Deno is a secure, modern runtime for JavaScript and TypeScript that eliminates npm and node_modules while enforcing default security through permissions. 1. It runs JavaScript and TypeScript natively without configuration. 2. By default, scripts have no access to the file system, network, or environment—permissions must be explicitly granted (e.g., --allow-read, --allow-net). 3. It uses a URL-based module system, importing dependencies directly from URLs with explicit versioning. 4. Built-in tools include a formatter (deno fmt), linter (deno lint), test runner (deno test), bundler (deno bundle), and language server, reducing reliance on third-party tools. 5. Ideal for small to medium backends, scripting, education, and TypeScript-first projects, though less suited for npm-dependent or native Node module-reliant environments. Deno offers a clean, secure alternative to Node.js for new projects prioritizing simplicity and safety.
Deno isn’t just another runtime for JavaScript and TypeScript—it’s a rethinking of what a modern, secure environment should be. Born out of lessons learned from Node.js, Deno was created by Ryan Dahl (Node’s original creator) to fix design flaws and prioritize security, simplicity, and developer experience from the ground up.

At its core, Deno executes JavaScript and compiles and runs TypeScript out of the box—no extra configuration needed. But what really sets it apart is how it handles security, modules, and tooling.
Secure by Default
One of Deno’s biggest selling points is its security model. Unlike Node.js, where scripts have full access to your file system, network, and environment by default, Deno takes a permission-based approach—similar to mobile apps.

By default, a Deno script can’t:
- Read or write files
- Make network requests
- Access the environment variables
- Spawn child processes
If a script tries to do any of these, it will throw a permission error unless explicitly allowed at runtime.

For example:
deno run script.ts
This runs with no permissions. To allow file access:
deno run --allow-read script.ts
Or network access:
deno run --allow-net script.ts
You can even scope permissions tightly:
deno run --allow-read=/home/user/docs script.ts
This model forces developers to think about what their code actually needs—great for reducing attack surface and improving transparency.
Modern Module System Without npm
Deno ditches the traditional package.json
and node_modules
in favor of a simpler, decentralized module system based on URLs.
Instead of installing packages via npm, you import them directly from URLs:
import { serve } from "https://deno.land/std/http/server.ts";
This means:
- No
node_modules
bloat - No dependency lock-in
- Clear, auditable imports
- Versioning is explicit in the URL:
import { join } from "https://deno.land/std@0.170.0/path/mod.ts";
While this approach avoids npm’s complexity, it also means you need to manage updates manually or use tools like
dprint
or import maps for larger projects.
Built-in Tooling for Better DX
Deno comes with several batteries-included tools, reducing the need for third-party packages:
-
Formatter (
deno fmt
) – Enforces consistent code style (Prettier-like) -
Linter (
deno lint
) – Finds potential bugs and style issues -
Test Runner (
deno test
) – Built-in testing with assertion libraries -
TypeScript Support – No config needed;
.ts
files just work -
Bundler (
deno bundle
) – Outputs a single JavaScript file - Language Server – Enables rich editor support (auto-complete, go-to-def, etc.)
This integrated tooling lowers setup time and keeps teams aligned without requiring complex configs or devDependencies.
Use Cases and When to Consider Deno
Deno shines in:
- Small to medium backend services (APIs, microservices)
- Scripting and automation (replacing bash or Node scripts)
- Educational tools and sandboxed environments
- Full-stack apps using modern TS (especially with frameworks like Fresh or Astro)
It’s less ideal for:
- Large ecosystems deeply tied to npm packages
- Projects requiring native Node.js modules (e.g.,
node-gyp
) - Environments where URL-based imports feel unfamiliar or hard to audit
Still, Deno’s runtime is stable, well-documented, and gaining traction—especially in security-sensitive or TypeScript-first environments.
Deno reimagines the JavaScript runtime with security and simplicity at the forefront. While it won’t replace Node.js overnight, it offers a compelling alternative for developers tired of
node_modules
hell and permissionless scripts running wild. With first-class TypeScript, no package manager, and least-privilege security, Deno feels like a step forward for the modern web.Basically, if you're starting fresh and value security and clean tooling, it’s worth a look.
The above is the detailed content of A Look into Deno: A Secure JavaScript and TypeScript Runtime. For more information, please follow other related articles on the PHP Chinese website!
-
Formatter (

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

There are three common ways to initiate HTTP requests in Node.js: use built-in modules, axios, and node-fetch. 1. Use the built-in http/https module without dependencies, which is suitable for basic scenarios, but requires manual processing of data stitching and error monitoring, such as using https.get() to obtain data or send POST requests through .write(); 2.axios is a third-party library based on Promise. It has concise syntax and powerful functions, supports async/await, automatic JSON conversion, interceptor, etc. It is recommended to simplify asynchronous request operations; 3.node-fetch provides a style similar to browser fetch, based on Promise and simple syntax

JavaScript data types are divided into primitive types and reference types. Primitive types include string, number, boolean, null, undefined, and symbol. The values are immutable and copies are copied when assigning values, so they do not affect each other; reference types such as objects, arrays and functions store memory addresses, and variables pointing to the same object will affect each other. Typeof and instanceof can be used to determine types, but pay attention to the historical issues of typeofnull. Understanding these two types of differences can help write more stable and reliable code.

Hello, JavaScript developers! Welcome to this week's JavaScript news! This week we will focus on: Oracle's trademark dispute with Deno, new JavaScript time objects are supported by browsers, Google Chrome updates, and some powerful developer tools. Let's get started! Oracle's trademark dispute with Deno Oracle's attempt to register a "JavaScript" trademark has caused controversy. Ryan Dahl, the creator of Node.js and Deno, has filed a petition to cancel the trademark, and he believes that JavaScript is an open standard and should not be used by Oracle

CacheAPI is a tool provided by the browser to cache network requests, which is often used in conjunction with ServiceWorker to improve website performance and offline experience. 1. It allows developers to manually store resources such as scripts, style sheets, pictures, etc.; 2. It can match cache responses according to requests; 3. It supports deleting specific caches or clearing the entire cache; 4. It can implement cache priority or network priority strategies through ServiceWorker listening to fetch events; 5. It is often used for offline support, speed up repeated access speed, preloading key resources and background update content; 6. When using it, you need to pay attention to cache version control, storage restrictions and the difference from HTTP caching mechanism.

Promise is the core mechanism for handling asynchronous operations in JavaScript. Understanding chain calls, error handling and combiners is the key to mastering their applications. 1. The chain call returns a new Promise through .then() to realize asynchronous process concatenation. Each .then() receives the previous result and can return a value or a Promise; 2. Error handling should use .catch() to catch exceptions to avoid silent failures, and can return the default value in catch to continue the process; 3. Combinators such as Promise.all() (successfully successful only after all success), Promise.race() (the first completion is returned) and Promise.allSettled() (waiting for all completions)

JavaScript array built-in methods such as .map(), .filter() and .reduce() can simplify data processing; 1) .map() is used to convert elements one to one to generate new arrays; 2) .filter() is used to filter elements by condition; 3) .reduce() is used to aggregate data as a single value; misuse should be avoided when used, resulting in side effects or performance problems.

JavaScript's event loop manages asynchronous operations by coordinating call stacks, WebAPIs, and task queues. 1. The call stack executes synchronous code, and when encountering asynchronous tasks, it is handed over to WebAPI for processing; 2. After the WebAPI completes the task in the background, it puts the callback into the corresponding queue (macro task or micro task); 3. The event loop checks whether the call stack is empty. If it is empty, the callback is taken out from the queue and pushed into the call stack for execution; 4. Micro tasks (such as Promise.then) take precedence over macro tasks (such as setTimeout); 5. Understanding the event loop helps to avoid blocking the main thread and optimize the code execution order.

Event bubbles propagate from the target element outward to the ancestor node, while event capture propagates from the outer layer inward to the target element. 1. Event bubbles: After clicking the child element, the event triggers the listener of the parent element upwards in turn. For example, after clicking the button, it outputs Childclicked first, and then Parentclicked. 2. Event capture: Set the third parameter to true, so that the listener is executed in the capture stage, such as triggering the capture listener of the parent element before clicking the button. 3. Practical uses include unified management of child element events, interception preprocessing and performance optimization. 4. The DOM event stream is divided into three stages: capture, target and bubble, and the default listener is executed in the bubble stage.
