Frequently asked questions
Answers about Deno 2 Node compatibility, TypeScript, security, npm/JSR, and production use
Can Deno run a Node.js project directly?
Many projects can. Deno 2 supports package.json, npm packages, and a broad Node API surface, but native addons, loaders, install scripts, and edge APIs still need real tests. Use an incremental migration.
Does running TypeScript type-check it automatically?
Do not depend on that assumption. Execution emphasizes fast transpilation and startup; run deno check explicitly in CI.
Does secure-by-default make arbitrary untrusted code safe?
No. Permissions reduce default I/O, but code on one thread shares grants. --allow-run, FFI, resource exhaustion, and runtime vulnerabilities require OS or container isolation. Read Permission boundaries.
Should I use JSR or npm?
Follow the repository convention first. Check JSR for TypeScript-native packages and the standard library; use npm for mature Node packages. Decide from maintenance, compatibility, licensing, and supply-chain constraints.
Does deno.json replace package.json?
It can be standalone or coexist. Deno configuration owns tasks, imports, workspace, and tool settings; migrated projects can retain npm metadata and scripts in package.json.
Is Deno production-ready?
Yes, but a runtime does not supply pinning, least privilege, logs, health checks, capacity, secrets, rollback, or platform verification for you. Apply the production baseline.