What Deno Actually Is
Deno is a JavaScript and TypeScript runtime built on V8 and Rust.
Ryan Dahl created it after getting frustrated with Node.js's design decisions. Deno 2.0 launched in October 2024 and it's finally stable enough that you won't get weird crashes every other day.
The whole point is security by default. Unlike Node.js, which gives scripts full system access unless restricted, Deno blocks everything. Want to read files? You need --allow-read
. Network access? That's --allow-net
.
I had a malware package try to phone home during development once
- the script just crashed with a permission error instead of silently stealing my AWS keys. That's when I realized this security model actually works.
TypeScript Without Configuration Hell
Deno runs .ts
files directly. No tsconfig.json
, no build step, no transpiler setup bullshit. You write TypeScript, you run it. This eliminates about 90% of the "it works on my machine" issues that make you want to throw your laptop out the window.
Testing is built-in too. deno test
runs your tests without installing Jest, Mocha, or whatever testing framework the JavaScript community decided to obsess over this month.
npm Compatibility
Deno 2.0 finally imports npm packages directly:
import express from \"npm:express@4.18.2\";
Most packages work fine. Express, lodash, axios
- the usual suspects work without drama. But good luck with anything that makes Node.js-specific filesystem assumptions or uses native modules. I spent 3 hours debugging a package that expected
__dirname
to exist.
Performance
Deno performs about the same as Node.js for most workloads. Both use V8, so JavaScript execution is identical. The Rust implementation makes some system operations faster, but for typical web applications you won't notice the difference.
Cold starts are faster than Node.js, which actually matters for serverless deployments where you're not keeping processes warm.
The Downsides
The ecosystem is tiny compared to npm. While npm compatibility helps, you're still dealing with a platform that has maybe 1% of Node's package ecosystem. Some advanced Node.js features just don't exist yet.
The permission flags get old fast. You'll be typing --allow-net --allow-read --allow-write --allow-env
so often you'll want to make an alias. Most people just use --allow-all
in dev because life's too short to remember which flag lets you read a config file.
TypeScript support, while excellent, can be slower for large projects since there's no incremental compilation yet. On a 50k+ line codebase, you'll notice the compile time difference compared to tsc --watch. It's not dealbreaker slow, but it's noticeable.