Deno v2.9.6 — Release Notes & Engineering Impact

### 2.9.6 / 2026.08.27 - feat(compressible): add support for 'text/x-component' content type (#36450) - feat(desktop): clipboard api (#35750) - feat(desktop): support checked, icon, and tooltip on menu items (#36649) - fix(bundle): isolate esbuild downloads from workspace registries (#36467) - fix(cache): combine duplicate headers for Vary matching (#36476) - fix(cli_parser): remove orphaned sync-types parser - fix(core): cap adaptive buffer initial allocations (#36432) - fix(core): make Unix pipe fd ownership explicit (#36353) - fix(core): make user timer waker state thread-safe (#36495) - fix(coverage): compare a range against a line in V8's units (#36613) - fix(crypto): preserve RSA-OAEP label bytes (#36441) - fix(desktop): keep dots in the app name when resolving the runtime library (#36006) - fix(desktop): keep the macOS bundle signature valid unless an update is applied (#36574) - fix(desktop): never block the JS thread on the error-report dialog (#36575) - fix(desktop): propagate deno.json version and license into packaged installers (#36577) - fix(desktop): run Vite-based HMR dev servers inside the desktop runtime (#36488) - fix(desktop): transport binding args and results as DesktopValue so Uint8Array survives (#36573) - fix(ext/fetch): enforce permissions for proxy transports (#36217) - fix(ext/fetch): only retry transport errors on pooled connections (#36415) - fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB (#36558) - fix(ext/http): keep request body readable after response is sent (#36629) - fix(ext/http): route invalid async responses to onError (#36437) - fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#36556) - fix(ext/napi): run JS-calling finalizers safely, NULL string result, and Float16Array (#36572) - fix(ext/napi): surface OS error and path on addon load failure (#36630) - fix(ext/napi): track pending finalizers by identity (#36551) - fix(ext/napi): wake the event loop at the next uv_timer deadline (#36559) - fix(ext/net): skip unsupported DNS records in ANY queries (#36650) - fix(ext/node): accept string ports in dns.lookupService (#36546) - fix(ext/node): build the proxied request target with the URL parser (#36557) - fix(ext/node): do not resume client TLS sessions unless requested (#36592) - fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#36407) - fix(ext/node): handle readv short reads (#36211) - fix(ext/node): require sys permission for inspector.open (#36465) - fix(ext/node_sqlite): invalidate sessions on database close (#36633) - fix(ext/tls): avoid panic for mismatched client certificate and key (#36457) - fix(ext/web): clean up abort handlers when listeners are removed (#36226) - fix(ext/web): close transfer MessagePort when a transferred readable is cancelled (#36270) - fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode() (#36611) - fix(fetch): require an initial multipart boundary (#36470) - fix(ffi): validate struct return buffers (#36373) - fix(fmt): honor .editorconfig when formatting from stdin (#36267) - fix(fs): require write permission for creating opens (#36497) - fix(fs): use a private FsFile constructor token (#36439) - fix(glob): retain valid gitignore rules after parse errors (#36478) - fix(http): preserve keep-alive after reading request body (#36690) - fix(http): truncate streaming responses to content length (#36496) - fix(lsp): restrict registry completion endpoint schemes (#36477) - fix(node): check reads during require resolution (#36461) - fix(node): match domain uncaught exception handling (#36475) - fix(node): preserve v8 deserializer view offsets (#36460) - fix(node): validate Brotli encoder operations (#36530) - fix(node): validate raw outgoing HTTP headers (#36471) - fix(node/crypto): preserve binary key export passphrases (#36443) - fix(node_crypto): apply RFC 7748 scalar decoding for X448 (#36466) - fix(node_crypto): size cipher updates by byte length (#36459) - fix(node_shim): preserve explicit argument delimiters (#36435) - fix(npm): flatten single-resolution peers when building package ids (#36608) - fix(npm): match peer fallbacks when checking peer resolution cache (#36607) - fix(npm): remove arrayref dependency (#36653) - fix(npm): resolve bare npm specifier when latest is too new for min dependency age (#36619) - fix(npm): use cached abbreviated metadata under --cached-only (#36526) - fix(npm): validate tar paths before extraction (#36468) - fix(os): serialize process environment updates (#36074) - fix(permissions): check resolved IP against import deny list (#36486) - fix(process): reject NULs in Windows arguments (#36436) - fix(process): validate whitespace-only loader environment values (#36431) - fix(publish): authenticate the package existence check so private packages work (#36656) - fix(publish): memoize publish order depth (#36215) - fix(publish): reject invalid JSR package names (#36474) - fix(repl): skip regex literals when validating input (#36375) - fix(runtime): unregister dropped signal resources (#36213) - fix(web): keep MessagePort resource identifiers private (#36440) - fix: bugs in primordials related to `ObjectCreate` and `ObjectDefineProperties` (#36541) - fix: prevent threadpool starvation with concurrent file locks (#32789) - perf(core): grow the op driver's future arena on demand (#36678) - perf(core): uncontended-borrow fast path for AsyncRefCell (#36679) - perf(core): use index-based `SafeArrayIterator` in primordials (#36543) - perf(core): zero-copy snapshot rehydration, drop bincode (#36680) - perf(ext/web): apply the base64url op design to standard base64 (#36422) - perf(ext/websocket): shrink the op_ws_create future (#36681)