Home/Deno

Deno

Overview Releases Sources

Jun 3, 2026

ML-DSA and ML-KEM post-quantum signatures; compile --bundle hardened

↗

Deno · v2.8.2

2.8.2 / 2026.06.03

feat(compile): improve --bundle dependency resolution and add --minify (#34536)
feat(compile): scope --bundle npm embed to packages actually reached (#34532)
feat(ext/crypto): add ChaCha20-Poly1305, SHAKE, cSHAKE, TurboSHAKE, SHA-3 HMAC (#34417)
feat(ext/crypto): add ML-DSA (FIPS 204) post-quantum signatures (#34448)
feat(ext/crypto): implement ML-KEM (FIPS 203) post-quantum KEM (#34447)
feat(ext/node): env/global proxy support for node:http and node:https (#34257)
feat(ext/node): support DENO_SERVE_ADDRESS override in node:http servers (#34662)
feat(jupyter): rewrite kernel in JS, drop zeromq/runtimelib deps (#34083)
feat(lsp): autocomplete jsr:/npm:/node: in deno.json(c) imports (#34724)
feat(publish): unfurl import specifiers in Wasm modules (#34549)
feat(task): support --env-file flag (#34508)
feat(task): support exclusion groups in task name wildcards (#34506)
feat(unstable): add --bundle flag to deno compile (#34527)
feat: bump deno_task_shell to 0.33.0 (#34642)
fix(add): handle version tags like @latest in deno add for JSR packages (#32859)
fix(add): replace panic with error when deno.json discovery fails (#34517)
fix(bundle): skip decorator pass when module has no decorators (#34489)
fix(bundle): use node-style CJS interop for the Deno platform (#34533)
fix(cache): skip WAL journal mode on WSL-1 (#34499)
fix(cache_dir): EnsureCachedStrategy must surface cached redirects (#34563)
fix(check): make node:stream/web types alias the globals (#34606)
fix(check): resolve npm packages without types when type checking (#34551)
fix(cli): suppress bug-report banner on broken pipe print panics (#34552)
fix(cli/task): run recursive workspace tasks in parallel (#34512)
fix(compile): allow process.chdir() into the VFS (#34610)
fix(compile): bundle workers separately under --bundle (#34531)
fix(compile): cover CJS-deep imports under --bundle (#34534)
fix(compile): create code cache when importing JSON or Wasm modules (#34614)
fix(compile): detect svelte-adapter-deno build output (#34535)
fix(compile): don't surface graph errors for --include files (#34568)
fix(compile): embed workspace package.json files in the VFS (#34530)
fix(compile): enable ANSI colors on Windows in compiled binaries (#34701)
fix(compile): handle CJS and native addons in --bundle (#34529)
fix(compile): respect npm registry sub-paths when flattening node_modules (#34575)
fix(compile): support workers loaded from blob URLs (#34574)
fix(compile): transpile TypeScript imported at runtime (#34616)
fix(config): hook up verbatimModuleSyntax for the emit pipeline (#34495)
fix(config): make config auto-discovery skip the same errors on every platform (#34558)
fix(config): surface invalid "exports" map in linked/workspace packages (#34473)
fix(config): warn instead of erroring when start dir is not a workspace member (#34458)
fix(config): warn instead of erroring when workspace member dir is missing (#34511)
fix(core): TLA hang on dyn import when async dep triggers lazy ESM load (#34469)
fix(core): preserve WebAssembly streaming callback across new contexts (#34679)
fix(crypto): correct X448 PKCS#8 handling (#34578)
fix(doc): don't lint private-type-ref for cross-package types (#34339)
fix(doc): handle non-ASCII doc lint diagnostics (#34626)
fix(ext/console): degrade gracefully when getKeys throws (#24980) (#34464)
fix(ext/fetch): implement missing Request properties (#34607)
fix(ext/fetch): preserve static request body length (#34546)
fix(ext/ffi): match V8 stack-arg layout in turbocall trampoline on Apple silicon (#34561)
fix(ext/fs): error when copyFile source and destination are the same file (#34718)
fix(ext/fs): retry without FILE_FLAG_BACKUP_SEMANTICS on Windows when driver rejects it (#34686)
fix(ext/fs): surface non-UTF-8 file names from read_dir (#34623)
fix(ext/http): reject Response-like return from respondWith (#34589)
fix(ext/http): reject Response-like return from serve handler (#34416)
fix(ext/io): cancel pending FileResource reads on close (#34544)
fix(ext/napi): clear error for Windows addons that link against node.exe (#34696)
fix(ext/napi): disallow JS execution during napi_new_instance (#34496)
fix(ext/napi): polyfill libuv thread + semaphore primitives (#34571)
fix(ext/napi): polyfill more libuv symbols from compat layer (#34488)
fix(ext/net): re-enable 0-RTT support in QUIC (#34520)
fix(ext/node): add module findPackageJSON export (#34597)
fix(ext/node): add node:test/reporters builtin (#34595)
fix(ext/node): add stripTypeScriptTypes export (#34594)
fix(ext/node): capture IPC handle eagerly to fix cluster send deadlock (#34661)
fix(ext/node): cover node:module SourceMap export (#34591)
fix(ext/node): disable repl preview when a custom eval is supplied (#34498)
fix(ext/node): drop bogus Buffer.prototype._isBuffer marker (#34502)
fix(ext/node): export syncBuiltinESMExports from node:module (#34593)
fix(ext/node): expose gc from v8 setFlagsFromString (#34604)
fix(ext/node): fix latin1Slice being too slow (#34503)
fix(ext/node): honor windowsHide in child_process spawn (#34627)
fix(ext/node): prevent buffer decode detach race (#34632)
fix(ext/node): re-export inner spec for module.exports = require(X).Y (#34363)
fix(ext/node): refuse sqlite close() while a user callback is running (#34515)
fix(ext/node): report real error code for failed dns.lookup (#34697)
fix(ext/node): resolve global cache packages when require referrer is outside DENODIR (#34497)
fix(ext/node): route node:fs.statfs through FileSystem trait (#34444)
fix(ext/node): support cyclic imports in vm.Module.prototype.link() (#34472)
fix(ext/node): support vm dynamic import callback (#34572)
fix(ext/node): tolerate unreadable cwd in require._nodeModulePaths (#34542)
fix(ext/node): vm dynamic import without callback throws ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING (#34427)
fix(ext/web): forward console.group label to inspector log (#34341)
fix(ext/web): honor PerformanceObserver buffered flag (#34748)
fix(ext/web): make MessageEvent.ports a frozen array (#34773)
fix(fmt): update markup_fmt to fix quadratic inline CSS formatting (#34663)
fix(install): allow "minimumDependencyAge" object without "age" (#34523)
fix(install): handle pre-existing node_modules symlink on Windows (#34659)
fix(install): rewrite relative imports/scopes in copied deno.json (#34562)
fix(install): run workspace member dependency lifecycle scripts with member INIT_CWD (#34700)
fix(install): vendor type-only imports during deno ci (#34459)
fix(jupyter): exit kernel process after sending shutdown reply (#34554)
fix(jupyter): keep kernel alive across transient peer disconnects (#34550)
fix(jupyter): make kernel ZMTP handshake compatible with libzmq (#34755)
fix(jupyter): send transient: {} in execute_result so nbclient doesn't crash (#34483)
fix(jupyter): use stable PATH entry for kernel binary path (#34492)
fix(lsp): avoid empty import specifier completions (#34647)
fix(lsp): complete npm package exports (#34675)
fix(lsp): complete string union literals containing dots (#34664)
fix(lsp): discover all tests when names are duplicated (#34624)
fix(lsp): handle empty jsx completion ranges (#34651)
fix(lsp): handle parser panics while parsing documents (#34640)
fix(lsp): honor moduleResolution: "bundler" for npm dir imports (#34643)
fix(lsp): include configured deps in auto-imports (#34650)
fix(lsp): limit node_modules auto-import aliasing (#34674)
fix(lsp): merge duplicate completion imports (#34658)
fix(lsp): preserve URL extensions in typeof import(...) hovers (#34565)
fix(lsp): recover from TSC isolate OOM instead of crashing the language server (#34693)
fix(lsp): release idle memory back to the OS (#34727)
fix(lsp): skip parent process check when PID isn't visible (#34744)
fix(lsp): spurious diagnostics in Jupyter notebook cells (#34734)
fix(lsp): support test steps from imported helpers (#34648)
fix(lsp): surface CSS imports as .js to TypeScript (#34419)
fix(lsp): surface module-level uncaught errors in test runs (#34641)
fix(lsp): use cached registry config when offline (#34723)
fix(lsp): use file uris for neovim virtual definitions (#34653)
fix(lsp): walk to enabled nested workspaces (#34654)
fix(napi): report a clear error for legacy V8/nan native addons (#34683)
fix(napi): support ZeroMQ libuv addon symbols (#34657)
fix(node): avoid spurious ERR_MULTIPLE_CALLBACK on process.stdout/stderr (#34728)
fix(node): classify required js files as commonjs by default (#34673)
fix(node): full re-export fallback for unresolvable member re-exports (#34689)
fix(node): resolve CJS requires with multi-level relative specifiers on Windows (#34655)
fix(node): support module-sync export condition (#34599)
fix(node/repl): gate preview through V8 inspector throwOnSideEffect (#34566)
fix(npm): apply scoped registry auth to same-origin tarballs (#34698)
fix(npm): clean node_modules after deno remove (#34110)
fix(npm): downgrade latest tag for release age (#34581)
fix(npm): execute native binaries from npm package bin entries (#34375)
fix(npm): hoist direct deps over higher transitive versions (#34470)
fix(npm): share copy-package variants via symlink for class identity (#34691)
fix(resolver): don't resolve linked packages via bare specifier (#34519)
fix(rt): support host-FS CJS files in the standalone runtime (#34560)
fix(runtime): better error message when Deno.consoleSize() has no tty (#34538)
fix(runtime): suggest --allow-scripts for bindings native addon error (#34666)
fix(runtime): suggest N-API alternatives for legacy V8/nan addons (#34695)
fix(runtime): suggest Worker/node:vm alternatives for npm:isolated-vm (#34702)
fix(runtime/ops): unwatch shared RecommendedWatcher on FsWatcher close (#34467)
fix(task): preserve trailing backslashes in task arguments (#34505)
fix(task): restore terminal mode after task exits on Windows (#34685)
fix(test): abort with a message when a test exits with sanitizeExit disabled (#34491)
fix(test): don't kill the deno process on top-level Deno.exit() (#34564)
fix(test): wait for inspector to disconnect before exiting (#34559)
fix(tsc): resolve Web globals to Deno's versions in npm packages (#34634)
fix(watch): register dynamic raw imports with file watcher (#34463)
fix(watch): restore original cwd between watcher restarts (#34465)
fix: absolute links should be processed using directory functions (#34218)
fix: link to docs in JSON import error message (#34611)
fix: load classic blob worker main script directly (#34592)
fix: opt-in mitigation for React RCE/DoS CVEs (#34676)
fix: reject empty package name in package.json dependencies (#34514)
fix: remove node_shim exec dependency (#34739)
fix: resolve local file when folder name matches import-mapped package (#32854)
fix: send BroadcastChannel messages before close (#34628)
perf(cli): drop unused deno_ast bundler feature (#34424)
perf(ext/fetch): cache lowercased header names per Headers instance (#33683)
perf(ext/node): bulk-build header array and trim header OWS in place (#34443)
perf(ext/node): cache member-export-props analysis (#34471)
perf(ext/node): gate node:http async resource entry (#34608)
perf(ext/node): optimize empty node:http response end (#34493)
perf(ext/node): optimize node:http header matching (#34484)
perf(ext/node): skip node:http perf timing without observers (#34409)
perf(ext/web): convert hot stream queues to O(1) Queue, cache _state reads (#34437)
perf(http): remove legacy hyper 0.14 from deno_http (#34557)
perf(node): lazy stdio + fix LazyEsmModuleLoader source consumption (#34440)
perf(node): lazy-load node:stream/web cluster out of the snapshot (#34548)
perf(node): skip require permission checks when read is fully granted (#34722)
perf(runtime): update notify watcher dependency (#34567)
perf(web): reduce Brotli CompressionStream binary size (#34432)
perf: enable safe ICF (identical code folding) when linking (#34478)
perf: replace ipnetwork with ipnet (#34580)

May 27, 2026

Node.js TLS/fs fixes; network deny list enforced on resolve

↗

Deno · v2.8.1

2.8.1 / 2026.05.27

Revert "fix(ext/node): polyfill module.enableCompileCache and companions" (#34190) (#34348)
feat(bundle): support browser field map in package.json (#34407)
fix(bundle): read package.json sideEffects field (#34406)
fix(cli): clearer error when importing .node addon via ESM (#34361)
fix(config): don't panic when --config path can't be converted to URL (#34351)
fix(core): allow host objects to round-trip through core.deserialize (#34380)
fix(core): keep lazy_loaded_esm sources across concurrent loads (#34353)
fix(ext/fetch,ext/websocket): check resolved IPs against net deny list (#34236)
fix(ext/node): TLSSocket.authorized=false when client presents no cert (#34381)
fix(ext/node): accept array forms of cert/key/pfx in createSecureContext (#34379)
fix(ext/node): add missing node:util APIs getSystemErrorMap, transferableAbortSignal, transferableAbortController (#34372)
fix(ext/node): allow omitting arguments in base64Slice (#34318)
fix(ext/node): attach register as static on Module (#34305)
fix(ext/node): do not throw NotFound for fs.exists (#34244)
fix(ext/node): drop extra positional args in promisified fs.promises.* (#34347)
fix(ext/node): emit 'error' event for fs.watch open failures (#34398)
fix(ext/node): enforce minimum Miller-Rabin rounds in checkPrime (#34391)
fix(ext/node): extract cert/key from pfx in tls SecureContext (#34383)
fix(ext/node): prevent panic on node:sqlite aggregate method (#34385)
fix(ext/node): require env permission for process.loadEnvFile (#34350)
fix(ext/node): reset req.reusedSocket on transparent retry (#34376)
fix(ext/node): support PKCS#12 MACs other than SHA-1 (#34342)
fix(ext/node): tolerate non-AsyncWrap handles in _getNewAsyncId (#34413)
fix(http): wake runtime after direct serve dispatch (#34387)
fix(inspector): emit NodeWorker.attachedToWorker for late workers (#34377)
fix(node/util): don't invoke Proxy traps in util.inspect (#34373)
fix(pack): remove automatic @deno/shim-deno injection (#34411)
fix(runtime): lazy-loaded globals should shadow on inherited [[Set]] (#34405)
fix(task): walk ancestor node_modules/.bin in BYONM mode (#34364)
fix(transpile): preserve newlines after multi-line block comments (#34357)
fix(types): restore brotli in CompressionFormat for dom/webworker libs (#34349)
fix(upgrade): zstd-compress bsdiff delta patches (#34354)
fix: allow --inspect=localhost:0 to resolve hostnames (#34230)
fix: panic in deno test --parallel (#34378)
fix: support npm: specifiers in --preload and --import (#34346)
perf(ext/node): reuse keep-alive timer in node:http server (#34302)

May 22, 2026

Workspace support; module.registerHooks(); Node.js compat expanded

↗

Deno · v2.8.0

2.8.0 / 2026.05.22

Import defer ships; npm installs 3.66x faster; six new CLI subcommands

↗

Deno Changelog · v2.8

`import defer`, six new subcommands (`deno transpile`, `deno pack`, `deno bump-version`, `deno ci`, `deno why`, `deno audit fix`), network debugging in Chrome DevTools, framework-aware `deno compile`, and 3.66x faster cold npm installs.

May 21, 2026

Claw Patrol: open-source agent security firewall

↗

Deno Changelog

Why we needed an agent firewall that speaks more than HTTP.

Apr 28, 2026

Deno v2.7.14

↗

2.7.14 / 2026.04.28

feat(ext/node): add fs.Utf8Stream
feat(upgrade): delta updates via bsdiff patches (#33274)
fix(bundle): treat CSS same-document fragment URLs as external (#33492)
fix(cache): add missing CacheStorage.keys() and Cache.keys() methods (#33275)
fix(config): don't exclude workspace members from deploy file patterns (#33562)
fix(coverage): exclude transformer-injected helpers from coverage (#33481)
fix(doc): remove background from operators in dark mode code blocks (#33267)
fix(ext/bundle): clearer error when Deno.bundle is called in compiled binary (#33503)
fix(ext/crypto): throw TypeMismatchError for non-TypedArray in getRand (#33470)
fix(ext/fetch): don't mutate caller's options in Deno.createHttpClient (#33497)
fix(ext/fetch): use byte ReadableStream for Node Readable request bodies (#33432)
fix(ext/fs): normalize Deno.watchFs paths so events drop ./ segments (#33490)
fix(ext/napi): implement napi_async_init and napi_async_destroy (#33282)
fix(ext/net): default Deno.listenDatagram hostname to 0.0.0.0 (#33496)
fix(ext/node): accept X.509v1 server certs in tls.createServer (#33505)
fix(ext/node): accept string mode in fs.mkdir and fs.mkdirSync (#33409)
fix(ext/node): add Server BlockList, asyncDispose, and misc net improvements (#33417)
fix(ext/node): add _idleStart and _idleTimeout to Timeout (#33604)
fix(ext/node): align crypto random* validation with Node (#33456)
fix(ext/node): align fs.truncate / ftruncate argument validation with Node (#33418)
fix(ext/node): align module.builtinModules / getBuiltinModule with Node (#33404)
fix(ext/node): align node:module behavior with Node (#33482)
fix(ext/node): align node:test it/describe with Node, enable passing compat tests (#33593)
fix(ext/node): align util.styleText with Node (#33547)
fix(ext/node): allow https.Agent() without new, enable passing compat tests (#33601)
fix(ext/node): async fs.stat/lstat throwIfNoEntry + deprecate fs.Stats (#33436)
fix(ext/node): attach input URL to ERR_INVALID_FILE_URL_PATH (#33398)
fix(ext/node): attach path/syscall to fs.lstat / realpath / link errors (#33446)
fix(ext/node): brand-check SecureContext._external accessor (#33569)
fix(ext/node): cache hash digest so it survives stream.pipeline (#33440)
fix(ext/node): cancelling Readable.toWeb(req) no longer destroys the socket (#33570)
fix(ext/node): close fd on error in http2 stream respondWithFile (#33614)
fix(ext/node): correct buffer-length check in Readable._fromList decoder branch (#33624)
fix(ext/node): defer drain in http2 shutdownWritable so pushStream after end() works (#33619)
fix(ext/node): drain pending TLS cleartext in enc_write_cb (#33378)
fix(ext/node): emit Buffer for http2 'goaway' opaqueData (#33502)
fix(ext/node): emit DEP0031 deprecation warning for ecdh.setPublicKey( (#33468)
fix(ext/node): emit DEP0182 deprecation for short AES-GCM auth tag (#33469)
fix(ext/node): emit HPE_INVALID_TRANSFER_ENCODING for CL+chunked respo (#33488)
fix(ext/node): emit StatWatcher 'stop' event asynchronously (#33448)
fix(ext/node): emit TimeoutNaNWarning for invalid timer durations (#33472)
fix(ext/node): emit http2 frameError on send failure with translated HTTP/2 error code (#33631)
fix(ext/node): emit stream-level PROTOCOL_ERROR in node:http2
fix(ext/node): emit tlsClientError instead of crashing on TLS init failure (#33429)
fix(ext/node): enable test-als-defaultvalue-original (AsyncLocalStorage default value) (#33464)
fix(ext/node): encode http2 headers as Latin-1 to fix response splitting (#33531)
fix(ext/node): encode more chars in url.pathToFileURL() (#33397)
fix(ext/node): enforce HTTP/2 server header list size limits (#33494)
fix(ext/node): enforce http2 maxSessionInvalidFrames limit (#33515)
fix(ext/node): expose http2 sensitive headers received with NV_FLAG_NO_INDEX flag (#33626)
fix(ext/node): fix EEXIST error and data loss in writeFileSync on Windows (#33413)
fix(ext/node): fix ERR_INVALID_CHAR message & OutgoingMessage.prototype.write (#33430)
fix(ext/node): fix TLS client certificate authentication verification (#33576)
fix(ext/node): fix TLS socket error ordering and app data leak before identity verification (#33585)
fix(ext/node): fix TLS socket lifecycle and readStop backpressure (#33524)
fix(ext/node): fix closeIdleConnections destroying active connections (#33596)
fix(ext/node): fix fs.glob skipping siblings with */../ patterns (#33372)
fix(ext/node): fix spawnSync internal API for monkey-patching and killSignal (#33545)
fix(ext/node): flush GOAWAY before destroying http2 socket and expose internal/http2/core (#33566)
fix(ext/node): flush HTTP/2 client preface after settings submission (#33387)
fix(ext/node): forward enableConnectProtocol setting to peer in HTTP/2 SETTINGS frame (#33616)
fix(ext/node): handle undefined http2 ping payload and cancel pending pings on destroy (#33561)
fix(ext/node): hide aggregateTwoErrors frame in AggregateError stack (#33402)
fix(ext/node): honor http2 strictFieldWhitespaceValidation option (#33506)
fix(ext/node): honor requestCert/ca on node:tls server, populate getPeerCertificate() (#33439)
fix(ext/node): honor weight option in http2 client.request and emit DEP0194 (#33622)
fix(ext/node): http2 createConnection support and per-frame socket writes (#33520)
fix(ext/node): implement BlockList.rules / isBlockList / toJSON / fromJSON (#33445)
fix(ext/node): implement Socket.resetAndDestroy with TCP RST in node:net (#33415)
fix(ext/node): implement StatWatcher.ref() / unref() (#33408)
fix(ext/node): implement dns Resolver cancel() and timeout support (#33580)
fix(ext/node): implement dns.reverse() and fix dns.lookup() family parameter (#33579)
fix(ext/node): implement fs.mkdtempDisposableSync / fsPromises.mkdtempDisposable (#33533)
fix(ext/node): implement node:cluster fork/Worker and worker-side detection (#33493)
fix(ext/node): implement process.debugPort with ToInt32 coercion (#33403)
fix(ext/node): import kIncomingMessage/kServerResponse in http2 allowHTTP1 fallback (#33435)
fix(ext/node): improve Node.js timer compatibility (#33479)
fix(ext/node): improve perf_hooks timerify and add missing exports (#33581)
fix(ext/node): include accepted values in Console colorMode error (#33424)
fix(ext/node): isolate parentPort from globalThis in worker_threads (#32596)
fix(ext/node): make Buffer.prototype methods generic-callable (#33466)
fix(ext/node): make http2 session.origin() round-trip origins and respect TLS servername (#33629)
fix(ext/node): make process.constructor a proper instanceof check (#33447)
fix(ext/node): name custom-promisified functions after their originals (#33407)
fix(ext/node): null-proto child_process options to block prototype pollution (#33555)
fix(ext/node): pass reusePort flags in Server.listen() without host (#33530)
fix(ext/node): pass signal name to process signal handlers (#33425)
fix(ext/node): pass stream fd to child process stdio instead of inheriting (#33525)
fix(ext/node): plumb llhttp error code, reason, and bytes parsed through HTTPParser (#33591)
fix(ext/node): prevent duplicate close emit when http2 client socket i (#33538)
fix(ext/node): re-arm Windows named pipe server after accept (#33369)
fix(ext/node): rebind http2 state buffers post-snapshot, enforce maxHeaderListPairs (#33495)
fix(ext/node): reject non-ArrayBufferView data in fs.writeFileSync (#33406)
fix(ext/node): rename _destroySsl to _destroySSL to match Node.js API (#33599)
fix(ext/node): replace unwrap with error propagation in parallel cp (#33396)
fix(ext/node): return relative path from fs.watch with recursive option (#33428)
fix(ext/node): strip trailing dot from SRV target in dns.resolveSrv() (#33578)
fix(ext/node): submit http2 RST_STREAM before flushing END_STREAM DATA frame on respondWithFD read (#33633)
fix(ext/node): support ALPNCallback in http2.createSecureServer (#33521)
fix(ext/node): support BlockList, AbortSignal, and constructor options in node:net Socket (#33414)
fix(ext/node): support ignore option in fs.watch and fs.promises.watch (#33610)
fix(ext/node): support encoding option in fs.readdir; don't double-call glob callback (#33501)
fix(ext/node): support http2 pushStream and client push events (#33516)
fix(ext/node): support reusePort option and fix bind/pipe handling in node:net (#33416)
fix(ext/node): support util.promisify on http2.connect (#33489)
fix(ext/node): support v1 X.509 certs and http2 ALPN fallback (#33510)
fix(ext/node): throw ERR_INVALID_ARG_VALUE when rmdir gets options.recursive (#33565)
fix(ext/node): throw ERR_INVALID_URL from http/https request string URL (#33427)
fix(ext/node): throw TypeError for Symbol keys/values in process.env (#33399)
fix(ext/node): timer _destroyed flag, Symbol.dispose, and setInterval abort (#33528)
fix(ext/node): track http2 custom settings and SETTINGS ACK callbacks (#33518)
fix(ext/node): treat unsolicited HTTP/2 PING ACK as connection-level protocol error (#33625)
fix(ext/node): use AbortSignal.addEventListener in addAbortListener (#33557)
fix(ext/node): use ERR_INVALID_ARG_TYPE for tls.createServer non-object options (#33589)
fix(ext/node): use ERR_INVALID_ARG_VALUE in module.createRequire (#33449)
fix(ext/node): use Node's address-type check in dgram Socket.send (#33420)
fix(ext/node): use node:timers for http server connection checks, expo (#33483)
fix(ext/node): use proper error codes for require() invalid arguments (#33609)
fix(ext/node): validate fs.watch boolean options (#33627)
fix(ext/node): validate boolean arg in process.setSourceMapsEnabled (#33473)
fix(ext/node): validate ciphers option in tls.createSecureContext() (#33597)
fix(ext/node): validate dgram options.recvBufferSize / sendBufferSize (#33444)
fix(ext/node): validate oaepHash in publicEncrypt/privateDecrypt (#33388)
fix(ext/node): validate options.type in Readable.toWeb (#33560)
fix(ext/node): validate process.chdir argument is a string (#33401)
fix(ext/node): walk sandbox prototype chain in vm property_query (#33463)
fix(ext/node): wire JSStreamSocket handle write/shutdown for http2 (#33526)
fix(ext/node): wire up captureRejection handler for http2 servers (#33542)
fix(ext/node): yield to I/O in http2 write path so stream pipeline finishes (#33541)
fix(ext/web): align AbortSignal.timeout error message with Node (#33460)
fix(ext/web): allow transferring non-serializable types in structuredClone (#33491)
fix(ext/web): handle late write racing with TransformStream cancel (#33478)
fix(ext/web): narrow ReadableStreamBYOBRequest.view to Uint8Array (#33477)
fix(ext/web): retain source from MessageEventInit (#33500)
fix(ext/web): route console.dirxml through the log printer (#33443)
fix(ext/web): set ERR_MISSING_ARGS code on URL.revokeObjectURL no-arg (#33471)
fix(ext/web): structuredClone of non-serializable Web types throws DataCloneError (#33465)
fix(ext/webidl): set ERR_ILLEGAL_CONSTRUCTOR code on illegal constructor calls (#33535)
fix(ext/webidl): set ERR_INVALID_THIS code on brand-check TypeError (#33467)
fix(node/buffer): fix panic in transcode with odd-length UTF-16LE input (#33390)
fix(node/compat): disable flaky test-child-process-exec-kill-throws on Windows (#33426)
fix(node/compat): disable flaky test-fs-read-stream-pos on Windows (#33421)
fix(node/compat): fix shard report merging and fetching in CI reporting (#33431)
fix(permissions): normalize paths for macOS filesystem comparison (#33451)
fix(task): match workspace directory name in --filter (#33499)
fix(task): use explicit workspace root check in directory-name fallback (#33540)
fix(x): forward --unstable-* flags to JSR and URL targets (#33450)
fix: bound fs.readFile on non-terminating sources (#33262)
fix: drop config-only unstable features from unstable_args() (#33452)
fix: match single-char wildcard segments in npm package imports (#33513)
perf(ext/node): pool 64KB read buffers to reduce allocation pressure (#33395)
perf: optimize worker and MessagePort message passing (#32657)
perf: upgrade rusty_v8 to 147.4.0 (#33422)

Apr 27, 2026

Apr 24, 2026

Static pages ship zero JavaScript; View Transitions API supported

↗

Deno Changelog · v2.3

Fresh 2.3: Zero JavaScript by default, View Transitions, and Temporal support

Fresh 2.3 is out, with over 100 commits from 20 contributors. This release makes the "zero JavaScript by default" promise actually hold, adds View Transitions support, pre-compiles middleware chains, and rounds out a long list of Vite integration fixes.

You can start a new project with:

deno create @fresh/init

or update an existing one with:

deno run -Ar jsr:@fresh/update

Zero JavaScript by default

Fresh has always said that pages ship no JavaScript unless they need to, but that wasn't strictly true. Every page ended up with a small client-entry script to bootstrap the island reviver and partials engine, even when neither was used.

Thanks to Jeroen Akkerman in #3696, Fresh now checks whether the page actually uses islands or partials (f-client-nav) before injecting anything. If it doesn't, the page ships with no <script> tag, no module preload headers, and no client-side bundle at all.

	Fresh 2.2	Fresh 2.3
JavaScript (raw)	~14–22 KB	0 KB
JavaScript (gzip)	~5–9 KB	0 KB
Module preload headers	1+	0
Inline boot `<script>`	1	0

There is nothing to configure. Static pages will just stop shipping JavaScript after upgrading.

View Transitions

The View Transitions API lets browsers animate between DOM states natively. Fresh 2.3 wires it up to the existing partials system, so you can opt in by adding one attribute:

<body f-client-nav f-view-transition>
  <!-- your app -->
</body>

Partial navigations will then be wrapped in document.startViewTransition() and you can customize the animation with regular CSS:

::view-transition-old(root) {
  animation: fade-out 0.2s ease-in;
}
::view-transition-new(root) {
  animation: fade-in 0.2s ease-out;
}

Or target individual elements:

.sidebar {
  view-transition-name: sidebar;
}

View Transitions between two pages in a Fresh app.

Browsers without support fall back to normal partial updates. See the View Transitions docs for more.

First-class WebSocket support

Fresh now has built-in WebSocket support (#3774). The quickest way to add a WebSocket endpoint is app.ws():

main.ts

const app = new App()
  .ws("/ws", {
    open(socket) {
      console.log("Client connected");
    },
    message(socket, event) {
      socket.send(`Echo: ${event.data}`);
    },
    close(socket) {
      console.log("Client disconnected");
    },
  });

For file-based routes, use ctx.upgrade() inside a GET handler. In managed mode, pass handlers and get the response back directly:

routes/api/ws.ts

export const handlers = define.handlers({
  GET(ctx) {
    return ctx.upgrade({
      message(socket, event) {
        socket.send(`Echo: ${event.data}`);
      },
    });
  },
});

There's also a bare mode. Call ctx.upgrade() without arguments to get the raw WebSocket object, useful when you need to store sockets in a shared structure like a chat room:

routes/api/chat.ts

const clients = new Set<WebSocket>();

export const handlers = define.handlers({
  GET(ctx) {
    const { socket, response } = ctx.upgrade();

    socket.onopen = () => clients.add(socket);
    socket.onmessage = (event) => {
      for (const client of clients) {
        if (client.readyState === WebSocket.OPEN) {
          client.send(event.data);
        }
      }
    };
    socket.onclose = () => clients.delete(socket);

    return response;
  },
});

Non-WebSocket requests to a WebSocket route automatically get a 400 response. See the WebSocket documentation for the full API including idleTimeout and protocol options.

Vite integration improvements

A lot of this cycle went into making the Vite integration more robust, especially around npm package compatibility.

CJS-to-ESM transforms and process.env replacements are now handled by Vite directly, so we could drop two Babel passes from the build.
CJS handling in SSR dev mode has been improved, React compat aliasing works properly now, and resolve.alias is applied before Deno resolution. Packages like Radix UI work out of the box.
optimizeDeps.exclude is set up so Vite no longer creates a duplicate Preact instance during pre-bundling.
Vite asset URLs now include a cache-bust query param so immutable caching does the right thing (#3761).
Temp files are ignored by the Vite watcher, so editor swap files no longer crash the dev server (#3763).

Work in this area is continuing. #3767 removes the rest of the Babel transforms (~2,050 lines) and lets Vite handle CJS packages natively end to end. That should land shortly after 2.3.

CSP nonces and IP filtering

Two new security middleware ship with this release.

CSP nonce injection (#3709) generates a unique nonce per request and adds it to every inline <script> and <style> tag. The corresponding Content-Security-Policy header uses 'nonce-{value}' instead of 'unsafe-inline', so only scripts and styles that Fresh rendered are allowed to execute.

main.ts

import { csp } from "fresh";

app.use(csp({ useNonce: true }));

User-supplied CSP directives now override the defaults rather than duplicating them (#3724). See the CSP documentation for the full list of options.

IP filter middleware (#3035, thanks to Octo8080X) adds built-in IP-based allow/deny lists with CIDR support:

main.ts

import { ipFilter } from "fresh";

app.use(ipFilter({
  denyList: ["192.168.1.10"],
  allowList: ["192.168.1.0/24"],
}));

See the IP filter documentation for custom response handling and more examples.

OpenTelemetry: server-to-browser trace propagation

Fresh already instruments middleware, route handlers, and rendering with OpenTelemetry spans. In 2.3, it also injects a W3C traceparent meta tag into the HTML response (#3729), so browser-side telemetry SDKs can connect client spans to the server trace.

Enable tracing with Deno's built-in OpenTelemetry support:

OTEL_DENO=true deno task start

Fresh will then automatically add the meta tag to every rendered page:

<meta
  name="traceparent"
  content="00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"
/>

No code changes required. See the OpenTelemetry documentation for exporter configuration and the full list of instrumented spans.

Temporal API in islands

The Temporal API is landing in JavaScript engines, and Fresh now supports passing all eight Temporal types as island props:

Temporal.Instant
Temporal.ZonedDateTime
Temporal.PlainDate, PlainTime, PlainDateTime
Temporal.PlainYearMonth, PlainMonthDay
Temporal.Duration

You can pass a Temporal value from a route straight through to an island:

routes/event.tsx

export default function EventPage() {
  const date = Temporal.PlainDate.from("2026-04-24");
  return <Countdown target={date} />;
}

islands/Countdown.tsx

export default function Countdown(props: { target: Temporal.PlainDate }) {
  const today = Temporal.Now.plainDateISO();
  const days = today.until(props.target).days;
  return <p>{days} days to go</p>;
}

Passing Temporal values from a route to an island.

Multiple static directories

The staticDir option now accepts an array (#3759). When the same filename exists in multiple directories, the first entry wins. This is useful when a build step generates assets into a separate directory and you want to keep those separate from hand-authored files.

vite.config.ts

import { defineConfig } from "vite";
import { fresh } from "@fresh/plugin-vite";

export default defineConfig({
  plugins: [
    fresh({
      staticDir: ["static", "generated"],
    }),
  ],
});

See the static files documentation for more.

Loading indicators on form submissions

Loading indicators used to only work for link clicks. In 2.3 they work for form submissions too (#3753). Fresh checks the submitter element first (for example, the clicked button) and falls back to the form, so you can have per-button indicators when a form has multiple submit buttons:

import { useSignal } from "@preact/signals";

function MyForm() {
  const saving = useSignal(false);

  return (
    <form action="/save" f-partial="/partials/save">
      <button
        type="submit"
        ref={(el) => {
          if (el) el._freshIndicator = saving;
        }}
      >
        {saving.value ? "Saving..." : "Save"}
      </button>
    </form>
  );
}

Per-button loading indicators on a form submission.

Reverse proxy support

Apps behind nginx, Caddy, or a cloud load balancer can now opt into trustProxy so that ctx.url reflects the actual client-facing URL (#3757):

const app = new App({ trustProxy: true });

With this enabled, Fresh reads the X-Forwarded-Proto and X-Forwarded-Host headers and rewrites ctx.url accordingly. If your proxy terminates TLS and forwards X-Forwarded-Proto: https, ctx.url.protocol will be https: instead of http:. See the reverse proxy documentation for details.

`deno create` support

With Deno 2.7+, you can scaffold a new Fresh project using deno create (#3706):

deno create @fresh/init

The old deno run -Ar jsr:@fresh/init form still works but now shows a deprecation warning.

Bug fixes

A non-exhaustive list of the most impactful fixes in this release:

HttpError is now exposed for client-side code, with an optional message to keep bundle sizes down (#3080).
Routing: optional parameter routes no longer 404 (#2798), trailing slash mismatches no longer break static routes (#3721), middleware matches optional parameters in fs routing (#3726), and layouts apply correctly to index routes in programmatic routing (#3725).
Partials: forms without an explicit f-partial inside f-client-nav are no longer intercepted (#3722), search params are preserved through redirects (#3715), and data script tags are appended to <head> during partial navigation (#3720).
The <Head> component now works correctly when rendered on the client (#3252).
Active links now consider query parameters and respect existing aria-current attributes (#3755).
Better error messages for missing exports in file routes (#3718), warnings instead of crashes on invalid HTML nesting around islands (#3762), and warnings for Partials with append/prepend mode missing a key prop (#3738).
Pre-compiled middleware (#3104): middleware chains are now compiled once at startup instead of being assembled on every request.
Windows: paths are normalized in generated snapshot and server entry files (#3727).

What's next

We're continuing to improve Vite support: upgrading to Vite 8 with Rolldown (#3760) and removing the remaining Babel transforms entirely (#3767).

The other big focus is build-time prerendering (#3766). Mark a route with prerender: true and Fresh renders it to static HTML during the build. Dynamic routes can enumerate their paths too, effectively turning Fresh into a static site generator for pages that don't need a server.

Follow along on GitHub.

Apr 22, 2026

Deno v2.7.13

↗

2.7.13 / 2026.04.22

feat(ext/node): implement node:repl module (#32799)
feat(ext/node): rewrite node:http with llhttp and native TCPWrap (#33208)
feat(upgrade): support installing from a PR (#33252)
fix(audit): migrate to bulk advisory endpoint (#33292)
fix(console): find nodejs.util.inspect.custom on Proxy objects via get trap (#33265)
fix(doc): Add Prism support for JSX/TSX code blocks (#33255)
fix(ext/http): treat empty Host header as missing in request URL (#33234)
fix(ext/napi): defer GC weak-callback finalizers to the event loop (#33260)
fix(ext/napi): implement real V8 handle scopes and callback scopes (#33281)
fix(ext/napi): implement zero-copy external Latin-1 strings (#33283)
fix(ext/node): ChildProcess.kill() returns false when process already exited (#33305)
fix(ext/node): address node:http rewrite review comments (#33299)
fix(ext/node): auto-start server-side STARTTLS handshake, add TLS upgrade tests (#33303)
fix(ext/node): defer JS stream encOut to avoid reentrant CppGC borrow (#33304)
fix(ext/node): enable HTTP parser consume fast path (#33354)
fix(ext/node): enforce maxHeaderSize in HTTP parser (#33306)
fix(ext/node): fix EEXIST error and file corruption with writeFileSync on Windows (#33253)
fix(ext/node): fix Module._resolveLookupPaths and require.resolve compat (#33261)
fix(ext/node): fix multiple http2 bugs (#33315)
fix(ext/node): fix playwright on windows (#33295)
fix(ext/node): flush HTTP/2 HEADERS frame after client request (#33300)
fix(ext/node): free uv_write and uv_shutdown requests in every exit path (#33350)
fix(ext/node): http client compat improvements (#33337)
fix(ext/node): http2 improvements — constants, error codes, settings, validation (#33332)
fix(ext/node): improve node:tls compat (validation, pipes, JS streams) (#33331)
fix(ext/node): support FD-indexed stdio inheritance in spawnSync (#33341)
fix(ext/node): support RSA-PSS keys in crypto.verify with null algorithm (#33314)
fix(runtime): warn on unsupported web Worker options and fix recv panic (#33310)
fix(test): fix specific_canary upgrade test on Windows (#33286)
fix: add note for canary's 30-day retention period (#33271)
fix: restore glibc < 2.27 compatibility for Linux release builds (#33259)
fix: update v8 crate to 147.2.1 (#33318)
perf(ext/node): elide async_hooks emit in timers when no hooks registered (#33355)
perf(ext/node): flush-free header fast path in HTTP parser (#33351)
perf(ext/node): reduce writev op allocations and write copies (#33352)
perf(libs/core): poll only ready handles and yield between I/O batches (#33349)
perf: reduce memory usage of Command.output() (#33335)

Apr 9, 2026

Deno v2.7.12

↗

2.7.12 / 2026.04.09

feat(ext/node): add fs.SyncWriteStream (#33226)
feat(ext/node): add llhttp-based HTTPParser with native cppgc binding (#33202)
feat(ext/node): add native TLSWrap cppgc object (Rust core) (#33183)
feat: native uv_pipe_t implementation with NativePipe and FdTable (#33165)
fix(core): fix uv_pipe_open handle lifecycle to match libuv (#33225)
fix(core): free UvLoopInner on uv_loop_t drop to prevent worker memory leak (#33200)
fix(core): handle WouldBlock in op_print for non-blocking stdio (#33221)
fix(core): use c_char instead of i8 in uv_buf_t base cast (#33179)
fix(ext/napi): use per-isolate Private key for napi_wrap/napi_unwrap (#33204)
fix(ext/node): add dns.getDefaultResultOrder() API (#33197)
fix(ext/node): create net.Socket from file descriptors (#33150)
fix(ext/node): implement TCP.open(fd) (#33155)
fix(ext/node): implement timeout, killSignal, and pid for child_process spawnSync (#32810)
fix(ext/node): implement uv_ref for native TCP handles (#33174)
fix(ext/node): remove dead legacy TCP server accept path (#33172)
fix(ext/node): return real OS file descriptors from node:fs APIs (#33039)
fix(ext/node): rewrite Pipe.open(fd) to use raw fd ops (#33136)
fix(ext/node): support numeric FDs in child_process stdio array (#33140)
fix(ext/node): throw on cipher update with input >= 2^31-1 bytes (#33201)
fix(ext/webgpu): accept ArrayBuffer in GPUQueue.writeBuffer() as data source (#33152)
fix(io): remove global stdio statics, handle non-blocking stdin (#33219)
fix(node): validate resolved main path stays within package directory (#33170)
fix(otel): add timeout to OTEL HTTP exporter to prevent hangs (#33159)
fix(permissions): check deny rules against resolved IPs to prevent numeric hostname bypass (#33203)
fix(permissions): normalize IPv4-mapped IPv6 addresses in net permission checks (#33223)
fix(repl): surface CDP protocol errors and fix race in wait_for_response (#33190)
fix(runtime): cache canonicalized watch paths, fix spurious events (#33123)
fix(schema): fix the publish: false of deno.json schema (#33196)
fix: linked packages with peer deps failing to cache from lockfile (#33143)
fix: update release template workflow URLs to .generated.yml (#33116)
perf(ext/node): use aws-lc-sys EVP API for chacha20-poly1305 (#33110)

Apr 1, 2026

Deno v2.7.11

↗

2.7.11 / 2026.04.01

feat: add alpha and beta release channel support (#33098)
fix(ext/node): fire fs.watch events for immediate writes (#32935) (#32989)
fix(watch): reduce graceful shutdown timeout from 5s to 500ms (#33099)

Mar 31, 2026

Deno v2.7.10

↗

2.7.10 / 2026.03.31

feat: add include and exclude fields to compile config (#33024)
fix(ext/http): gracefully handle consumed external in OTel ops (#33027)
fix(ext/node): process.argv[0] is equivalent to execPath (#28915)
fix(ext/node): add chacha20-poly1305 cipher support (#33084)
fix(ext/node): drain pending messages before emitting worker exit event (#32623)
fix(ext/node): escape shell metacharacters in child_process args on Windows (#33071)
fix(ext/node): fix BadResource error in FileHandle.readLines() (#32685)
fix(ext/node): improve GCM cipher compat with Node.js (#33079)
fix(ext/node): improve sign/verify crypto compat with Node.js (#33083)
fix(ext/node): return pid from spawnSync (#33081)
fix(ext/web): fix infinite loop in WebTransport datagram overflow handling (#33075)
fix(install): all package.json aliases should be added to node_modules (#33068)
fix(lsp): don't double-encode query/fragment in notebook cell URIs (#33070)
fix(lsp): suggest import map aliases in auto-imports for local directories (#33048)
fix(npm): resolve linked packages not published to npm registry (#33021)
fix(outdated): use dist-tags.latest for Latest column, matching npm/pnpm/bun (#32939)
fix(resolver): resolve npm packages that shadow Node built-in names in BYONM mode (#32865)
fix(serde_v8): use actual bytes written in to_utf8_slow (#33074)
fix: use case-insensitive path matching for permissions on Windows (#33073)

Mar 28, 2026

Fresh v2.2.2

↗

What's Changed

Updates the examples on the homepage by @jasonmccallister in https://github.com/denoland/fresh/pull/3682
fix: typo in Subscribe page handler reference by @DouglasdeMoura in https://github.com/denoland/fresh/pull/3669
Update Code of Conduct link in Footer component by @written-fresh in https://github.com/denoland/fresh/pull/3679
Do not assign named exports into existing default export by @CertainLach in https://github.com/denoland/fresh/pull/3494
fix(vite): use manifest entry filename for server entry import by @cuipeiyu in https://github.com/denoland/fresh/pull/3595
docs: add example for session management by @DontMash in https://github.com/denoland/fresh/pull/3594
docs: add clarification for assets/static by @fry69 in https://github.com/denoland/fresh/pull/3525
fix: handle paths with whitespaces in staticFiles by @LY1806620741 in https://github.com/denoland/fresh/pull/3659
perf: make updater faster by streaming instead of reading into memory by @ottenhoff in https://github.com/denoland/fresh/pull/3630
docs: add contributing section by @fry69 in https://github.com/denoland/fresh/pull/3384
chore: minor code cleanups by @marvinhagemeister in https://github.com/denoland/fresh/pull/3103
feat: expose HttpError for clients by @marvinhagemeister in https://github.com/denoland/fresh/pull/3080
docs: update project setup commands in READMEs by @SisyphusZheng in https://github.com/denoland/fresh/pull/3334
fix: handle invalid date objects in jsonify stringify by @dahlia in https://github.com/denoland/fresh/pull/2851
chore: remove showcase page by @bartlomieju in https://github.com/denoland/fresh/pull/3703
fix: vendor check_docs to avoid raw GitHub URL rate limits by @bartlomieju in https://github.com/denoland/fresh/pull/3704

New Contributors

@muhaimincs made their first contribution in https://github.com/denoland/fresh/pull/3686
@jasonmccallister made their first contribution in https://github.com/denoland/fresh/pull/3682
@DouglasdeMoura made their first contribution in https://github.com/denoland/fresh/pull/3669
@alphatra made their first contribution in https://github.com/denoland/fresh/pull/3660
@cngarrison made their first contribution in https://github.com/denoland/fresh/pull/3547
@cuipeiyu made their first contribution in https://github.com/denoland/fresh/pull/3595
@DontMash made their first contribution in https://github.com/denoland/fresh/pull/3594
@briansimoni made their first contribution in https://github.com/denoland/fresh/pull/3212
@LY1806620741 made their first contribution in https://github.com/denoland/fresh/pull/3659
@ottenhoff made their first contribution in https://github.com/denoland/fresh/pull/3630
@wfrancescons made their first contribution in https://github.com/denoland/fresh/pull/3236
@j0si made their first contribution in https://github.com/denoland/fresh/pull/2970
@dahlia made their first contribution in https://github.com/denoland/fresh/pull/2851

Full Changelog: https://github.com/denoland/fresh/compare/2.2.1...2.2.2

Last Checked

3h ago

Domain

deno.com

Deno

2.8.2 / 2026.06.03

2.8.1 / 2026.05.27

2.8.0 / 2026.05.22

2.7.14 / 2026.04.28

Fresh 2.3: Zero JavaScript by default, View Transitions, and Temporal support

Zero JavaScript by default

View Transitions

First-class WebSocket support

Vite integration improvements

CSP nonces and IP filtering

OpenTelemetry: server-to-browser trace propagation

Temporal API in islands

Multiple static directories

Loading indicators on form submissions

Reverse proxy support

deno create support

Bug fixes

What's next

2.7.13 / 2026.04.22

2.7.12 / 2026.04.09

2.7.11 / 2026.04.01

2.7.10 / 2026.03.31

What's Changed

New Contributors

`deno create` support