Deno v2.8.2 — Release Notes & Engineering Impact

### 2.8.2 / 2026.06.03 - feat(compile): improve --bundle dependency resolution and add --minify (#34536) - feat(compile): scope --bundle npm embed to packages actually reached (#34532) - feat(ext/crypto): add ChaCha20-Poly1305, SHAKE, cSHAKE, TurboSHAKE, SHA-3 HMAC (#34417) - feat(ext/crypto): add ML-DSA (FIPS 204) post-quantum signatures (#34448) - feat(ext/crypto): implement ML-KEM (FIPS 203) post-quantum KEM (#34447) - feat(ext/node): env/global proxy support for node:http and node:https (#34257) - feat(ext/node): support DENO_SERVE_ADDRESS override in node:http servers (#34662) - feat(jupyter): rewrite kernel in JS, drop zeromq/runtimelib deps (#34083) - feat(lsp): autocomplete jsr:/npm:/node: in deno.json(c) imports (#34724) - feat(publish): unfurl import specifiers in Wasm modules (#34549) - feat(task): support --env-file flag (#34508) - feat(task): support exclusion groups in task name wildcards (#34506) - feat(unstable): add --bundle flag to `deno compile` (#34527) - feat: bump deno_task_shell to 0.33.0 (#34642) - fix(add): handle version tags like `@latest` in `deno add` for JSR packages (#32859) - fix(add): replace panic with error when deno.json discovery fails (#34517) - fix(bundle): skip decorator pass when module has no decorators (#34489) - fix(bundle): use node-style CJS interop for the Deno platform (#34533) - fix(cache): skip WAL journal mode on WSL-1 (#34499) - fix(cache_dir): EnsureCachedStrategy must surface cached redirects (#34563) - fix(check): make node:stream/web types alias the globals (#34606) - fix(check): resolve npm packages without types when type checking (#34551) - fix(cli): suppress bug-report banner on broken pipe print panics (#34552) - fix(cli/task): run recursive workspace tasks in parallel (#34512) - fix(compile): allow process.chdir() into the VFS (#34610) - fix(compile): bundle workers separately under --bundle (#34531) - fix(compile): cover CJS-deep imports under --bundle (#34534) - fix(compile): create code cache when importing JSON or Wasm modules (#34614) - fix(compile): detect svelte-adapter-deno build output (#34535) - fix(compile): don't surface graph errors for --include files (#34568) - fix(compile): embed workspace package.json files in the VFS (#34530) - fix(compile): enable ANSI colors on Windows in compiled binaries (#34701) - fix(compile): handle CJS and native addons in --bundle (#34529) - fix(compile): respect npm registry sub-paths when flattening node_modules (#34575) - fix(compile): support workers loaded from blob URLs (#34574) - fix(compile): transpile TypeScript imported at runtime (#34616) - fix(config): hook up verbatimModuleSyntax for the emit pipeline (#34495) - fix(config): make config auto-discovery skip the same errors on every platform (#34558) - fix(config): surface invalid "exports" map in linked/workspace packages (#34473) - fix(config): warn instead of erroring when start dir is not a workspace member (#34458) - fix(config): warn instead of erroring when workspace member dir is missing (#34511) - fix(core): TLA hang on dyn import when async dep triggers lazy ESM load (#34469) - fix(core): preserve WebAssembly streaming callback across new contexts (#34679) - fix(crypto): correct X448 PKCS#8 handling (#34578) - fix(doc): don't lint private-type-ref for cross-package types (#34339) - fix(doc): handle non-ASCII doc lint diagnostics (#34626) - fix(ext/console): degrade gracefully when getKeys throws (#24980) (#34464) - fix(ext/fetch): implement missing Request properties (#34607) - fix(ext/fetch): preserve static request body length (#34546) - fix(ext/ffi): match V8 stack-arg layout in turbocall trampoline on Apple silicon (#34561) - fix(ext/fs): error when copyFile source and destination are the same file (#34718) - fix(ext/fs): retry without FILE_FLAG_BACKUP_SEMANTICS on Windows when driver rejects it (#34686) - fix(ext/fs): surface non-UTF-8 file names from read_dir (#34623) - fix(ext/http): reject Response-like return from respondWith (#34589) - fix(ext/http): reject Response-like return from serve handler (#34416) - fix(ext/io): cancel pending FileResource reads on close (#34544) - fix(ext/napi): clear error for Windows addons that link against node.exe (#34696) - fix(ext/napi): disallow JS execution during napi_new_instance (#34496) - fix(ext/napi): polyfill libuv thread + semaphore primitives (#34571) - fix(ext/napi): polyfill more libuv symbols from compat layer (#34488) - fix(ext/net): re-enable 0-RTT support in QUIC (#34520) - fix(ext/node): add module findPackageJSON export (#34597) - fix(ext/node): add node:test/reporters builtin (#34595) - fix(ext/node): add stripTypeScriptTypes export (#34594) - fix(ext/node): capture IPC handle eagerly to fix cluster send deadlock (#34661) - fix(ext/node): cover node:module SourceMap export (#34591) - fix(ext/node): disable repl preview when a custom eval is supplied (#34498) - fix(ext/node): drop bogus Buffer.prototype._isBuffer marker (#34502) - fix(ext/node): export syncBuiltinESMExports from node:module (#34593) - fix(ext/node): expose gc from v8 setFlagsFromString (#34604) - fix(ext/node): fix latin1Slice being too slow (#34503) - fix(ext/node): honor windowsHide in child_process spawn (#34627) - fix(ext/node): prevent buffer decode detach race (#34632) - fix(ext/node): re-export inner spec for module.exports = require(X).Y (#34363) - fix(ext/node): refuse sqlite close() while a user callback is running (#34515) - fix(ext/node): report real error code for failed dns.lookup (#34697) - fix(ext/node): resolve global cache packages when require referrer is outside DENODIR (#34497) - fix(ext/node): route node:fs.statfs through FileSystem trait (#34444) - fix(ext/node): support cyclic imports in vm.Module.prototype.link() (#34472) - fix(ext/node): support vm dynamic import callback (#34572) - fix(ext/node): tolerate unreadable cwd in require._nodeModulePaths (#34542) - fix(ext/node): vm dynamic import without callback throws ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING (#34427) - fix(ext/web): forward console.group label to inspector log (#34341) - fix(ext/web): honor PerformanceObserver buffered flag (#34748) - fix(ext/web): make MessageEvent.ports a frozen array (#34773) - fix(fmt): update markup_fmt to fix quadratic inline CSS formatting (#34663) - fix(install): allow "minimumDependencyAge" object without "age" (#34523) - fix(install): handle pre-existing node_modules symlink on Windows (#34659) - fix(install): rewrite relative imports/scopes in copied deno.json (#34562) - fix(install): run workspace member dependency lifecycle scripts with member INIT_CWD (#34700) - fix(install): vendor type-only imports during `deno ci` (#34459) - fix(jupyter): exit kernel process after sending shutdown reply (#34554) - fix(jupyter): keep kernel alive across transient peer disconnects (#34550) - fix(jupyter): make kernel ZMTP handshake compatible with libzmq (#34755) - fix(jupyter): send transient: {} in execute_result so nbclient doesn't crash (#34483) - fix(jupyter): use stable PATH entry for kernel binary path (#34492) - fix(lsp): avoid empty import specifier completions (#34647) - fix(lsp): complete npm package exports (#34675) - fix(lsp): complete string union literals containing dots (#34664) - fix(lsp): discover all tests when names are duplicated (#34624) - fix(lsp): handle empty jsx completion ranges (#34651) - fix(lsp): handle parser panics while parsing documents (#34640) - fix(lsp): honor `moduleResolution: "bundler"` for npm dir imports (#34643) - fix(lsp): include configured deps in auto-imports (#34650) - fix(lsp): limit node_modules auto-import aliasing (#34674) - fix(lsp): merge duplicate completion imports (#34658) - fix(lsp): preserve URL extensions in `typeof import(...)` hovers (#34565) - fix(lsp): recover from TSC isolate OOM instead of crashing the language server (#34693) - fix(lsp): release idle memory back to the OS (#34727) - fix(lsp): skip parent process check when PID isn't visible (#34744) - fix(lsp): spurious diagnostics in Jupyter notebook cells (#34734) - fix(lsp): support test steps from imported helpers (#34648) - fix(lsp): surface CSS imports as .js to TypeScript (#34419) - fix(lsp): surface module-level uncaught errors in test runs (#34641) - fix(lsp): use cached registry config when offline (#34723) - fix(lsp): use file uris for neovim virtual definitions (#34653) - fix(lsp): walk to enabled nested workspaces (#34654) - fix(napi): report a clear error for legacy V8/nan native addons (#34683) - fix(napi): support ZeroMQ libuv addon symbols (#34657) - fix(node): avoid spurious ERR_MULTIPLE_CALLBACK on process.stdout/stderr (#34728) - fix(node): classify required js files as commonjs by default (#34673) - fix(node): full re-export fallback for unresolvable member re-exports (#34689) - fix(node): resolve CJS requires with multi-level relative specifiers on Windows (#34655) - fix(node): support module-sync export condition (#34599) - fix(node/repl): gate preview through V8 inspector throwOnSideEffect (#34566) - fix(npm): apply scoped registry auth to same-origin tarballs (#34698) - fix(npm): clean node_modules after deno remove (#34110) - fix(npm): downgrade latest tag for release age (#34581) - fix(npm): execute native binaries from npm package bin entries (#34375) - fix(npm): hoist direct deps over higher transitive versions (#34470) - fix(npm): share copy-package variants via symlink for class identity (#34691) - fix(resolver): don't resolve linked packages via bare specifier (#34519) - fix(rt): support host-FS CJS files in the standalone runtime (#34560) - fix(runtime): better error message when Deno.consoleSize() has no tty (#34538) - fix(runtime): suggest --allow-scripts for `bindings` native addon error (#34666) - fix(runtime): suggest N-API alternatives for legacy V8/nan addons (#34695) - fix(runtime): suggest Worker/node:vm alternatives for npm:isolated-vm (#34702) - fix(runtime/ops): unwatch shared RecommendedWatcher on FsWatcher close (#34467) - fix(task): preserve trailing backslashes in task arguments (#34505) - fix(task): restore terminal mode after task exits on Windows (#34685) - fix(test): abort with a message when a test exits with sanitizeExit disabled (#34491) - fix(test): don't kill the deno process on top-level Deno.exit() (#34564) - fix(test): wait for inspector to disconnect before exiting (#34559) - fix(tsc): resolve Web globals to Deno's versions in npm packages (#34634) - fix(watch): register dynamic raw imports with file watcher (#34463) - fix(watch): restore original cwd between watcher restarts (#34465) - fix: absolute links should be processed using directory functions (#34218) - fix: link to docs in JSON import error message (#34611) - fix: load classic blob worker main script directly (#34592) - fix: opt-in mitigation for React RCE/DoS CVEs (#34676) - fix: reject empty package name in package.json dependencies (#34514) - fix: remove node_shim exec dependency (#34739) - fix: resolve local file when folder name matches import-mapped package (#32854) - fix: send BroadcastChannel messages before close (#34628) - perf(cli): drop unused deno_ast bundler feature (#34424) - perf(ext/fetch): cache lowercased header names per Headers instance (#33683) - perf(ext/node): bulk-build header array and trim header OWS in place (#34443) - perf(ext/node): cache member-export-props analysis (#34471) - perf(ext/node): gate node:http async resource entry (#34608) - perf(ext/node): optimize empty node:http response end (#34493) - perf(ext/node): optimize node:http header matching (#34484) - perf(ext/node): skip node:http perf timing without observers (#34409) - perf(ext/web): convert hot stream queues to O(1) Queue, cache _state reads (#34437) - perf(http): remove legacy hyper 0.14 from deno_http (#34557) - perf(node): lazy stdio + fix LazyEsmModuleLoader source consumption (#34440) - perf(node): lazy-load node:stream/web cluster out of the snapshot (#34548) - perf(node): skip require permission checks when read is fully granted (#34722) - perf(runtime): update notify watcher dependency (#34567) - perf(web): reduce Brotli CompressionStream binary size (#34432) - perf: enable safe ICF (identical code folding) when linking (#34478) - perf: replace ipnetwork with ipnet (#34580)