## denoland/deno — v2.9.3…v2.9.4

_74 commits._

### Features
- **feat(ext/node): add a byteLength/length parameter to Buffer.indexOf/lastIndexOf/includes (#35872)** (d721949)
- **feat(desktop): enable `--hmr` for React Router (#35900)** (c0006c7)
- **feat: upgrade V8 to 150.2.0 (#36098)** (ab63eae)
- **feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv (#36016)** (d96ec1c)

### Fixes
- **fix(desktop): make BrowserWindow bindings typeable (#35907)** (614d2ff)
- **fix(net): clean up cancellation resources on early errors (#36229)** (059677e)
- **fix(fs): require sys permission for umask (#36222)** (c7615bd)
- **perf(snapshot): mangle internal source identifiers (#36263)** (757cd96)
- **perf(core): avoid duplicating lazy ESM snapshot sources (#36262)** (2a4b2f3)
- **perf: compress bundled AppImage runtimes (#36261)** (b033ae5)
- **fix(core): allow dynamic imports during cached module evaluation (#36258)** (9819e75)
- **fix(compile): bump libsui to 0.16.4 to fix Windows resource SizeOfImage (#36242)** (32b1a3c)
- **fix(jupyter): report codemirror_mode as a string (#36241)** (b92788c)
- **fix(ext/webidl): implement `async_sequence` for `ReadableStream.from` (#35976)** (fc3554a)
- **fix(ext/node): implement worker_threads.locks via Web Locks (#35963)** (527ccda)
- **fix(test): escape control characters in test names (#36196)** (fbbb6fa)
- **fix(npm): download tarballs from the configured registry instead of registry.npmjs.org (#36187)** (739b896)
- **fix: handle UTF-16 diagnostic columns (#36028)** (461d66f)
- **fix(node_stream): handle Web Stream adapter errors (#36193)** (de6f0d0)
- **fix(clean): reject symlinked node_modules cleanup roots (#36190)** (55573e8)
- **fix(npm): reject symlinked package materialization dirs (#36191)** (b5b33bf)
- **fix(init): validate temporary node_modules parent (#36142)** (1afbf6d)
- **fix(npm): avoid following lock poll symlinks (#36192)** (cc50e9c)
- **fix(rt): isolate extracted native addons (#36144)** (c70e617)
- **fix(permissions): escape bidi controls in prompts (#36195)** (232e2a8)
- **fix(core): enforce JSON requests in FsModuleLoader (#36137)** (933f43e)
- **fix(loader): reject non-JSON modules for JSON imports (#36135)** (5ad7b74)
- **fix(cache): store Web Cache under origin data (#36145)** (55a6ff0)
- **fix(ext/node): apply backpressure to http2 stream writes (#36044)** (b5f0435)
- **fix(napi): synchronize external string finalizers (#36078)** (bb5d899)
- **fix(runtime): bridge console to the inspector regardless of --inspect flag (#35795)** (1a9ed82)
- **fix(fmt): keep embedded CSS custom property indentation stable (#35949)** (dbec11a)
- **fix: discover config file for jsr: entrypoints (#35838)** (eba8189)
- **fix(update): don't downgrade lockfile when npm cache is stale (#35904)** (f3fe31f)
- **fix(ext/node): retry DNS query when its per-attempt timeout fires (#35955)** (9d20a1f)
- **fix(outdated): keep type-only dependencies in the lockfile (#36140)** (6534cf1)
- **perf: use FxHash for hot internal hash maps (#36100)** (2c7328f)
- **fix(ext/napi): cancel async sends after close (#36077)** (72866dc)
- **fix(tests): make npm test registry tolerate a bad advisories request body (#36138)** (3260572)
- **fix(publish): constrain generated source rewrites (#36109)** (c0b6f98)
- **fix(pack): support file paths longer than the tar name field (#36105)** (9bc1371)
- **fix(node_http2): clean up destroyed sessions (#36043)** (596b02c)
- **fix(fetch): bound multipart part headers (#36096)** (beb27b9)
- **fix(process): avoid collisions in Windows stdio pipe names (#36081)** (091a66f)
- **fix(canvas): require FFI permission for native window handles (#36080)** (f904996)
- **fix(core): stop rejected dynamic imports before loading (#36136)** (2e827aa)
- **fix(node_resolver): handle CJS filesystem path edge cases (#36112)** (742f36e)
- **fix(net): limit WebTransport handshake frame buffering (#36068)** (81453aa)
- **fix(ext/node): don't leave 0-byte .heapsnapshot files near the heap limit (#36113)** (5747962)
- **fix(runtime): give worker isolate threads the stack size we report (#36114)** (59f885b)
- **fix(ext/node): node:sqlite backup() and deserialize() argument validation (#36127)** (9c2e923)
- **fix(core): bound error graph conversion (#36070)** (fc49251)
- **fix(release): insert into versions.json in semver order (#36097)** (e235958)
- **fix(add): support --minimum-dependency-age flag in deno add/remove (#36099)** (5dd39c7)
- **fix(x): honor --minimum-dependency-age and deno.json minimumDependencyAge (#36025)** (2127d8e)
- **fix(http): preserve trust proxy environment setting (#36073)** (fae571f)
- **fix(desktop): preserve binding wrappers after lazy op upgrade (#36065)** (cba24dd)
- **fix(webtransport): validate certificate dates (#36069)** (e0a6f98)
- **fix(ext/napi): scope callback info per invocation (#36076)** (921954d)
- **fix(core): handle malformed error constructors (#36071)** (ba5e0a6)
- **fix(ext/web): handle failed webtransport datagram setup (#36067)** (50cfd7f)
- **fix(webtransport): avoid url parse panic (#36066)** (08de37b)
- **fix(tls): resolve sni requests concurrently (#36062)** (31c5175)
- **fix(desktop): strip runtime extension from app name (#36060)** (7ff3aec)
- **fix(ext/node): stop http2 file reads on stream close (#36061)** (2f969da)

### Backend
- **2.9.4 (#36271)** (14eea31)

### Tests
- **test(resolver): cover the extensionless-CJS binary guard (#35829)** (8e42fb0)
- **test: deflake parallel serve watcher test (#36064)** (2d6820a)

### Chore
- **chore: make prefer-primordials lint an internal plugin (#35978)** (28cbff0)
- **refactor(web,core): migrate ext/web/blob.rs off serde_v8 (#36231)** (72b0d96)
- **build: regenerate checksums when promoting LTS/RC releases (#36237)** (73eb1a4)
- **ci: free disk space before deno_core test job (#35956)** (0415d03)
- **chore: promote to LTS by re-stamping published release binaries (#36059)** (6ab6025)
- **chore: use standard executable permissions for promoted binaries (#36079)** (8cdf63d)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/denoland/deno?utm_source=github-action)._