1442 commits

Author	SHA1	Message	Date
Bartek Iwańczuk	2bf5c78666	fix(audit): handle 'review' actions (#31100) ... Closes https://github.com/denoland/deno/issues/31098	2025-10-27 12:44:02 +01:00
Bartek Iwańczuk	0ed74e6c53	feat(unstable): add deno audit subcommand (#30966) ... This commit adds a new `deno audit` subcommand that collects all dependencies and queries npm registry for information about known vulnerabilities of used npm packages. ``` $ ../deno/target/debug/deno audit ... ╭ Prototype Pollution Protection Bypass in qs │ Severity: high │ Package: qs │ Vulnerable: <6.0.4 │ Patched: >=6.0.4 │ Info: https://github.com/advisories/GHSA-gqgv-6jq5-jjj9 ╰ Actions: install express@5.1.0 (major upgrade) ╭ qs vulnerable to Prototype Pollution │ Severity: high │ Package: qs │ Vulnerable: <6.2.4 │ Patched: >=6.2.4 │ Info: https://github.com/advisories/GHSA-hrpp-h998-j3pp ╰ Actions: install express@5.1.0 (major upgrade) ╭ send vulnerable to template injection that can lead to XSS │ Severity: low │ Package: send │ Vulnerable: <0.19.0 │ Patched: >=0.19.0 │ Info: https://github.com/advisories/GHSA-m6fv-jmcg-4jfg ╰ Actions: install express@5.1.0 (major upgrade) ╭ serve-static vulnerable to template injection that can lead to XSS │ Severity: low │ Package: serve-static │ Vulnerable: <1.16.0 │ Patched: >=1.16.0 │ Info: https://github.com/advisories/GHSA-cm22-4g7w-348p ╰ Actions: install express@5.1.0 (major upgrade) Found 25 vulnerabilities Severity: 8 low, 6 moderate, 9 high, 2 critical ```	2025-10-23 18:43:59 +02:00
David Sherret	9da9db0d46	fix(check): error when type checking after deduping packages (#31049)	2025-10-21 23:11:01 -04:00
Nathan Whitaker	34dea6098e	feat(unstable): dynamic command-line completions for deno task (#30670) ... Closes #14039. Closes #30664.	2025-10-21 23:05:42 +00:00
Shannon Poole	0f81808c88	fix(coverage): don't process coverage for blob: urls (#31035) ... Fixes #31030.	2025-10-21 08:59:21 +02:00
David Sherret	9e21ce5532	feat(unstable): ability to specify minimum dependency age in deno.json file (#31007)	2025-10-20 14:50:17 +00:00
David Sherret	7912110a93	feat(unstable): ability to only install dependencies older than a certain date (#30752) ... Supports: - Relative number of minutes (ex. 120 for two hours) - ISO 8601 duration format (ex. P2D for two days) - RFC3339 absolute date (ex. 2025-09-16T10:48:01+00:00)	2025-10-17 12:16:05 -04:00
David Sherret	05958afda0	fix(npm): handle deno run/install of npm package with only directories.bin (#30919)	2025-10-17 12:06:15 -04:00
Nayeem Rahman	dd10efa4ef	fix: show referrer range in deno_core loader errors (#30981)	2025-10-14 14:09:12 +01:00
Nathan Whitaker	aca48143b5	fix(cache): don't try to set up node_modules with node_modules_dir manual in deno cache (#30957) ... Fixes #30949. Fixes #30938	2025-10-09 10:46:54 +02:00
Nathan Whitaker	f20c8cdb89	fix(update): preserve tilde in version range (#30946) ... Fixes https://github.com/denoland/deno/issues/30925	2025-10-08 17:50:30 +00:00
Nathan Whitaker	379789b209	fix(clean): do not panic on failure to get local cache path in clean --except (#30895)	2025-10-01 22:41:14 +00:00
Bartek Iwańczuk	ecfd6ae6fa	chore: upgrade to Rust 1.90 (#30793) ... Co-authored-by: Divy Srivastava <me@littledivy.com>	2025-09-29 15:16:55 -04:00
David Sherret	3b037dd00f	refactor: updates in preparation for supporting a minimum dependency age (#30849)	2025-09-25 18:31:49 -04:00
Leo Kettmeir	ebcda43eb6	fix(tunnel): rename --connected to --tunnel and better handle DENO_DEPLOY_TOKEN env variable (#30786) ... Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>	2025-09-25 23:30:13 +02:00
Nayeem Rahman	c6fe003af5	feat(lsp): describe/it test editor support (#30802)	2025-09-24 18:19:43 +00:00
Nathan Whitaker	d82f509c41	perf: stack allocated v8 scopes (#30827)	2025-09-23 17:54:14 -07:00
Nathan Whitaker	e7e1f1c13a	fix(bundle): reload html entrypoints with --watch (#30790) ... Fixes #30769.	2025-09-24 00:27:28 +00:00
Sahil H. Mobaidin	c7379b7c94	fix(cli/bundle): respect --frozen flag deno bundle command (#30825) ... fixes: https://github.com/denoland/deno/issues/30713	2025-09-23 21:50:04 +00:00
David Sherret	9c04b88b0a	fix(lint): skip module graph validation (#30815) ... We should just skip module graph validation here. Someone can verify it via other sub commands and this is only used for `no-slow-types`.	2025-09-23 00:57:54 +00:00
Bartek Iwańczuk	ff9840b266	fix(coverage): collect coverage data for workers (#30807) ... Closes https://github.com/denoland/deno/issues/13206	2025-09-23 00:33:53 +02:00
snek	4ddd342d8f	refactor(unstable): improved arg handling and metadata (#30772)	2025-09-19 16:36:47 +02:00
Luca Casonato	5570d6a56b	chore: update deno_graph to 0.100.1 (#30767)	2025-09-18 10:52:50 +02:00
Bartek Iwańczuk	9399f7b894	refactor: Rewrite usages of V8 inspector to the new API (#30743) ... Based on https://github.com/denoland/deno_core/pull/1193. This commit rewrites 3 parts of the system to use a new "sync" V8 inspector API exposed by `deno_core`: - REPL - coverage collection - hot module replacement Turns out the async abstraction over V8 inspector was unnecessary and actually greatly complicated usage of the inspector. Towards https://github.com/denoland/deno/issues/13572 Towards https://github.com/denoland/deno/issues/13206	2025-09-17 16:11:03 +02:00
David Sherret	73853545f1	fix(init): regression where deno init --npm stopped working on mac (#30730)	2025-09-15 18:33:47 +00:00
Nayeem Rahman	9e2472afc0	fix(check): filter resolution errors for bare ambient modules (#30690)	2025-09-12 17:44:13 +01:00
Nathan Whitaker	4e4bbf2fcc	feat(bundle): support html entrypoint (#29856) ... For instance `deno bundle --outdir dist index.html` It will find scripts referenced in the html, bundle them, and then update the paths in index.html for the bundled assets. Right now it doesn't handle other assets (from `link` elements), but it could	2025-09-09 12:18:10 -07:00
David Sherret	41ff38ae65	fix(publish): unfurl import.meta.resolve calls (#30663) ... Closes #30659	2025-09-09 14:14:12 -04:00
David Sherret	ea419a6e39	feat(BREAKING/fmt): prompt or require deno fmt . when providing no files and no config files discovered (#30623) ... When running `deno fmt` with no input paths with no deno.json or package.json: * In tty environments, prompts for confirmation. * In non-tty environments, errors without providing the current directory (`deno fmt .`). The reason for this is we had too many complaints of people accidentally running `deno fmt` in a directory that wasn't a JS project.	2025-09-08 14:28:47 -04:00
Bartek Iwańczuk	9a93c65ac8	feat(install): refresh install report (#30615) ... Changes report format for `deno install` and other related package management subcommands: ``` $ deno install Installed 335 packages in 6s Reused 40 packages from cache ++++++++++++++++++++++++++++++++++++++++ Downloaded 2 packages from JSR ++ Downloaded 666 packages from npm ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Dependencies: + jsr:@std/cli 1.0.21 + jsr:@std/html 1.0.4 + npm:@babel/core 7.28.3 + npm:@babel/preset-react 7.27.1 + npm:@mjackson/node-fetch-server 0.7.0 + npm:@opentelemetry/api 1.9.0 + npm:@preact/signals 2.3.1 ```	2025-09-08 09:44:22 +00:00
Nathan Whitaker	baf185014d	fix(bundle): avoid cloning parsed source, restore owned transpile assertion (#30624)	2025-09-05 18:15:04 +00:00
Nathan Whitaker	6d0692e00a	fix(bundle): properly display error on invalid config in watch mode (#30621) ... Fixes https://github.com/denoland/deno/issues/30617	2025-09-05 02:21:59 +00:00
Nathan Whitaker	c76c3f7c13	feat(bundle): runtime API for deno bundle (#29949)	2025-09-04 09:47:27 -07:00
Meet Dhanani	8424cd4a32	feat(cli): reload environment variables with --watch and --env-file (#30197)	2025-09-04 09:32:30 -04:00
Leo Kettmeir	59f77c909e	refactor(webgpu): make cppgc arguments safer (#30563) ... Also updates `deno_core`. --------- Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>	2025-09-03 18:01:58 +02:00
Bartek Iwańczuk	4dfd44faab	feat: deno run with no arguments prints list of available tasks (#30592) ... Closes https://github.com/denoland/deno/issues/29552 --------- Signed-off-by: David Sherret <dsherret@users.noreply.github.com> Co-authored-by: David Sherret <dsherret@users.noreply.github.com>	2025-09-03 15:44:22 +00:00
David Sherret	2294364519	feat(lint): no-import-prefix workspace rule (#30598) ... Lint rule that's enabled by default in a workspace (when there's a deno.json or package.json) in order to encourage using bare specifiers and storing dependencies in a single place in the config file.	2025-09-02 22:59:19 +00:00
Nayeem Rahman	bb6c27e4cc	fix(check): support "compilerOptions.rootDirs" in tsconfig (#30495) ... Previously, to get the svelte template (`npx sv create`) to work under Deno, a knowledgeable user would have to convert the compiler options under `.svelte-kit/tsconfig.json` to a `deno.json`. This catches up Deno's tsconfig support so they don't have to change anything.	2025-09-02 19:39:57 +01:00
Bartek Iwańczuk	9fac6ccb8b	feat(test): Add setup and teardown APIs to Deno.test API (#30504) ... This commit adds `Deno.test.beforeAll`, `Deno.test.beforeEach`, `Deno.test.afterAll` and `Deno.test.afterEach` APIs. These APIs can be used to perform setup and teardown for test cases. The API is similar to the Vitest API: https://vitest.dev/api/#setup-and-teardown, with the main difference being that that `before*` hooks don't return a cleanup function.	2025-09-02 16:27:04 +02:00
David Sherret	17d02c228f	feat: permissions in the config file (#30330) ... Co-authored-by: nathanwhit <nathanwhit@users.noreply.github.com>	2025-09-02 13:37:33 +00:00
Bartek Iwańczuk	ada1580897	refactor: reorganize tools/test module (#30590) ... There are no functional changes in the code, it's just a refactor that moves code around to makes it easier to land https://github.com/denoland/deno/pull/30504	2025-09-01 23:13:50 +02:00
David Sherret	daa412b0f2	fix(init): use temp node_modules folders for deno init --npm ... (#30492) ... Changes it to use a temp directory for node_modules folders for `deno init --npm`	2025-08-29 23:33:47 +00:00
David Sherret	36620f6f57	fix: upgrade to swc_ecma_parser 23 (#30564)	2025-08-29 15:36:36 -04:00
Oliver Kuckertz	7b16237a43	feat(fmt): apply object spacing to import/export lines (#30371)	2025-08-28 19:23:45 -04:00
Nathan Whitaker	b88c621f22	fix(install): print install report on add, cache, and all install variants, move scripts and deprecation warnings after the report (#30549) ... We were only doing the new output on the top level install (`deno install` with no args or flags), we now do it on `deno install npm:chalk`, `deno add npm:chalk`, `deno cache ./foo.ts`, "deno install --entrypoint ./foo.ts"`. Additionally the scripts and deprecation warnings were printing above the output, now they're deferred and displayed below	2025-08-28 09:48:14 +02:00
Nathan Whitaker	6967c6d199	fix(bundle): do not error on fallible dynamic imports/requires (#30522) ... Fixes https://github.com/denoland/deno/issues/30510 Basically we save the error for later, return `None` to esbuild. Later when we process esbuild errors, if esbuild failed to resolve the same package then we use our error message instead of esbuild's Also this changes how we print out the esbuild errors to include the notes, which can often be useful	2025-08-27 11:30:47 -07:00
David Sherret	82f6b4714a	fix: add another space after warning symbol (#30482) ... The warning symbol was overlapping the text in my terminal.	2025-08-26 08:19:51 -07:00
Nathan Whitaker	b164cf5ade	fix(bundle): don't error when using npm package without bin as entrypoint (#30523) ... Fixes #30266.	2025-08-26 08:18:05 -07:00
David Sherret	5f9a64bcaf	refactor: remove WorkspaceDirectoryProvider (#30467)	2025-08-21 11:27:12 -04:00
Nathan Whitaker	84546d2f6f	feat(install): more informative deno install output (#30387) ... This commit updates output of `deno install` to look like so: ``` $ deno install Packages: 20 +++++++++++++++++ Resolved: 32, reused: 8, downloaded: 12, added: 10 Dependencies: + jsr:@std/http 1.0.2 + npm:express 1.0.1 ... ``` --------- Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>	2025-08-21 12:35:02 +02:00