Deno v2.8.3 — Release Notes & Engineering Impact

### 2.8.3 / 2026.06.11 - feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate (#34756) - feat(cli): support --env-file in dependency and registry subcommands (#34843) - feat(compile): support watch mode (#34860) - feat(config): support globs in links (#34849) - feat(ext/crypto): implement SubtleCrypto.supports() static method (#34903) - feat(ext/crypto): support ML-DSA JWK import/export (#34914) - feat(ext/fetch): support `priority` in `RequestInit` (#34716) - feat(ext/node): auto-instrument node:http2 with OpenTelemetry (#34510) - feat(ext/node): notify control socket when node:http server starts serving (#34949) - feat(ext/telemetry): honor OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT (#34787) - feat(ext/telemetry): honor OTEL_SPAN_EVENT_COUNT_LIMIT (#34795) - feat(ext/telemetry): support OTEL_TRACES_SAMPLER (#34764) - feat(fmt): add JSON trailing comma config (#33383) - feat(info): add localPath to npm packages in `deno info --json` (#34806) - feat(info): support --minimum-dependency-age flag (#34762) - feat(lsp): add "Debug" code lens for test steps (#34742) - feat(lsp): add Deno.test ignore and only code actions (#34861) - feat(lsp): diagnose import map files (#34864) - feat(lsp): provide hover info for import map resolutions (#34854) - feat(lsp): report `deno doc --lint` diagnostics (#34733) - feat(lsp): show no-slow-types diagnostics for JSR packages (#34740) - feat(outdated): warn about packages skipped due to registry errors (#34974) - feat(test): forward shebang permissions into `deno test --doc` (#35052) - feat(workspace): auto-discover external deno.json import maps (#34803) - feat(x): add deno x --ignore-scripts (#34952) - feat: `bump-version -c` to handle deno.json + package.json in same dir (#34770) - fix(add): accept npm version ranges on the command line (#34799) - fix(bundle): apply node-style CJS interop on all platforms (#34939) - fix(bundle): don't panic when esbuild binary is busy or unavailable (#34845) - fix(bundle): instantiate .wasm imports instead of emitting raw bytes (#34923) - fix(bundle): rename sourcemap for HTML entrypoints (#34901) - fix(bundle): respect `--check` and run the type checker (#33514) - fix(cache): retry locked cache database instead of deleting it (#34873) - fix(check): honor ts suppressions for unresolved imports (#34163) - fix(check): ignore doc comment dynamic imports (#34888) - fix(check): surface unresolved imports in .d.ts entrypoints (#34168) - fix(check): treat .d.ts in ESM-supporting npm packages as ESM (#34613) - fix(clean): keep cleaning when cache files are locked and report holders (#34946) - fix(clean): support `deno clean --dry-run` without --except (#34846) - fix(cli): accept allow-import for deno add (#35019) - fix(cli): check worker's own permissions for dynamic asset imports (#34707) - fix(cli): collect re-exported names for `deno test --doc` injection (#33511) - fix(cli): don't let --env-file set Deno's own runtime control vars (#35032) - fix(cli): don't suggest non-existent subcommand-flag combinations (#34810) - fix(cli): generate type-only doc-test imports under verbatimModuleSyntax (#33508) - fix(cli): include the typed name in unrecognized subcommand error (#34882) - fix(cli): strip trailing CR from args so CRLF shebangs work (#34968) - fix(compile): prune managed npm snapshot to graph-reachable packages (#34741) - fix(compile): resolve bare npm imports in --bundle worker sources (#34967) - fix(compile): run forked child's module instead of entrypoint (#34687) - fix(compile): support fs.fstatSync on vfs (#34892) - fix(console): %c colors with same red component as previous color (#34784) - fix(core): don't set ERR_MODULE_NOT_FOUND code on module linking errors (#34800) - fix(core): externalize lazy loaded sources (#34936) - fix(core): silence too_many_arguments on Callable trait method (#33475) - fix(core): use isolate_unchecked accessors for fast `&v8::Isolate` args (#33474) - fix(coverage): exclude linked/patched packages from coverage report (#34834) - fix(coverage): improve HTML report PageSpeed score (#34980) - fix(dotenv): include underscore in unbraced variable names (#34797) - fix(ext/crypto): ChaCha20-Poly1305 uses raw-secret format and iv param (#34915) - fix(ext/crypto): ML-KEM raw-seed, seed-form PKCS#8, and JWK (#34924) - fix(ext/crypto): align WebCrypto modern algorithms with the spec (#34941) - fix(ext/crypto): move getPublicKey to SubtleCrypto and validate usages (#34913) - fix(ext/crypto): support raw-public format for existing asymmetric keys (#34920) - fix(ext/crypto): use outputLength for SHAKE/cSHAKE/TurboSHAKE digests (#34911) - fix(ext/fetch): block requests to bad ports per Fetch Standard (#34863) - fix(ext/fetch): don't decompress empty body advertised as gzip/br (#34880) - fix(ext/fetch): only match multipart delimiter lines (#34587) - fix(ext/fetch): preserve empty multipart filenames (#35009) - fix(ext/ffi): accept Uint8Array<ArrayBufferLike> in FFI buffer types (#34999) - fix(ext/fs): clarify that Deno.symlink() needs unscoped permissions (#34991) - fix(ext/fs): report broken symlink read as NotFound, not FilesystemLoop (#34833) - fix(ext/fs): stream Deno.readDir entries (#35130) - fix(ext/http): don't crash server on dead streaming-body resource (#34933) - fix(ext/http): include buffered request bytes in size hint (#34831) - fix(ext/http): join split request headers consistently (#35081) - fix(ext/http): prefer brotli for equal compression q-values (#35011) - fix(ext/http): surface errors thrown while streaming a Deno.serve body (#35104) - fix(ext/io): cancel pending readable stream reads (#34986) - fix(ext/kv): update access_token error message to new deno deploy console (#34918) - fix(ext/kv): validate batchSize and expireIn inputs (#34782) - fix(ext/net): handle missing port and path in listen and listenDatagram (#31681) - fix(ext/node): accept non-canonical RSA SPKI keys (#34134) - fix(ext/node): accept scoped IPv6 interface in dgram addMembership (#34899) - fix(ext/node): bump emulated Node version to v24.15.0 (#34804) - fix(ext/node): clear nonblocking fd stdio for child pipes (#34962) - fix(ext/node): count forked child process sockets (#34096) - fix(ext/node): don't cache a pointer to the zlib result buffer (#35043) - fix(ext/node): don't expose Module.register stub (#34894) - fix(ext/node): enforce maxBuffer in child_process.spawnSync (#34053) - fix(ext/node): export runMain from node:module (#35065) - fix(ext/node): fix asciiSlice & ucs2Slice & hexSlice being too slow (#34525) - fix(ext/node): fix broken encoding validation in indexOfBuffer (#33393) - fix(ext/node): guard TCPWrap.open against adopting tracked fds (#35045) - fix(ext/node): guard sqlite authorizer reentrant replacement (#34983) - fix(ext/node): handle EMFILE in child_process.spawn and compound shell commands (#33544) - fix(ext/node): implement mock.property() in node:test (#34959) - fix(ext/node): implement setKeepAlive on native TCPWrap (#34865) - fix(ext/node): implement url.fileURLToPathBuffer (#34883) - fix(ext/node): keep node:vm ContextifyContext wrapper alive with its context (#35090) - fix(ext/node): keep sqlite iterator callbacks alive (#34982) - fix(ext/node): keep v8.serialize output readable by Node.js (#35118) - fix(ext/node): keep worker alive while holding a refed MessagePort (#34877) - fix(ext/node): match Node's UTF-8 replacement for invalid bytes in Buffer decode (#34947) - fix(ext/node): match Node.js when dns.lookup hostname is falsy (#34887) - fix(ext/node): propagate nextLoad(newUrl) redirect to default loader (#35027) - fix(ext/node): read proxy env vars without --allow-env (#34807) - fix(ext/node): replay direct writes on stale http retry (#34992) - fix(ext/node): support ChildProcess.send with net.Server handles (#34948) - fix(ext/node): throw ERR_UNKNOWN_BUILTIN_MODULE for unknown node: builtins (#34766) - fix(ext/node): trace v8 deserializer delegate (#34981) - fix(ext/node): transfer TCP handle ownership in http2 consumeStream (#35047) - fix(ext/node): unblock static module loads when registerHooks is active (#35026) - fix(ext/node): wire ConnectionsList hooks so headersTimeout doesn't spuriously fire (#34356) - fix(ext/node_crypto): support PBES2/AES-CBC bags in tls.createSecureContext pfx (#34438) - fix(ext/os): don't expose invalid env var keys from Deno.env.toObject() (#34711) - fix(ext/process): run shebang-less scripts via /bin/sh on ENOEXEC (#34945) - fix(ext/process): treat Windows kill on exited process as NotFound (#34889) - fix(ext/web): URL.createObjectURL throws ERR_INVALID_ARG_TYPE for non-Blob args (#34878) - fix(ext/web): clearer error when a resource-backed stream is consumed after close (#34964) - fix(ext/web): don't trip debugger on handled stream writer-release rejection (#35100) - fix(ext/web): fire FileReader progress events as tasks (#34763) - fix(ext/web): friendlier URLPattern construction errors (#35102) - fix(ext/web): repair text_decoder_stream bench after BlobStoreTrait change (#35044) - fix(ext/web): show state and supportsBYOB in ReadableStream inspect (#34932) - fix(ext/web): support SharedArrayBuffer over BroadcastChannel (#34961) - fix(ext/web): writableStreamForRid accepts any ArrayBufferView/ArrayBuffer (#35020) - fix(ext/webgpu): bounds-check + view-aware setBindGroup Uint32Array fast path (#33980) - fix(ext/webgpu): update published crate repository url (#33916) - fix(ext/websocket): send URL userinfo as Basic auth header (#34708) - fix(fmt): align singleBodyPosition schema values (#34304) - fix(fmt): pass newlineKind option to JSON and Markdown formatters (#32579) - fix(http): handle raw h1 serve regressions (#35049) - fix(info): normalize trailing spaces in file path args on Windows (#35008) - fix(inspector): attribute idle event-loop wait to (idle) in CPU profiles (#35034) - fix(install): handle ETXTBSY when setting up node_modules (#33311) - fix(install): preserve workspace member resolution in global install (#34989) - fix(install): suppress peer dependency warnings for overridden packages (#34935) - fix(jupyter): handle completion cursor_pos as Unicode codepoints (#35098) - fix(jupyter): verify HMAC signatures on incoming kernel messages (#34825) - fix(lint): helpful error for Deno.lint.runPlugin outside deno test (#35018) - fix(lint): name the offending plugin in lint plugin load errors (#35067) - fix(lockfile): write through deno.lock symlink instead of replacing it (#34826) - fix(lsp): cache JSR type roots (#34886) - fix(lsp): evict on-disk documents from cache when deleted or changed (#34858) - fix(lsp): ignore relative import map remaps (#34856) - fix(lsp): prefer exact import map remaps (#34855) - fix(lsp): start rename after extract refactors (#34832) - fix(lsp): suggest import map aliases for remaps (#34857) - fix(lsp): update cache after workspace folder changes (#32823) - fix(net): preserve unix abstract socket paths (#34874) - fix(npm): resolve workspace members with prerelease versions (#34928) - fix(npm): run workspace package lifecycle scripts (#34615) - fix(npm): support workspace: dependencies with an alias in package.json (#34990) - fix(ops): build fast-call errors without re-entering JS (#35042) - fix(outdated): include catalog dependencies in deno outdated/update (#34977) - fix(outdated): send npm Accept header when fetching package metadata (#35012) - fix(permissions): allow non-recursive reads/writes on ancestors of deny (#34504) - fix(permissions): correct -A wording in raw-mode prompt message (#35070) - fix(permissions): don't hang prompt when stdin is in raw mode (#34457) - fix(permissions): run special-file guard for no-follow ops (#34393) - fix(publish): allow stable text imports (#34692) - fix(publish): catch banned triple slash directives anywhere in file during dry-run (#35010) - fix(publish): detect circular workspace dependencies before authorization (#34823) - fix(publish): ignore unused type parameter diagnostics from fast check (#35017) - fix(publish): improve error reporting for JSR manifest verification (#34690) - fix(publish): preserve default export of `export *` re-exported module (#34709) - fix(repl): print uncaught exceptions from timers at the prompt (#35002) - fix(repl): report descriptive syntax error instead of "Unexpected token '<'" (#35016) - fix(repl): show tab completions for navigator.gpu (#35006) - fix(repl): treat trailing `.` as incomplete input (#35101) - fix(resolver): collapse redundant slashes in file specifiers (#34713) - fix(resolver): don't treat a linked deno.json package as an npm link (#34841) - fix(resolver): prefer deno jsx options over tsconfig (#34141) - fix(run): error instead of panicking when watch flags are used with stdin (#34785) - fix(runtime): cancel prompt on esc (#35004) - fix(runtime): don't panic on missing SnapshotOptions when no snapshot (#34929) - fix(runtime): keep lazy Deno namespace APIs writable (#35050) - fix(runtime): serialize terminal permission prompts (#34821) - fix(runtime): show import location for unsupported import attributes (#34824) - fix(runtime): source map maybe cjs modules (#35013) - fix(serde_v8): add recursion depth limit to deserializer (#34984) - fix(serve): apply import map to main module in `deno serve --watch` (#34893) - fix(test): do not report "only" notice when a test fails on its own (#35063) - fix(test): handle escaped markdown code fences (#35125) - fix(test): skip markdown roots when building watcher graph (#35003) - fix(test): support blockquoted markdown doc tests (#34871) - fix(test): wait for worker termination before pending promise failures (#35127) - fix(update): show version requirement in interactive picker (#34671) - fix(watch): detect newly created files in fmt/lint/test/bench --watch (#34828) - fix(watch): keep watcher alive when script calls Deno.exit() (#35021) - fix(watch): respect --watch-exclude in deno serve (#34847) - fix: ignore 0 value for OTEL_METRIC_EXPORT_INTERVAL (#35054) - fix: resolve global install import maps from original cwd (#34165) - fix: support --inspect family in NODE_OPTIONS (#34717) - fix: throw ERR_DIR_CLOSED on use-after-close in Dir (#34910) - perf(config): match glob paths relative to base (#35039) - perf(core): reduce native callback snapshot overhead (#35121) - perf(ext/fs): use file identity instead of canonicalize in copyFile same-path guard (#34750) - perf(ext/http): add Deno-owned HTTP/1.1 serve path (#34446) - perf(ext/web): ASCII fast path for streaming TextDecoder.decode (#34299) - perf(ext/web): convert geometry.js from lazy_loaded_esm to lazy_loaded_js (#34997) - perf(lsp): cache lint and doc diagnostics per document module (#34875) - perf(lsp): cache shared workspace data across members (#32476)