chore(deps): update dependency denoland/deno to v2.9.5

[renovate]

This PR contains the following updates:

Package	Update	Change
denoland/deno	patch	2.9.3 → 2.9.5

---

Release Notes

denoland/deno (denoland/deno)

v2.9.5

Compare Source

2.9.5 / 2026.08.06

• feat(add): --unscoped flag to alias packages by their unscoped name (#​36319)
• feat(task): add --members flag to run tasks in workspace members only (#​35748)
• feat: add Blob/Body textStream() (#​35616)
• feat: add experimental QuickJS backend (#​36194)
• fix(bundle): avoid esbuild protocol deadlock (#​36427)
• fix(bundle): respect runtime file permissions (#​36107)
• fix(cjs): use loader sources for recursive analysis (#​36111)
• fix(cli): escape control characters in external metadata (#​36198)
• fix(core): don't resolve internal module imports with the user's import map
  (#​36303)
• fix(crypto): add "raw-secret" to KeyFormat type (#​35708)
• fix(desktop): handle colored HMR URLs and page loads (#​36316)
• fix(desktop): retain update signature verification op (#​36152)
• fix(ext/crypto): allow deriveBits with length 0 (#​36283)
• fix(ext/napi): polyfill uv_handle_size and uv_strerror (#​36308)
• fix(ext/net): release completed QUIC stream resources (#​36247)
• fix(ext/net): require --allow-sys for node:dns.getServers() (#​35941)
• fix(ext/node): Node compat for web streams (#​36285)
• fix(ext/node): apply backpressure in Readable.toWeb() (#​36321)
• fix(ext/node): defer TLS write completion callback to avoid reentrancy panic
  (#​35867)
• fix(ext/node): don't fire http2 settings callback after session destroy
  (#​36230)
• fix(ext/node): gate constrained memory cgroup reads (#​36218)
• fix(ext/node): handle pre-quoted shell arguments (#​36371)
• fix(ext/node): implement node:test tags (#​36292)
• fix(ext/node): implement util.diff (#​36289)
• fix(ext/node): implement v8.promiseHooks API (#​36281)
• fix(ext/node): sort fs.readdir entries to match Node.js (#​36341)
• fix(ext/node): stop http2 file reads after stream close (#​36300)
• fix(ext/node): store blocklist ranges compactly (#​36212)
• fix(ext/node): support the fs flush option for writes (#​36290)
• fix(ext/node): use signatureAlgorithm digest for X509 ECDSA verify (#​36326)
• fix(ext/node_crypto): use named group exponent sizes (#​36347)
• fix(ext/web): attach Node error codes to WHATWG API validation errors (#​36288)
• fix(ext/websocket): disable HTTP/2 server push on wss upgrade path (#​36327)
• fix(fetch): scope redirect-sensitive headers by origin (#​36361)
• fix(ffi): reject resizable buffers in nonblocking calls (#​36259)
• fix(fmt): accept xml and svg extensions for stdin (#​36149)
• fix(fmt): update lax-markup to 0.3.2, lax-css and lax-sql to 0.3.0 (#​36397)
• fix(http): preserve stripped headers across redirects (#​36360)
• fix(inspector): validate request host headers (#​36348)
• fix(net): cancel pending writes on stream close (#​36369)
• fix(net): clean up concurrently dropped load-balanced listeners (#​36246)
• fix(net): handle malformed DNS record text (#​36374)
• fix(node): clean up Web Stream finished listeners (#​36227)
• fix(node): retain consumed HTTP stream wrapper (#​36254)
• fix(npm): ignore invalid package bin targets (#​36354)
• fix(npm): tolerate malformed scripts field in packuments (#​36324)
• fix(npmrc): match auth configs by authority and path (#​36359)
• fix(outdated): don't report JSR pre-release versions as latest (#​36325)
• fix(publish): report when the registry rejects a provenance attestation
  (#​36404)
• fix(resolver): don't treat deno eval modules as npm package files (#​36304)
• fix(runtime): map notify's Windows missing-path error to NotFound (#​35864)
• fix(sync-types): add reason to too_many_arguments allows (lint)
• fix(telemetry): handle reentrant attribute conversion (#​36256)
• fix(webgpu): own mapped range backing stores (#​36257)
• fix(webstorage): preserve Storage constructor name (#​35944)
• fix: capitalize IP in help text (#​36170)
• fix: upgrade deno_task_shell to 0.33.3 (#​36406)
• fix: wire no-legacy-abort unstable flag from deno.json config (#​36312)
• perf(core): run the common-path tick drain in Rust (#​36157)
• perf(ext/node): bypass dns lookup on literal IPs in udp send (#​35909)
• perf(ext/web): implement base64url encode/decode as simdutf ops (#​36398)
• perf(fs): open files on the blocking pool in async readFile/writeFile (#​36160)
• perf: order startup functions in release builds (#​36219)
• perf: reduce eager module evaluation at startup (#​36331)
• perf: remove Linux unwind tables from release artifacts (#​36265)

v2.9.4

Compare Source

2.9.4 / 2026.07.23

• feat(desktop): enable --hmr for React Router (#​35900)
• feat(ext/node): add a byteLength/length parameter to
  Buffer.indexOf/lastIndexOf/includes (#​35872)
• feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv (#​36016)
• feat: upgrade V8 to 150.2.0 (#​36098)
• fix(add): support --minimum-dependency-age flag in deno add/remove (#​36099)
• fix(cache): store Web Cache under origin data (#​36145)
• fix(canvas): require FFI permission for native window handles (#​36080)
• fix(clean): reject symlinked node_modules cleanup roots (#​36190)
• fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage
  (#​36242)
• fix(core): allow dynamic imports during cached module evaluation (#​36258)
• fix(core): bound error graph conversion (#​36070)
• fix(core): enforce JSON requests in FsModuleLoader (#​36137)
• fix(core): handle malformed error constructors (#​36071)
• fix(core): stop rejected dynamic imports before loading (#​36136)
• fix(desktop): make BrowserWindow bindings typeable (#​35907)
• fix(desktop): preserve binding wrappers after lazy op upgrade (#​36065)
• fix(desktop): strip runtime extension from app name (#​36060)
• fix(ext/napi): cancel async sends after close (#​36077)
• fix(ext/napi): scope callback info per invocation (#​36076)
• fix(ext/node): apply backpressure to http2 stream writes (#​36044)
• fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit
  (#​36113)
• fix(ext/node): implement worker_threads.locks via Web Locks (#​35963)
• fix(ext/node): node:sqlite backup() and deserialize() argument validation
  (#​36127)
• fix(ext/node): retry DNS query when its per-attempt timeout fires (#​35955)
• fix(ext/node): stop http2 file reads on stream close (#​36061)
• fix(ext/web): handle failed webtransport datagram setup (#​36067)
• fix(ext/webidl): implement async_sequence for ReadableStream.from (#​35976)
• fix(fetch): bound multipart part headers (#​36096)
• fix(fmt): keep embedded CSS custom property indentation stable (#​35949)
• fix(fs): require sys permission for umask (#​36222)
• fix(http): preserve trust proxy environment setting (#​36073)
• fix(init): validate temporary node_modules parent (#​36142)
• fix(jupyter): report codemirror_mode as a string (#​36241)
• fix(loader): reject non-JSON modules for JSON imports (#​36135)
• fix(napi): synchronize external string finalizers (#​36078)
• fix(net): clean up cancellation resources on early errors (#​36229)
• fix(net): limit WebTransport handshake frame buffering (#​36068)
• fix(node_http2): clean up destroyed sessions (#​36043)
• fix(node_resolver): handle CJS filesystem path edge cases (#​36112)
• fix(node_stream): handle Web Stream adapter errors (#​36193)
• fix(npm): avoid following lock poll symlinks (#​36192)
• fix(npm): download tarballs from the configured registry instead of
  registry.npmjs.org (#​36187)
• fix(npm): reject symlinked package materialization dirs (#​36191)
• fix(outdated): keep type-only dependencies in the lockfile (#​36140)
• fix(pack): support file paths longer than the tar name field (#​36105)
• fix(permissions): escape bidi controls in prompts (#​36195)
• fix(process): avoid collisions in Windows stdio pipe names (#​36081)
• fix(publish): constrain generated source rewrites (#​36109)
• fix(release): insert into versions.json in semver order (#​36097)
• fix(rt): isolate extracted native addons (#​36144)
• fix(runtime): bridge console to the inspector regardless of --inspect flag
  (#​35795)
• fix(runtime): give worker isolate threads the stack size we report (#​36114)
• fix(test): escape control characters in test names (#​36196)
• fix(tests): make npm test registry tolerate a bad advisories request body
  (#​36138)
• fix(tls): resolve sni requests concurrently (#​36062)
• fix(update): don't downgrade lockfile when npm cache is stale (#​35904)
• fix(webtransport): avoid url parse panic (#​36066)
• fix(webtransport): validate certificate dates (#​36069)
• fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge
  (#​36025)
• fix: discover config file for jsr: entrypoints (#​35838)
• fix: handle UTF-16 diagnostic columns (#​36028)
• perf(core): avoid duplicating lazy ESM snapshot sources (#​36262)
• perf(snapshot): mangle internal source identifiers (#​36263)
• perf: compress bundled AppImage runtimes (#​36261)
• perf: use FxHash for hot internal hash maps (#​36100)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/deno-monorepo

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}