The release of Deno 1.28 has been announced, a platform for executing applications in JavaScript and TypeScript in isolation, which can be used to create server-side handlers. The platform is developed by Ryan Dahl, the creator of Node.js. Similar to Node.js, Deno uses the V8 JavaScript engine, which is also used in Chromium-based browsers. However, Deno is not a fork of Node.js; it is a completely new project created from scratch. The project's code is distributed under the MIT license. Builds are prepared for Linux, Windows, and macOS.
The Deno project was created to provide users with a more secure environment and to eliminate conceptual errors present in the Node.js architecture. To enhance security, the wrapper around the V8 engine is written in Rust, which helps avoid many vulnerabilities arising from low-level memory handling. For processing requests in a non-blocking manner, the Tokio platform, also written in Rust, is used. Tokio allows for the creation of high-performance applications based on event-driven architecture, supporting multithreading and asynchronous processing of network requests.
A key change in the new release is the stabilization of compatibility with packages hosted in the NPM repository, allowing Deno to utilize over 1.3 million modules created for the Node.js platform. For example, applications based on Deno can now use modules for organizing persistent data access, such as Prisma, Mongoose, and MySQL, as well as frameworks for frontend functionality, such as React and Vue. Some NPM modules still remain incompatible with Deno, for instance, due to bindings to Node.js-specific environmental elements like the package.json file. Additionally, using the 'deno compile' command with NPM modules is currently not possible. Future releases aim to resolve such incompatibilities and limitations.
Support for the previously used Deno model based on the ECMAScript module system and Web API is maintained at the same level, with the familiar URL-based loading scheme used for importing NPM modules. A special URL prefix "npm:" is designated for accessing NPM modules, similar to typical Deno modules. For instance, to import an NPM module, you can specify ‘import { chalk } from "npm:chalk@5";’, and to run an NPM script from the command line — "deno run —allow-env —allow-read npm:create-vite-extra".
Using NPM packages in Deno is significantly simpler than in Node.js, as there is no need for pre-installing modules (modules are installed upon the first application run), the package.json file is not utilized, and the node_modules directory is not used by default (modules are cached in a shared directory, but the old behavior can be reverted using the ‘—node-modules-dir’ option).
Applications based on NPM retain the ability to utilize the access control, isolation, and enhanced security features provided in Deno. To counter potential attacks through suspicious dependencies, Deno blocks all access to the system from dependencies by default and issues warnings about identified issues. For example, when a module attempts to gain write access to /usr/bin/, a confirmation request for this operation will be displayed: deno run npm:install-malware ⚠️ ┌ Deno requests write access to /usr/bin/. ├ Requested by `install-malware` ├ Run again with —allow-write to bypass this prompt. └ Allow? [y/n] (y = yes, allow; n = no, deny) >
Among the unrelated improvements in NPM in the new version, the update of the V8 engine to release 10.9, automatic detection of lock files, stabilization of the APIs Deno.bench(), Deno.gid(), Deno.networkInterfaces(), Deno.systemMemoryInfo(), and Deno.uid(), and the addition of a new unstable API Deno.Command() for running commands (a universal replacement for Deno.spawn, Deno.spawnSync, and Deno.spawnChild) are mentioned.
Key features of Deno:
- Security orientation in the default configuration. File access, network capabilities, and access to environment variables are blocked by default and require explicit enabling. Default applications run in isolated sandbox environments and cannot access system capabilities without explicit permissions.
- Built-in support for TypeScript alongside JavaScript. The standard TypeScript compiler is used for type checking and generating JavaScript, which results in a drop in performance compared to parsing JavaScript in V8.
- Runtime is provided as a single self-contained executable file ("deno"). To run applications using Deno, it's enough to download one executable file for your platform, which is about 30 MB in size, has no external dependencies, and does not require any special installation in the system. Additionally, deno is not a monolithic application but a collection of crate packages written in Rust (deno_core, rusty_v8) that can be used separately;
- When running a program, as well as for loading modules, addressable URL referencing can be used. For example, to run the program welcome.js, you can use the command “deno https://deno.land/std/examples/welcome.js”. Code from external sources is downloaded and cached on the local system but is never automatically updated (updating requires explicitly running the application with the flag “—reload”).
- Efficient handling of HTTP network requests in applications; the platform is designed for creating high-performance network applications.
- The ability to create universal web applications that can run both in Deno and in a regular web browser.
- A standard set of modules is available, which does not require binding to external dependencies. Modules from the standard collection have undergone additional auditing and compatibility checks.
- In addition to the runtime, the Deno platform also acts as a package manager and allows for referencing modules via URL within the code. For example, to load a module, one can specify in the code 'import * as log from "https://deno.land/std/log/mod.ts". Files loaded from external servers URLs are cached. Version binding of modules is determined by specifying version numbers within the URL, e.g., 'https://unpkg.com/liltest@0.0.5/dist/liltest.js'.
- The system includes a dependency inspection tool (the 'deno info' command) and a code formatting utility (deno fmt);
- All application scripts can be bundled into a single JavaScript file.
Source: opennet.ru
