Deno

Security-adjacent fixes include clearing supplementary groups before changing process identity, refusing symlink SQLite database paths, checking permissions for multicast membership, and validating lockfile tarball origins. Also fixes Node compat issues such as repeated child process signals, AsyncLocalStorage exit context, and node:dns error codes, plus performance work in core and Buffer hex paths.

Adds a clipboard API and menu item icon, tooltip, and checked state support to the desktop runtime. Enforces permissions for proxy transports in fetch, and fixes a range of issues across HTTP, N-API, npm, and more — including keeping request bodies readable after a response is sent and skipping invalid DNS records in ANY queries.

Adds Blob/Body textStream() and an experimental QuickJS backend, plus new --unscoped and --members flags for add and task. The bulk of the release is dozens of Node compatibility and net/websocket fixes, including backpressure in Readable.toWeb() and corrected DNS permission handling for node:dns.getServers().

Fixed npm tarballs downloading from registry.npmjs.org instead of the configured registry. Also fixed worker_threads.locks being implemented via Web Locks, stale lockfile downgrades, and dozens of other fixes across the runtime.

deno add now supports --no-save and --save-optional flags, and compile targets aarch64-pc-windows-msvc. Fixes include sqlite deserialization guard, napi threadsafe function lifecycle, node_http2 header validation, and a data-loss fix for active stream reads on node.

Desktop apps can now use window opacity and transparency APIs, and React Router framework is automatically detected. HMR support is enabled for Vite and Nuxt, and stream performance is improved across Web Streams and pipeTo operations. Plus dozens of correctness fixes across Node.js compat, telemetry, coverage reporting, and package installation.

Added a --desktop flag for type-checking Deno Desktop code and deep-link URL scheme registration at bundle time. Fixed over 40 bugs across caching, bundling, Node.js compatibility, desktop/windowing issues, and a timer expiry race that could lose timers.

Deno.serve automatic compression is now disabled by default (opt-in via --compress/compress config). This release also ships the deno desktop subcommand for building cross-platform desktop apps, plus deno watch, deno link/unlink, deno list, CSS module imports, Web Locks API, Happy Eyeballs for TCP/TLS connections, and built-in snapshot testing.

Deno 2.9 introduces deno desktop, a new command that builds native desktop applications from web framework projects with no extra toolchain, producing a single distributable binary with built-in Deno.* desktop APIs. Performance gains include 2x faster cold startup (17ms), up to 3x less RSS memory, and 27% higher realworld Deno.serve throughput. Also adds direct npm, pnpm, yarn, and Bun lockfile reading in deno install, CSS module imports, and a stronger test runner.

Deno v2.8.3 introduces watch mode for deno compile and supports glob patterns in deno.json links. New features also include diagnostic reporting for import map files and ML-DSA JWK import/export in ext/crypto. The release also addresses numerous issues across the CLI, bundling, fetching, and Node.js compatibility.

Added ML-DSA (FIPS 204) post-quantum signatures and ML-KEM (FIPS 203) post-quantum key encapsulation, plus ChaCha20-Poly1305, SHAKE, and SHA-3 HMAC support to the crypto API. Improved deno compile --bundle dependency resolution, scoping npm embeds to packages actually reached, and added --minify flag. Also fixed numerous bugs across compile, node compatibility, Jupyter kernel, LSP, and file I/O.

Fixed multiple Node.js compatibility issues including TLSSocket.authorized behavior when clients present no certificate, PKCS#12 MAC support in TLS SecureContext, and fs.watch error event emission on open failures. Network permission checks now apply to resolved IPs in fetch and WebSocket, and a panic in deno test --parallel is fixed.

Deno v2.8.0 adds workspace support to deno bump-version and a catalog: protocol for centralized dependency versions, implements module.registerHooks() for CommonJS and ESM, and expands Node.js compatibility with node:wasi, node:module SourceMap API, and Inspector CDP domain support. Also stabilizes text imports, adds deno ci and deno pack commands, and upgrades TypeScript to 6.0.3 and V8 to 14.9.

Deno 2.8 introduces import defer syntax, six new subcommands (transpile, pack, bump-version, ci, why, audit fix), network debugging in Chrome DevTools, and framework-aware deno compile. Cold npm installs are now 3.66x faster.

Deno has released Claw Patrol, an open-source security firewall designed for agents that extends beyond HTTP protocol protection.

2.7.14 / 2026.04.28

• feat(ext/node): add fs.Utf8Stream
• feat(upgrade): delta updates via bsdiff patches (#33274)
• fix(bundle): treat CSS same-document fragment URLs as external (#33492)
• fix(cache): add missing CacheStorage.keys() and Cache.keys() methods…