chore(deps): update deno monorepo to v2.8.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
deno (source)	2.8.2 → 2.8.3

---

Release Notes

denoland/deno (deno)

v2.8.3

Compare Source

• feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate (#​34756)
• feat(cli): support --env-file in dependency and registry subcommands (#​34843)
• feat(compile): support watch mode (#​34860)
• feat(config): support globs in links (#​34849)
• feat(ext/crypto): implement SubtleCrypto.supports() static method (#​34903)
• feat(ext/crypto): support ML-DSA JWK import/export (#​34914)
• feat(ext/fetch): support priority in RequestInit (#​34716)
• feat(ext/node): auto-instrument node:http2 with OpenTelemetry (#​34510)
• feat(ext/node): notify control socket when node:http server starts serving
  (#​34949)
• feat(ext/telemetry): honor OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT (#​34787)
• feat(ext/telemetry): honor OTEL_SPAN_EVENT_COUNT_LIMIT (#​34795)
• feat(ext/telemetry): support OTEL_TRACES_SAMPLER (#​34764)
• feat(fmt): add JSON trailing comma config (#​33383)
• feat(info): add localPath to npm packages in deno info --json (#​34806)
• feat(info): support --minimum-dependency-age flag (#​34762)
• feat(lsp): add "Debug" code lens for test steps (#​34742)
• feat(lsp): add Deno.test ignore and only code actions (#​34861)
• feat(lsp): diagnose import map files (#​34864)
• feat(lsp): provide hover info for import map resolutions (#​34854)
• feat(lsp): report deno doc --lint diagnostics (#​34733)
• feat(lsp): show no-slow-types diagnostics for JSR packages (#​34740)
• feat(outdated): warn about packages skipped due to registry errors (#​34974)
• feat(test): forward shebang permissions into deno test --doc (#​35052)
• feat(workspace): auto-discover external deno.json import maps (#​34803)
• feat(x): add deno x --ignore-scripts (#​34952)
• feat: bump-version -c to handle deno.json + package.json in same dir
  (#​34770)
• fix(add): accept npm version ranges on the command line (#​34799)
• fix(bundle): apply node-style CJS interop on all platforms (#​34939)
• fix(bundle): don't panic when esbuild binary is busy or unavailable (#​34845)
• fix(bundle): instantiate .wasm imports instead of emitting raw bytes (#​34923)
• fix(bundle): rename sourcemap for HTML entrypoints (#​34901)
• fix(bundle): respect --check and run the type checker (#​33514)
• fix(cache): retry locked cache database instead of deleting it (#​34873)
• fix(check): honor ts suppressions for unresolved imports (#​34163)
• fix(check): ignore doc comment dynamic imports (#​34888)
• fix(check): surface unresolved imports in .d.ts entrypoints (#​34168)
• fix(check): treat .d.ts in ESM-supporting npm packages as ESM (#​34613)
• fix(clean): keep cleaning when cache files are locked and report holders
  (#​34946)
• fix(clean): support deno clean --dry-run without --except (#​34846)
• fix(cli): accept allow-import for deno add (#​35019)
• fix(cli): check worker's own permissions for dynamic asset imports (#​34707)
• fix(cli): collect re-exported names for deno test --doc injection (#​33511)
• fix(cli): don't let --env-file set Deno's own runtime control vars (#​35032)
• fix(cli): don't suggest non-existent subcommand-flag combinations (#​34810)
• fix(cli): generate type-only doc-test imports under verbatimModuleSyntax
  (#​33508)
• fix(cli): include the typed name in unrecognized subcommand error (#​34882)
• fix(cli): strip trailing CR from args so CRLF shebangs work (#​34968)
• fix(compile): prune managed npm snapshot to graph-reachable packages (#​34741)
• fix(compile): resolve bare npm imports in --bundle worker sources (#​34967)
• fix(compile): run forked child's module instead of entrypoint (#​34687)
• fix(compile): support fs.fstatSync on vfs (#​34892)
• fix(console): %c colors with same red component as previous color (#​34784)
• fix(core): don't set ERR_MODULE_NOT_FOUND code on module linking errors
  (#​34800)
• fix(core): externalize lazy loaded sources (#​34936)
• fix(core): silence too_many_arguments on Callable trait method (#​33475)
• fix(core): use isolate_unchecked accessors for fast &v8::Isolate args
  (#​33474)
• fix(coverage): exclude linked/patched packages from coverage report (#​34834)
• fix(coverage): improve HTML report PageSpeed score (#​34980)
• fix(dotenv): include underscore in unbraced variable names (#​34797)
• fix(ext/crypto): ChaCha20-Poly1305 uses raw-secret format and iv param
  (#​34915)
• fix(ext/crypto): ML-KEM raw-seed, seed-form PKCS#8, and JWK (#​34924)
• fix(ext/crypto): align WebCrypto modern algorithms with the spec (#​34941)
• fix(ext/crypto): move getPublicKey to SubtleCrypto and validate usages
  (#​34913)
• fix(ext/crypto): support raw-public format for existing asymmetric keys
  (#​34920)
• fix(ext/crypto): use outputLength for SHAKE/cSHAKE/TurboSHAKE digests (#​34911)
• fix(ext/fetch): block requests to bad ports per Fetch Standard (#​34863)
• fix(ext/fetch): don't decompress empty body advertised as gzip/br (#​34880)
• fix(ext/fetch): only match multipart delimiter lines (#​34587)
• fix(ext/fetch): preserve empty multipart filenames (#​35009)
• fix(ext/ffi): accept Uint8Array in FFI buffer types (#​34999)
• fix(ext/fs): clarify that Deno.symlink() needs unscoped permissions (#​34991)
• fix(ext/fs): report broken symlink read as NotFound, not FilesystemLoop
  (#​34833)
• fix(ext/fs): stream Deno.readDir entries (#​35130)
• fix(ext/http): don't crash server on dead streaming-body resource (#​34933)
• fix(ext/http): include buffered request bytes in size hint (#​34831)
• fix(ext/http): join split request headers consistently (#​35081)
• fix(ext/http): prefer brotli for equal compression q-values (#​35011)
• fix(ext/http): surface errors thrown while streaming a Deno.serve body
  (#​35104)
• fix(ext/io): cancel pending readable stream reads (#​34986)
• fix(ext/kv): update access_token error message to new deno deploy console
  (#​34918)
• fix(ext/kv): validate batchSize and expireIn inputs (#​34782)
• fix(ext/net): handle missing port and path in listen and listenDatagram
  (#​31681)
• fix(ext/node): accept non-canonical RSA SPKI keys (#​34134)
• fix(ext/node): accept scoped IPv6 interface in dgram addMembership (#​34899)
• fix(ext/node): bump emulated Node version to v24.15.0 (#​34804)
• fix(ext/node): clear nonblocking fd stdio for child pipes (#​34962)
• fix(ext/node): count forked child process sockets (#​34096)
• fix(ext/node): don't cache a pointer to the zlib result buffer (#​35043)
• fix(ext/node): don't expose Module.register stub (#​34894)
• fix(ext/node): enforce maxBuffer in child_process.spawnSync (#​34053)
• fix(ext/node): export runMain from node:module (#​35065)
• fix(ext/node): fix asciiSlice & ucs2Slice & hexSlice being too slow (#​34525)
• fix(ext/node): fix broken encoding validation in indexOfBuffer (#​33393)
• fix(ext/node): guard TCPWrap.open against adopting tracked fds (#​35045)
• fix(ext/node): guard sqlite authorizer reentrant replacement (#​34983)
• fix(ext/node): handle EMFILE in child_process.spawn and compound shell
  commands (#​33544)
• fix(ext/node): implement mock.property() in node:test (#​34959)
• fix(ext/node): implement setKeepAlive on native TCPWrap (#​34865)
• fix(ext/node): implement url.fileURLToPathBuffer (#​34883)
• fix(ext/node): keep node:vm ContextifyContext wrapper alive with its context
  (#​35090)
• fix(ext/node): keep sqlite iterator callbacks alive (#​34982)
• fix(ext/node): keep v8.serialize output readable by Node.js (#​35118)
• fix(ext/node): keep worker alive while holding a refed MessagePort (#​34877)
• fix(ext/node): match Node's UTF-8 replacement for invalid bytes in Buffer
  decode (#​34947)
• fix(ext/node): match Node.js when dns.lookup hostname is falsy (#​34887)
• fix(ext/node): propagate nextLoad(newUrl) redirect to default loader (#​35027)
• fix(ext/node): read proxy env vars without --allow-env (#​34807)
• fix(ext/node): replay direct writes on stale http retry (#​34992)
• fix(ext/node): support ChildProcess.send with net.Server handles (#​34948)
• fix(ext/node): throw ERR_UNKNOWN_BUILTIN_MODULE for unknown node: builtins
  (#​34766)
• fix(ext/node): trace v8 deserializer delegate (#​34981)
• fix(ext/node): transfer TCP handle ownership in http2 consumeStream (#​35047)
• fix(ext/node): unblock static module loads when registerHooks is active
  (#​35026)
• fix(ext/node): wire ConnectionsList hooks so headersTimeout doesn't spuriously
  fire (#​34356)
• fix(ext/node_crypto): support PBES2/AES-CBC bags in tls.createSecureContext
  pfx (#​34438)
• fix(ext/os): don't expose invalid env var keys from Deno.env.toObject()
  (#​34711)
• fix(ext/process): run shebang-less scripts via /bin/sh on ENOEXEC (#​34945)
• fix(ext/process): treat Windows kill on exited process as NotFound (#​34889)
• fix(ext/web): URL.createObjectURL throws ERR_INVALID_ARG_TYPE for non-Blob
  args (#​34878)
• fix(ext/web): clearer error when a resource-backed stream is consumed after
  close (#​34964)
• fix(ext/web): don't trip debugger on handled stream writer-release rejection
  (#​35100)
• fix(ext/web): fire FileReader progress events as tasks (#​34763)
• fix(ext/web): friendlier URLPattern construction errors (#​35102)
• fix(ext/web): repair text_decoder_stream bench after BlobStoreTrait change
  (#​35044)
• fix(ext/web): show state and supportsBYOB in ReadableStream inspect (#​34932)
• fix(ext/web): support SharedArrayBuffer over BroadcastChannel (#​34961)
• fix(ext/web): writableStreamForRid accepts any ArrayBufferView/ArrayBuffer
  (#​35020)
• fix(ext/webgpu): bounds-check + view-aware setBindGroup Uint32Array fast path
  (#​33980)
• fix(ext/webgpu): update published crate repository url (#​33916)
• fix(ext/websocket): send URL userinfo as Basic auth header (#​34708)
• fix(fmt): align singleBodyPosition schema values (#​34304)
• fix(fmt): pass newlineKind option to JSON and Markdown formatters (#​32579)
• fix(http): handle raw h1 serve regressions (#​35049)
• fix(info): normalize trailing spaces in file path args on Windows (#​35008)
• fix(inspector): attribute idle event-loop wait to (idle) in CPU profiles
  (#​35034)
• fix(install): handle ETXTBSY when setting up node_modules (#​33311)
• fix(install): preserve workspace member resolution in global install (#​34989)
• fix(install): suppress peer dependency warnings for overridden packages
  (#​34935)
• fix(jupyter): handle completion cursor_pos as Unicode codepoints (#​35098)
• fix(jupyter): verify HMAC signatures on incoming kernel messages (#​34825)
• fix(lint): helpful error for Deno.lint.runPlugin outside deno test (#​35018)
• fix(lint): name the offending plugin in lint plugin load errors (#​35067)
• fix(lockfile): write through deno.lock symlink instead of replacing it
  (#​34826)
• fix(lsp): cache JSR type roots (#​34886)
• fix(lsp): evict on-disk documents from cache when deleted or changed (#​34858)
• fix(lsp): ignore relative import map remaps (#​34856)
• fix(lsp): prefer exact import map remaps (#​34855)
• fix(lsp): start rename after extract refactors (#​34832)
• fix(lsp): suggest import map aliases for remaps (#​34857)
• fix(lsp): update cache after workspace folder changes (#​32823)
• fix(net): preserve unix abstract socket paths (#​34874)
• fix(npm): resolve workspace members with prerelease versions (#​34928)
• fix(npm): run workspace package lifecycle scripts (#​34615)
• fix(npm): support workspace: dependencies with an alias in package.json
  (#​34990)
• fix(ops): build fast-call errors without re-entering JS (#​35042)
• fix(outdated): include catalog dependencies in deno outdated/update (#​34977)
• fix(outdated): send npm Accept header when fetching package metadata (#​35012)
• fix(permissions): allow non-recursive reads/writes on ancestors of deny
  (#​34504)
• fix(permissions): correct -A wording in raw-mode prompt message (#​35070)
• fix(permissions): don't hang prompt when stdin is in raw mode (#​34457)
• fix(permissions): run special-file guard for no-follow ops (#​34393)
• fix(publish): allow stable text imports (#​34692)
• fix(publish): catch banned triple slash directives anywhere in file during
  dry-run (#​35010)
• fix(publish): detect circular workspace dependencies before authorization
  (#​34823)
• fix(publish): ignore unused type parameter diagnostics from fast check
  (#​35017)
• fix(publish): improve error reporting for JSR manifest verification (#​34690)
• fix(publish): preserve default export of export * re-exported module
  (#​34709)
• fix(repl): print uncaught exceptions from timers at the prompt (#​35002)
• fix(repl): report descriptive syntax error instead of "Unexpected token '<'"
  (#​35016)
• fix(repl): show tab completions for navigator.gpu (#​35006)
• fix(repl): treat trailing . as incomplete input (#​35101)
• fix(resolver): collapse redundant slashes in file specifiers (#​34713)
• fix(resolver): don't treat a linked deno.json package as an npm link (#​34841)
• fix(resolver): prefer deno jsx options over tsconfig (#​34141)
• fix(run): error instead of panicking when watch flags are used with stdin
  (#​34785)
• fix(runtime): cancel prompt on esc (#​35004)
• fix(runtime): don't panic on missing SnapshotOptions when no snapshot (#​34929)
• fix(runtime): keep lazy Deno namespace APIs writable (#​35050)
• fix(runtime): serialize terminal permission prompts (#​34821)
• fix(runtime): show import location for unsupported import attributes (#​34824)
• fix(runtime): source map maybe cjs modules (#​35013)
• fix(serde_v8): add recursion depth limit to deserializer (#​34984)
• fix(serve): apply import map to main module in deno serve --watch (#​34893)
• fix(test): do not report "only" notice when a test fails on its own (#​35063)
• fix(test): handle escaped markdown code fences (#​35125)
• fix(test): skip markdown roots when building watcher graph (#​35003)
• fix(test): support blockquoted markdown doc tests (#​34871)
• fix(test): wait for worker termination before pending promise failures
  (#​35127)
• fix(update): show version requirement in interactive picker (#​34671)
• fix(watch): detect newly created files in fmt/lint/test/bench --watch (#​34828)
• fix(watch): keep watcher alive when script calls Deno.exit() (#​35021)
• fix(watch): respect --watch-exclude in deno serve (#​34847)
• fix: ignore 0 value for OTEL_METRIC_EXPORT_INTERVAL (#​35054)
• fix: resolve global install import maps from original cwd (#​34165)
• fix: support --inspect family in NODE_OPTIONS (#​34717)
• fix: throw ERR_DIR_CLOSED on use-after-close in Dir (#​34910)
• perf(config): match glob paths relative to base (#​35039)
• perf(core): reduce native callback snapshot overhead (#​35121)
• perf(ext/fs): use file identity instead of canonicalize in copyFile same-path
  guard (#​34750)
• perf(ext/http): add Deno-owned HTTP/1.1 serve path (#​34446)
• perf(ext/web): ASCII fast path for streaming TextDecoder.decode (#​34299)
• perf(ext/web): convert geometry.js from lazy_loaded_esm to lazy_loaded_js
  (#​34997)
• perf(lsp): cache lint and doc diagnostics per document module (#​34875)
• perf(lsp): cache shared workspace data across members (#​32476)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[w3nl]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}