts (#34821)
• fix(runtime): show import location for unsupported import attributes (#34824)
• fix(runtime): source map maybe cjs modules (#35013)
• fix(serde_v8): add recursion depth limit to deserializer (#34984)
• fix(serve): apply import map to main module in deno serve --watch (#34893)
• fix(test): do not report "only" notice when a test fails on its own (#35063)
• fix(test): handle escaped markdown code fences (#35125)
• fix(test): skip markdown roots when building watcher graph (#35003)
• fix(test): support blockquoted markdown doc tests (#34871)
• fix(test): wait for worker termination before pending promise failures (#35127)
• fix(update): show version requirement in interactive picker (#34671)
• fix(watch): detect newly created files in fmt/lint/test/bench --watch (#34828)
• fix(watch): keep watcher alive when script calls Deno.exit() (#35021)
• fix(watch): respect --watch-exclude in deno serve (#34847)
• fix: ignore 0 value for OTEL_METRIC_EXPORT_INTERVAL (#35054)
• fix: resolve global install import maps from original cwd (#34165)
• fix: support --inspect family in NODE_OPTIONS (#34717)
• fix: throw ERR_DIR_CLOSED on use-after-close in Dir (#34910)
• perf(config): match glob paths relative to base (#35039)
• perf(core): reduce native callback snapshot overhead (#35121)
• perf(ext/fs): use file identity instead of canonicalize in copyFile same-path guard (#34750)
• perf(ext/http): add Deno-owned HTTP/1.1 serve path (#34446)
• perf(ext/web): ASCII fast path for streaming TextDecoder.decode (#34299)
• perf(ext/web): convert geometry.js from lazy_loaded_esm to lazy_loaded_js (#34997)
• perf(lsp): cache lint and doc diagnostics per document module (#34875)
• perf(lsp): cache shared workspace data across members (#32476)