Deno v2.9.4 — Release Notes & Engineering Impact

### 2.9.4 / 2026.07.23 - feat(desktop): enable `--hmr` for React Router (#35900) - feat(ext/node): add a byteLength/length parameter to Buffer.indexOf/lastIndexOf/includes (#35872) - feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv (#36016) - feat: upgrade V8 to 150.2.0 (#36098) - fix(add): support --minimum-dependency-age flag in deno add/remove (#36099) - fix(cache): store Web Cache under origin data (#36145) - fix(canvas): require FFI permission for native window handles (#36080) - fix(clean): reject symlinked node_modules cleanup roots (#36190) - fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage (#36242) - fix(core): allow dynamic imports during cached module evaluation (#36258) - fix(core): bound error graph conversion (#36070) - fix(core): enforce JSON requests in FsModuleLoader (#36137) - fix(core): handle malformed error constructors (#36071) - fix(core): stop rejected dynamic imports before loading (#36136) - fix(desktop): make BrowserWindow bindings typeable (#35907) - fix(desktop): preserve binding wrappers after lazy op upgrade (#36065) - fix(desktop): strip runtime extension from app name (#36060) - fix(ext/napi): cancel async sends after close (#36077) - fix(ext/napi): scope callback info per invocation (#36076) - fix(ext/node): apply backpressure to http2 stream writes (#36044) - fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit (#36113) - fix(ext/node): implement worker_threads.locks via Web Locks (#35963) - fix(ext/node): node:sqlite backup() and deserialize() argument validation (#36127) - fix(ext/node): retry DNS query when its per-attempt timeout fires (#35955) - fix(ext/node): stop http2 file reads on stream close (#36061) - fix(ext/web): handle failed webtransport datagram setup (#36067) - fix(ext/webidl): implement `async_sequence` for `ReadableStream.from` (#35976) - fix(fetch): bound multipart part headers (#36096) - fix(fmt): keep embedded CSS custom property indentation stable (#35949) - fix(fs): require sys permission for umask (#36222) - fix(http): preserve trust proxy environment setting (#36073) - fix(init): validate temporary node_modules parent (#36142) - fix(jupyter): report codemirror_mode as a string (#36241) - fix(loader): reject non-JSON modules for JSON imports (#36135) - fix(napi): synchronize external string finalizers (#36078) - fix(net): clean up cancellation resources on early errors (#36229) - fix(net): limit WebTransport handshake frame buffering (#36068) - fix(node_http2): clean up destroyed sessions (#36043) - fix(node_resolver): handle CJS filesystem path edge cases (#36112) - fix(node_stream): handle Web Stream adapter errors (#36193) - fix(npm): avoid following lock poll symlinks (#36192) - fix(npm): download tarballs from the configured registry instead of registry.npmjs.org (#36187) - fix(npm): reject symlinked package materialization dirs (#36191) - fix(outdated): keep type-only dependencies in the lockfile (#36140) - fix(pack): support file paths longer than the tar name field (#36105) - fix(permissions): escape bidi controls in prompts (#36195) - fix(process): avoid collisions in Windows stdio pipe names (#36081) - fix(publish): constrain generated source rewrites (#36109) - fix(release): insert into versions.json in semver order (#36097) - fix(rt): isolate extracted native addons (#36144) - fix(runtime): bridge console to the inspector regardless of --inspect flag (#35795) - fix(runtime): give worker isolate threads the stack size we report (#36114) - fix(test): escape control characters in test names (#36196) - fix(tests): make npm test registry tolerate a bad advisories request body (#36138) - fix(tls): resolve sni requests concurrently (#36062) - fix(update): don't downgrade lockfile when npm cache is stale (#35904) - fix(webtransport): avoid url parse panic (#36066) - fix(webtransport): validate certificate dates (#36069) - fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge (#36025) - fix: discover config file for jsr: entrypoints (#35838) - fix: handle UTF-16 diagnostic columns (#36028) - perf(core): avoid duplicating lazy ESM snapshot sources (#36262) - perf(snapshot): mangle internal source identifiers (#36263) - perf: compress bundled AppImage runtimes (#36261) - perf: use FxHash for hot internal hash maps (#36100)