chore(deps): update dependency deno to v2.9.6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
deno (source)	2.9.5 → 2.9.6

---

Release Notes

denoland/deno (deno)

v2.9.6

Compare Source

2.9.6 / 2026.08.27

• feat(compressible): add support for 'text/x-component' content type (#​36450)
• feat(desktop): clipboard api (#​35750)
• feat(desktop): support checked, icon, and tooltip on menu items (#​36649)
• fix(bundle): isolate esbuild downloads from workspace registries (#​36467)
• fix(cache): combine duplicate headers for Vary matching (#​36476)
• fix(cli_parser): remove orphaned sync-types parser
• fix(core): cap adaptive buffer initial allocations (#​36432)
• fix(core): make Unix pipe fd ownership explicit (#​36353)
• fix(core): make user timer waker state thread-safe (#​36495)
• fix(coverage): compare a range against a line in V8's units (#​36613)
• fix(crypto): preserve RSA-OAEP label bytes (#​36441)
• fix(desktop): keep dots in the app name when resolving the runtime library
  (#​36006)
• fix(desktop): keep the macOS bundle signature valid unless an update is
  applied (#​36574)
• fix(desktop): never block the JS thread on the error-report dialog (#​36575)
• fix(desktop): propagate deno.json version and license into packaged installers
  (#​36577)
• fix(desktop): run Vite-based HMR dev servers inside the desktop runtime
  (#​36488)
• fix(desktop): transport binding args and results as DesktopValue so Uint8Array
  survives (#​36573)
• fix(ext/fetch): enforce permissions for proxy transports (#​36217)
• fix(ext/fetch): only retry transport errors on pooled connections (#​36415)
• fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB
  (#​36558)
• fix(ext/http): keep request body readable after response is sent (#​36629)
• fix(ext/http): route invalid async responses to onError (#​36437)
• fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#​36556)
• fix(ext/napi): run JS-calling finalizers safely, NULL string result, and
  Float16Array (#​36572)
• fix(ext/napi): surface OS error and path on addon load failure (#​36630)
• fix(ext/napi): track pending finalizers by identity (#​36551)
• fix(ext/napi): wake the event loop at the next uv_timer deadline (#​36559)
• fix(ext/net): skip unsupported DNS records in ANY queries (#​36650)
• fix(ext/node): accept string ports in dns.lookupService (#​36546)
• fix(ext/node): build the proxied request target with the URL parser (#​36557)
• fix(ext/node): do not resume client TLS sessions unless requested (#​36592)
• fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#​36407)
• fix(ext/node): handle readv short reads (#​36211)
• fix(ext/node): require sys permission for inspector.open (#​36465)
• fix(ext/node_sqlite): invalidate sessions on database close (#​36633)
• fix(ext/tls): avoid panic for mismatched client certificate and key (#​36457)
• fix(ext/web): clean up abort handlers when listeners are removed (#​36226)
• fix(ext/web): close transfer MessagePort when a transferred readable is
  cancelled (#​36270)
• fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode()
  (#​36611)
• fix(fetch): require an initial multipart boundary (#​36470)
• fix(ffi): validate struct return buffers (#​36373)
• fix(fmt): honor .editorconfig when formatting from stdin (#​36267)
• fix(fs): require write permission for creating opens (#​36497)
• fix(fs): use a private FsFile constructor token (#​36439)
• fix(glob): retain valid gitignore rules after parse errors (#​36478)
• fix(http): preserve keep-alive after reading request body (#​36690)
• fix(http): truncate streaming responses to content length (#​36496)
• fix(lsp): restrict registry completion endpoint schemes (#​36477)
• fix(node): check reads during require resolution (#​36461)
• fix(node): match domain uncaught exception handling (#​36475)
• fix(node): preserve v8 deserializer view offsets (#​36460)
• fix(node): validate Brotli encoder operations (#​36530)
• fix(node): validate raw outgoing HTTP headers (#​36471)
• fix(node/crypto): preserve binary key export passphrases (#​36443)
• fix(node_crypto): apply RFC 7748 scalar decoding for X448 (#​36466)
• fix(node_crypto): size cipher updates by byte length (#​36459)
• fix(node_shim): preserve explicit argument delimiters (#​36435)
• fix(npm): flatten single-resolution peers when building package ids (#​36608)
• fix(npm): match peer fallbacks when checking peer resolution cache (#​36607)
• fix(npm): remove arrayref dependency (#​36653)
• fix(npm): resolve bare npm specifier when latest is too new for min dependency
  age (#​36619)
• fix(npm): use cached abbreviated metadata under --cached-only (#​36526)
• fix(npm): validate tar paths before extraction (#​36468)
• fix(os): serialize process environment updates (#​36074)
• fix(permissions): check resolved IP against import deny list (#​36486)
• fix(process): reject NULs in Windows arguments (#​36436)
• fix(process): validate whitespace-only loader environment values (#​36431)
• fix(publish): authenticate the package existence check so private packages
  work (#​36656)
• fix(publish): memoize publish order depth (#​36215)
• fix(publish): reject invalid JSR package names (#​36474)
• fix(repl): skip regex literals when validating input (#​36375)
• fix(runtime): unregister dropped signal resources (#​36213)
• fix(web): keep MessagePort resource identifiers private (#​36440)
• fix: bugs in primordials related to ObjectCreate and
  ObjectDefineProperties (#​36541)
• fix: prevent threadpool starvation with concurrent file locks (#​32789)
• perf(core): grow the op driver's future arena on demand (#​36678)
• perf(core): uncontended-borrow fast path for AsyncRefCell (#​36679)
• perf(core): use index-based SafeArrayIterator in primordials (#​36543)
• perf(core): zero-copy snapshot rehydration, drop bincode (#​36680)
• perf(ext/web): apply the base64url op design to standard base64 (#​36422)
• perf(ext/websocket): shrink the op_ws_create future (#​36681)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[w3nl]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}