Thank you, Deno | vlt /vōlt/

Ryan Dahl announced last week that the Deno staff is becoming a member of Cloudflare. The Deno runtime winds down over the following 12 months, JSR retains working on Cloudflare’s roads, & the staff’s new job, per Cloudflare’s post, is merging Deno’s celld into workerd.

The announcement got here two years to the day after Deno 2 shipped. Bun joined Anthropic ten months in the past. The tempting conclusion is that the alternative-runtime experiment is over & Node has received by default. In actuality, the ecosystem has gotten the advantages Deno was pushing, simply not from Deno itself.

Competition is crucial to a wholesome ecosystem

Unfortunately, Deno by no means actually hit vital mass in manufacturing; Node is as dominant in 2026 because it was in 2018. What Deno did obtain was to reinvigorate & put stress on the incumbent, & that stress did not solely run a method.

Deno began as a clear break. Ryan stood up at JSConf EU in 2018 & listed what he’d do otherwise from Node: deny-by-default permissions, TypeScript as a first-class enter, web-standard APIs on the server, ES modules solely, a single executable. And, pointedly, no npm, no bundle.json & no node_modules. Dependencies had been URLs. The slides put it plainly: “There is not any have to record dependencies.”

Lots of us who’d spent years on npm & Node had been skeptical of that final half (not the permissions or the TypeScript, which had been clearly good) & mentioned so on the time. We’d been there earlier than, within the hotlinking period, when each web page pulled jquery.min.js off any person else’s server & broke when it moved or obtained compromised. A URL tells you the place one thing was, not what it’s. Once you care that the bytes you examined are the bytes you ship, you want an integrity hash & someplace to report it, & you’ve got reinvented the lockfile. Matteo Collina of the Node TSC said in 2020 that “one other left-pad incident is ready to occur, however this time there isn’t a ‘central entity’ that may repair it.” Some of this skepticism was defensive however occurred to be proper ultimately.

Deno 1.0 shipped in 2020 on the unique phrases, & then spent the following 4 years strolling them again one piece at a time. First the deps.ts conference, one file that re-exported each URL: a manifest in all however title. Then lock.json, an integrity hash per URL: a lockfile. Then import maps, so you possibly can write naked specifiers once more. Deno’s personal documentation today recommends registries over HTTPS imports as a result of they “can drift to totally different variations throughout information” & “belief the serving host.” Those had been the objections from 2018, restated as steerage.

Then Bun confirmed up. Bun 0.1 was launched in July 2022 with the alternative guess: rebuild the toolchain from scratch for pace, however run current npm packages, learn bundle.json & act as a drop-in substitute for node. About six weeks later, Deno printed “Big Changes Ahead for Deno”, asserting npm: specifiers, a dedication to make 80–90% of npm packages work inside three months & a brand new aim of being “the quickest JavaScript runtime.” Deno credited person suggestions for the shift; the timing suggests Bun was a big a part of it. Deno 2, in October 2024, completed the job with full Node & npm compatibility. Four years after launching as the choice to Node’s ecosystem, Deno had turn out to be one other method to run it.

That was the correct name, & it was additionally an admission that the ecosystem wasn’t going to desert over a decade’s price of dependencies in a single day. Cloudflare’s workerd, which it open-sourced in 2022, grew its personal Node compatibility layer for a similar motive: that is the place the packages are.

Node ended up needing to reply. Since 2018 it has shipped a world fetch, WebSocket, Web Streams & Web Crypto; a stable test runner & –watch; –env-file & single-executable builds; a secure permission model; type stripping on by default; node:sqlite; & require(esm). Node’s contributors (many volunteers) did the onerous work to pay attention & make large adjustments, & they deserve a ton of credit score for it, however I do not suppose it occurs on that timeline with out three different runtimes delivery many of those concepts first. A mature open supply undertaking not often lacks good concepts. It lacks urgency, & rivals provide that urgency.

The requirements work got here out of the identical stress: WinterCG shaped in 2022 as a result of a number of severe runtimes made “what is the minimal widespread API?” a sensible query, & now, as Ecma TC55, it ought to outlast whichever runtimes consolidate subsequent.

Package managers & registries

For most of its historical past the JavaScript bundle ecosystem was a monoculture: one consumer, one registry, & an API contract casual sufficient that it stayed effectively undocumented for a decade & a half. Nearly each enchancment since got here from somebody refusing to just accept the established order.

Yarn (2016) insisted installs be deterministic & gave us the lockfile, workspaces & an offline cache; npm 5 shipped package-lock.json the following 12 months. pnpm confirmed that node_modules did not need to be lots of of megabytes of duplicated information. Bun made set up quick sufficient that the incumbents needed to revisit their efficiency. Deno argued it is best to be capable of learn a dependency’s supply earlier than you’re taking it, & whereas URL imports did not final, that concept did.

The clearest current instance is set up scripts. pnpm & Bun stopped working them by default; vlt never did. The argument had been made inside npm for your complete time I labored there with out ever changing into the default. In June of this 12 months, after a run of supply-chain worms, GitHub announced that npm 12 would stop running them by default too. Nothing concerning the thought modified in these years; sufficient different bundle managers shipped it that npm might not deal with it as radical. The stress runs in each instructions too: we borrowed catalogs from pnpm, & pnpm’s namedRegistries borrowed our named-registry aliases.

On the registry facet, JSR deserves credit score. It made a unique set of bets than we did: publish TypeScript supply, require ESM, generate docs from code. We disagreed with elements of it & added jsr: support to vlt anyway as a result of our customers requested for it. It survives the wind-down as a result of, so far as I can inform, it is low cost to run, its API is documented, & Cloudflare had a motive to maintain it alive.

What adjustments now

The two hottest impartial, venture-backed JavaScript runtimes now dwell inside corporations whose commerce is one thing else. Jarred Sumner said the Bun staff’s relationship with the Claude Code staff “most likely will look much like the connection between Google Chrome <> V8,” with extra independence, & Cloudflare’s submit makes clear that workerd’s roadmap is Cloudflare’s. That’s how JavaScriptCore & V8 have at all times been funded, & it is nonetheless a change.

Whether a group fork of the Deno runtime emerges will inform us whether or not the ecosystem values a secure-by-default, standards-first runtime sufficient to pay for one which is not connected to a cloud. And celld-into-workerd is new optionality at a layer that has had little or no: a self-hostable, open implementation of Workers & Durable Objects, led by Ryan & Bert Belder.

JavaScript has insurance coverage at nearly each layer: three manufacturing engines, a number of runtimes, a number of bundle managers. When one layer consolidates, because the runtime layer is doing now, the others maintain. The churn that makes this potential can be what folks complain about most. “JavaScript fatigue” has been a working joke for a decade: a brand new framework each week, a brand new bundler each month, & one more bundle supervisor, which, sure, I’m conscious I’ve contributed to. But no one needed to depart Node to get fetch, a permission mannequin or TypeScript and not using a construct step, & no one has to change bundle managers to get set up scripts turned off by default anymore. Those issues confirmed up within the instruments folks had been already utilizing as a result of another person shipped them first & the incumbent needed to reply. The tasks did not at all times win, however the concepts often did, & end-users collected them both method.

To Ryan, Bert, Bartek & the remainder of the Deno staff (previous & current): your collective efforts have enriched our shared ecosystem. Thank you!

Darcy Clarke
Founder & CEO, vlt