CLI

deno task with no argument lists tasks. Flags: --cwd, --filter (workspace members), --if-present (exit 0 if missing), --eval (inline task), -j/--jobs.

Dependency management

deno add / deno install

Unprefixed package names default to npm. deno add express installs npm:express. Use a jsr: prefix or --jsr for JSR packages.

• -D, --dev — add under devDependencies (package.json only)
• --no-save — install without writing to the config file
• --lockfile-only — update only the lockfile
• --allow-scripts[=<pkg>] — permit npm lifecycle scripts
• --min-dep-age <age> — refuse packages published more recently than the given age, as a supply-chain attack mitigation. Defaults to one day, so installing a just-published version needs --min-dep-age=0. Accepts minutes (120), an ISO-8601 duration (P2D), or a cutoff date. Also spelled --minimum-dependency-age.

deno ci

Requires deno.lock, removes any existing node_modules, installs strictly from the lockfile, and errors if it is out of date. CI should run this, not deno install.

• --prod — exclude devDependencies
• --skip-types — exclude @types/* packages (name-based heuristic; may skip packages that ship runtime code)

deno outdated / deno update

• --update — apply updates rather than only listing them
• --latest — ignore existing semver ranges
• --lockfile-only — update within existing ranges without editing the config file (this is what npm update does)
• --compatible — only semver-compatible updates
• --recursive — across all workspace members

Filters select by alias in the config file, not real package name, and take wildcards and ! negation:

deno list

• --depth <n> — tree depth (0 = direct dependencies only)
• --prod / --dev — restrict to one dependency set
• --recursive — include all workspace members

deno info walks the module graph from an entrypoint; deno list reports what the project declares.

dx

dx <pkg> runs a package binary without installing it — npx / bunx / pnpm dlx / yarn dlx. A separate binary shipped alongside Deno, aliasing deno x, and absent from the top-level deno --help. Runs with the sandbox disabled.

Toolchain

deno fmt handles JS, TS, JSON(C), Markdown, and Jupyter notebooks; HTML, CSS, SCSS, LESS, YAML, Svelte, Vue, Astro, and Angular sit behind unstable options.

deno test discovers {*_,*.,}test.{js,mjs,ts,mts,jsx,tsx} and **/__tests__/**. --coverage-threshold=<pct> fails below a coverage percentage.

Suppress with // deno-lint-ignore <rule>, // deno-lint-ignore-file, // deno-fmt-ignore, // deno-fmt-ignore-file.

deno check --doc also checks JSDoc code blocks; --doc-only checks only JSDoc and Markdown blocks — a good way to keep documentation examples honest.

Project setup

deno create is the npm create / yarn create equivalent and covers that whole ecosystem: deno create vite, deno create astro, and so on. Unprefixed names are treated as npm packages; --jsr selects JSR, and -y bypasses the prompt and runs with full permissions.

Publishing

deno publish requires name, version, exports in deno.json. Flags: --dry-run, --allow-dirty, --allow-slow-types, --set-version, --token. Provenance is on by default in GitHub Actions, publicly linking the package to the build that produced it; --no-provenance disables it.

deno bump-version takes major, minor, patch, premajor, preminor, prepatch, prerelease. At a workspace root it applies to every member and rewrites jsr: references in the root import map. With no increment it derives per-package bumps from conventional commits since the last tag and prepends a release note to Releases.md.

deno pack flags: --dry-run, --output, --set-version, --ignore, --no-source-maps, --allow-dirty.

Permissions

Applies to run, serve, test, bench, compile, and eval.

Every --allow-* has a matching --deny-*, and deny always wins.

--allow-net scopes take ports (example.com:443) and Unix sockets (unix:/var/run/docker.sock). --allow-import defaults to a fixed allowlist — jsr.io, esm.sh, cdn.jsdelivr.net, and a few others — not to nothing.

Environment variables

deno --help lists the full set with descriptions.