Deno 2.9.4

Deno 2.9.4 has shipped, bringing a solid collection of fixes and performance improvements to the JavaScript and TypeScript runtime. This point release focuses on refining the developer experience across the board — from desktop app development to Node.js compatibility.

Desktop HMR for React Router

One of the headline additions in 2.9.4 is support for the --hmr flag in the desktop module when using React Router. This enables hot module replacement during desktop application development, giving you instant feedback as you edit your components. No more manual restarts — just save and see your changes reflected in real time.

Node.js Compatibility Improvements

The ext/node layer continues to close the gap with Node.js. This release adds a byteLength/length parameter to Buffer.indexOf, lastIndexOf, and includes, matching Node.js's API surface more closely. Raw ChaCha20 cipher support has been added to crypto.createCipheriv, and the node:sqlite module now includes proper argument validation for backup() and deserialize().

The worker_threads.locks API is now implemented via the Web Locks API, enabling more reliable synchronization patterns in TypeScript workers. Backpressure is now properly applied to http2 stream writes, preventing memory buildup on slow connections.

V8 Upgrade to 150.2.0

Deno 2.9.4 upgrades V8 to version 150.2.0, bringing the latest JavaScript engine optimizations and security fixes. This underpins many of the performance gains in this release.

Key Bug Fixes

This release addresses over 50 issues. Some highlights include:

• npm registry handling — tarballs are now downloaded from the configured registry instead of always falling back to registry.npmjs.org, respecting private registries
• Symlink safety — the module resolver now rejects symlinked node_modules cleanup roots and lock poll symlinks, improving security
• WebTransport — fixed URL parse panics and added certificate date validation
• Canvas — FFI permission is now required for native window handles
• Console bridging — console output is now bridged to the inspector regardless of the --inspect flag
• Test names — control characters in test names are properly escaped to prevent terminal injection

Performance Wins

Three notable performance improvements landed: duplicate lazy ESM snapshot source avoidance, mangled internal source identifiers in snapshots, and compressed bundled AppImage runtimes. The internal hash maps were also switched to FxHash for hot paths, reducing lookup overhead.

Deno 2.9.4 is available now. Run deno upgrade to update your installation, or download the latest binaries from the official website.