denoland/deno
A modern runtime for JavaScript and TypeScript.
How deno is put together
denoland/deno is the Deno runtime: a JavaScript, TypeScript, and WebAssembly runtime built on V8 (with an optional QuickJS feature), Rust, and Tokio. The repository is a large Cargo workspace whose main binary (cli/) wires together a runtime library (runtime/), dozens of permission-gated 'ext' crates exposing web APIs to JS, and workspace libs for module resolution, npm compatibility, lockfiles, and snapshots. Data flow: the CLI parses flags/config, resolves modules via deno_graph/deno_resolver, loads code through the file fetcher/module loader into V8 isolates bootstrapped from snapshots, and executes ops bridging JS to Rust capabilities under the permission system. A TypeScript language server (cli/lsp) built on tower-lsp provides editor integration backed by a vendored tsc.
Languages
Frameworks
Datastores
Infrastructure
Major components
CLI binary (cli/)
Entry point (main.rs -> lib.rs) providing subcommands, flag parsing (cli/args/flags.rs), file fetching, module loading, type checking, formatting/linting/test/bench tooling, and `deno compile` self-contained binaries.
Runtime library (runtime/)
Provides deno_runtime: worker bootstrap, web workers, permissions enforcement, snapshot creation/loading, code cache, coverage, and wiring of all ext/* ops into V8 isolates.
Extension crates (ext/*)
Implement individual Web/platform APIs (fetch, http, crypto, fs, net, kv, websocket, webgpu, ffi, node compat, telemetry, etc.) as Rust ops exposed to JavaScript.
Workspace libraries (libs/*)
Shared building blocks: deno_core (JS engine bindings), serde_v8, resolver, config, lockfile, npm/npm_cache/npm_installer, eszip, dotenv, inspector_server, http_h1.
Language Server (cli/lsp/)
LSP server over tower-lsp offering completions, diagnostics, hover, code actions, refactors, and semantic tokens by driving a TS server (ts_server.rs/tsc.rs) plus deno lint and registry completion APIs.
Permission system (runtime/permissions, cli/schemas/permission-broker-*.json)
Implements Deno's capability model (--allow-net/--allow-read/etc.), including permission audit and broker request/response schemas.
Node/npm compatibility (ext/node, ext/node_crypto, ext/node_sqlite, libs/node_resolver, libs/node_shim)
Emulates Node.js APIs, npm package resolution/installation, .npmrc handling, and Node-API (napi) native addon support.
Tests & tooling (tests/, tools/, x)
Integration/unit/spec/node-compat/bench test suites plus maintenance scripts (release cutting, copyright checks, WPT sync, type generation) run with Deno itself.
A quieter week focused on performance tuning of the JavaScript engine core, plus a batch of small fixes for publishing, coverage, and native addons.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on performance tuning of the JavaScript engine core, plus a batch of small fixes for publishing, coverage, and native addons.
Week of 2026-08-17
Twenty-five fixes shipped this week, heavily concentrated on Node.js compatibility — including crypto, HTTP, and process handling — plus several networking and npm resolution corrections.
Week of 2026-08-10
A very busy week of 36 changes spanning security hardening (permissions for proxies and file writes), Node.js addon stability fixes, and performance improvements to base64 operations.
Week of 2026-08-03
The biggest structural week yet: the CLI's argument parser was rewritten entirely in-house, an experimental QuickJS engine backend debuted, and version 2.9.5 was released.
Week of 2026-07-27
A large 45-change week blending performance wins (smaller release binaries, faster startup and file I/O), numerous Node.js http2 compatibility fixes, and developer conveniences like the --unscoped add flag.
Over the past five weeks, Deno's development has been dominated by a wave of correctness fixes across its Node.js compatibility layer, networking stack, and security permissions, alongside a major architectural push: the CLI's command-line parsing was fully rewritten in-house (dropping the clap library) and an experimental QuickJS backend landed. Performance work continued steadily, with zero-copy snapshot rehydration, faster base64 encoding via SIMD, and reduced startup module evaluation. The project also shipped user-facing features like workspace-scoped tasks and a textStream() API, while tightening validation everywhere from DNS records to npm package names.
Week by week
2026-08-24A quieter week focused on performance tuning of the JavaScript engine core, plus a batch of small fixes for publishing, coverage, and native addons.latest6 changes
Refactor
Faster startup snapshot loading
Snapshots (pre-built program state that speeds up launch) are now rehydrated with zero-copy techniques after dropping an older serialization format.
Fix
Stricter package name checks when publishing
Invalid JavaScript Registry package names are now rejected before they can cause problems downstream.
Refactor
Core module map split up
The large internal ModuleMap component was divided into smaller focused pieces to make future maintenance easier.
Fix
Accurate code coverage line counts
Coverage reports no longer miscount lines by comparing values measured in different units.
Refactor
Lighter WebSocket connections
Opening a WebSocket now uses less memory thanks to a smaller internal data structure.
Fix
No more threadpool starvation on file locks
Concurrent file locking operations no longer exhaust the background worker pool that other tasks depend on.
2026-08-17Twenty-five fixes shipped this week, heavily concentrated on Node.js compatibility — including crypto, HTTP, and process handling — plus several networking and npm resolution corrections.6 changes
Fix
HTTP/2 header limit raised
The default maximum size for HTTP/2 request headers was increased to 256KB so larger legitimate requests aren't rejected.
Fix
Request body stays readable after responding
Fixes a bug where reading an incoming HTTP request body failed once a response had already been sent back.
Fix
Streaming responses truncated correctly
Streamed HTTP responses are now cut off at their declared content length instead of potentially sending extra bytes.
Fix
Stronger crypto curve handling
X448 key exchange now follows the official RFC rules for decoding secret scalars, matching Node.js behavior.
Fix
Safer Windows process arguments
Arguments containing NUL characters are rejected rather than silently corrupting commands launched on Windows.
Fix
npm peer dependency fixes
Two related changes make Deno resolve npm packages' shared dependencies more accurately, including flattening single-option peers and caching results correctly.
2026-08-10A very busy week of 36 changes spanning security hardening (permissions for proxies and file writes), Node.js addon stability fixes, and performance improvements to base64 operations.6 changes
Refactor
Faster base64 encoding
Standard base64 encode/decode was rewritten to use optimized SIMD routines, following the earlier speedup of the base64url variant.
Fix
Proxy connections now respect permissions
Network requests routed through a proxy now properly check the user's granted permissions before connecting.
Fix
File creation requires write permission
Opening a file for creation is now correctly gated behind write access, closing a permission-check gap.
Fix
Import deny list checks resolved IPs
Blocked-domain rules now apply even when a hostname resolves to a different IP address than expected.
Fix
Safe npm tarball extraction
Paths inside downloaded npm packages are validated before extraction, preventing malicious archives from writing outside their folder.
Fix
Native addon finalizer bugs fixed
Several crashes and double-cleanup issues in low-level Node.js addon teardown were fixed, including safe handling of new Float16Array buffers.
2026-08-03The biggest structural week yet: the CLI's argument parser was rewritten entirely in-house, an experimental QuickJS engine backend debuted, and version 2.9.5 was released.6 changes
Feature
Experimental QuickJS backend
Deno can now optionally run JavaScript on the QuickJS engine as an alternative to V8, opening the door to lighter-weight builds.
Refactor
CLI flag parsing rewritten
The entire command-line option parsing system was replaced with Deno's own parser, removing the external clap dependency from the codebase.
Feature
Workspace-only task running
A new --members flag lets you run defined tasks across all packages in a workspace without touching outside projects.
Feature
Blob/Body textStream() added
Web-standard Blob and Body objects gained a textStream() method to read their contents incrementally as text chunks.
Chore
Version 2.9.5 released
A patch release was cut and its changes merged back into the main branch, along with release tooling cleanups.
Fix
Inspector host header validation
The debugging inspector now validates incoming request host headers to guard against cross-site requests.
2026-07-27A large 45-change week blending performance wins (smaller release binaries, faster startup and file I/O), numerous Node.js http2 compatibility fixes, and developer conveniences like the --unscoped add flag.6 changes
Refactor
Smaller release binaries
Debugging unwind tables were stripped from Linux release builds, shrinking download sizes.
Refactor
Faster startup and file reads
Less work happens eagerly when programs launch, and async file reads/writes now open files on a dedicated background pool for better speed.
Feature
--unscoped flag for deno add
Packages can now be aliased by their short unscoped name, simplifying installs of scoped registry packages.
Fix
http2 session cleanup fixes
Several Node.js-compatible http2 bugs were fixed, including stray settings callbacks and stalled file reads after streams close.
Fix
Redirect header scoping
Sensitive headers like authorization are now only forwarded on redirects when the destination shares the same origin.
Fix
v8.promiseHooks implemented
Node's promise lifecycle hooking API is now available, improving compatibility with profiling and monitoring tools.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
34 files reviewed; 0 of 1 claimed findings confirmed after verification.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required