最新のセキュリティ情報
10月22日(木)昨日
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite-plus >= 0.2.8, <= 1.0.0 → 1.1.0 The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [server.host](https://vite.dev/config/server-options#server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affe…
v2.9.8
2.9.8 / 2026.10.21 fix(compile): check read permission for dynamically imported local files ( #36925 ) fix(completions): complete script paths for bare deno run in zsh ( #36976 ) fix(core): keep op contexts alive until the isolate is disposed ( #37026 ) fix(coverage): skip the V8 code cache while collecting coverage ( #36901 ) fix(ext/fetch): bump hyper-util to 0.1.21 and hyper to 1.11.1 to cancel idle interval when pool empties ( #36968 ) fix(ext/napi): check napi_create_dataview bounds for overflow ( #36962 ) fix(ext/napi): ignore the callback return value while an exception is pending ( #3…
10月10日(土)
Deno is joining Cloudflare
Putting ourselves in the best place to build the future of the web
9月17日(木)
v2.9.7
2.9.7 / 2026.09.16 fix(audit): honor configured CA stores ( #36728 ) fix(cache): make HTTP authority paths unambiguous ( #36356 ) fix(cli): accept all valid sys permission descriptors ( #36753 ) fix(cli): don't duplicate passthrough args for deno deploy/sandbox ( #36722 ) fix(cli): generate valid bash completions ( #36736 ) fix(cli): preserve double dash before the entrypoint ( #36835 ) fix(cli): restore optional-value semantics for deno bundle --sourcemap ( #36723 ) fix(completions): keep the dash on short flags in zsh completions ( #36720 ) fix(desktop): complete deferred window close and f…
8月28日(金)
v2.9.6
2.9.6 / 2026.08.27 feat(compressible): add support for 'text/x-component' content type ( #36450 ) feat(desktop): clipboard api ( #35750 ) feat(desktop): support checked, icon, and tooltip on menu items ( #36649 ) fix(bundle): isolate esbuild downloads from workspace registries ( #36467 ) fix(cache): combine duplicate headers for Vary matching ( #36476 ) fix(cli_parser): remove orphaned sync-types parser fix(core): cap adaptive buffer initial allocations ( #36432 ) fix(core): make Unix pipe fd ownership explicit ( #36353 ) fix(core): make user timer waker state thread-safe ( #36495 ) fix(cover…
8月7日(金)
v2.9.5
2.9.5 / 2026.08.06 feat(add): --unscoped flag to alias packages by their unscoped name ( #36319 ) feat(task): add --members flag to run tasks in workspace members only ( #35748 ) feat: add Blob/Body textStream() ( #35616 ) feat: add experimental QuickJS backend ( #36194 ) fix(bundle): avoid esbuild protocol deadlock ( #36427 ) fix(bundle): respect runtime file permissions ( #36107 ) fix(cjs): use loader sources for recursive analysis ( #36111 ) fix(cli): escape control characters in external metadata ( #36198 ) fix(core): don't resolve internal module imports with the user's import map ( #363…
7月24日(金)
v2.9.4
2.9.4 / 2026.07.23 feat(desktop): enable --hmr for React Router ( #35900 ) feat(ext/node): add a byteLength/length parameter to Buffer.indexOf/lastIndexOf/includes ( #35872 ) feat(ext/node): support raw chacha20 cipher in crypto.createCipheriv ( #36016 ) feat: upgrade V8 to 150.2.0 ( #36098 ) fix(add): support --minimum-dependency-age flag in deno add/remove ( #36099 ) fix(cache): store Web Cache under origin data ( #36145 ) fix(canvas): require FFI permission for native window handles ( #36080 ) fix(clean): reject symlinked node_modules cleanup roots ( #36190 ) fix(compile): bump libsui to 0…
7月16日(木)
v2.9.3
2.9.3 / 2026.07.15 feat(cli): deno add --no-save and --save-optional ( #36039 ) feat(cli): add --min-dep-age alias ( #35914 ) feat(compile): support aarch64-pc-windows-msvc target ( #36004 ) feat(ext/fetch): add http2MaxHeaderListSize option to Deno.createHttpClient ( #33194 ) fix(bundle): preserve raw imports in watch mode ( #36040 ) fix(canvas): don't hold SurfaceData mut borrow over window resize ( #35993 ) fix(config): reject out-of-range minimum dependency ages ( #36051 ) fix(core): block user ext imports after resolution ( #36012 ) fix(core): deactivate idle TTY write handles ( #35886 )…
7月8日(水)
v2.9.2
2.9.2 / 2026.07.08 feat(desktop): autodetect React Router framework ( #35557 ) feat(desktop): enable --hmr for Vite and Nuxt ( #35851 ) feat(desktop): run HMR by framework dev server ( #35722 ) feat(desktop): window opacity and transparency APIs ( #35646 ) feat(desktop): wire --exclude-unused-npm through to compile ( #35740 ) feat(ext/node): implement v8.setHeapSnapshotNearHeapLimit ( #35694 ) feat(ext/telemetry): honor OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT ( #35068 ) feat(inspector): start inspector server on SIGUSR1 ( #35738 ) feat(node): implement getTestContext() in node:test ( #35678 ) feat:…
7月2日(木)
v2.9.1
2.9.1 / 2026.07.01 feat(check): add --desktop flag to type-check for deno desktop ( #35644 ) feat(desktop): register deep-link URL schemes at bundle time ( #35466 ) feat: update laufey to 0.5.0 ( #35663 ) fix(bundle): emit CSSStyleSheet for CSS raw imports ( #35598 ) fix(cache): skip checksums for cached 404 entries ( #35526 ) fix(config): don't strip workspace-member includes from deploy config ( #34788 ) fix(core): apply deferred fast-call op upgrade to the captured bootstrap clone ( #35630 ) fix(core): prevent shared-buffer timer expiry race from losing timers ( #35312 ) fix(desktop): defa…
6月26日(金)
v2.9.0
2.9.0 / 2026.06.25 Read more: http://deno.com/blog/v2.9 feat(bundle): add --declaration flag to generate rolled-up .d.ts files ( #33838 ) feat(cli): add deno link and deno unlink subcommands ( #34359 ) feat(cli): add deno watch subcommand ( #35301 ) feat(cli): add deno list subcommand to list declared dependencies ( #34972 ) feat(cli): auto-migrate pnpm-workspace.yaml on resolution failure ( #34993 ) feat(cli): provide a node on PATH when Node.js is not installed ( #34969 ) feat(compile): persist Web Storage/KV in a per-app data directory ( #34618 ) feat(coverage): add configurable coverage t…
6月25日(木)
Deno 2.9
`deno desktop` for building native desktop apps from web tech, first-class migration from npm/pnpm/yarn/Bun, CSS module imports, snapshot and parameterized testing, smaller `deno compile --bundle` binaries, and Node.js 26 compatibility.
6月12日(金)
v2.8.3
2.8.3 / 2026.06.11 feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate ( #34756 ) feat(cli): support --env-file in dependency and registry subcommands ( #34843 ) feat(compile): support watch mode ( #34860 ) feat(config): support globs in links ( #34849 ) feat(ext/crypto): implement SubtleCrypto.supports() static method ( #34903 ) feat(ext/crypto): support ML-DSA JWK import/export ( #34914 ) feat(ext/fetch): support priority in RequestInit ( #34716 ) feat(ext/node): auto-instrument node:http2 with OpenTelemetry ( #34510 ) feat(ext/node): notify control socket when node:http serve…
5月22日(金)
Deno 2.8
`import defer`, six new subcommands (`deno transpile`, `deno pack`, `deno bump-version`, `deno ci`, `deno why`, `deno audit fix`), network debugging in Chrome DevTools, framework-aware `deno compile`, and 3.66x faster cold npm installs.
2月25日(水)
Deno 2.7: Temporal API, Windows ARM, and npm overrides
Deno 2.7 stabilizes the Temporal API, adds Windows on ARM builds, npm overrides in package.json, brotli compression streams, self-extracting compiled binaries, deno create, and dozens of Node.js compatibility improvements.
2月24日(火)
Build a dinosaur runner game with Deno, pt. 6
Add structured logging, distributed traces, and game analytics to your Deno game and learn how to use Deno Deploy's built-in logs, traces, and metrics dashboards.
2月10日(火)
Build a dinosaur runner game with Deno, pt. 5
Capture player identities, add a customization modal, and persist those preferences via Oak + PostgreSQL.
2月3日(火)
Introducing Deno Sandbox
Instant Linux microVMs with defense-in-depth security for running untrusted code.
Deno Deploy is Generally Available
Deno Deploy is now generally available, plus some highlights of new features and tools.
1月27日(火)
Build a dinosaur runner game with Deno, pt. 4
Building a leaderboard with database integration for our example browser-based game.
12月23日(火)
Build a dinosaur runner game with Deno, pt. 3
Adding obstacles, collision detection and game mechanics to our example browser-based game.
12月16日(火)
Build a dinosaur runner game with Deno, pt. 2
This series of posts will guide you through building a simple game using Deno. This post sets up the game loop, user controls and basic game physics.
12月12日(金)
React / Next.js Denial-of-Service Vulnerability: Deno Deploy users protected
A high severity Denial-of-Service (DoS) vulnerability has been found in React Server Components and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other users.
12月10日(水)
Deno 2.6: dx is the new npx
This release includes `dx` for running package binaries, more granular permissions, source phase imports, faster type checking with `tsgo`, native source maps, `deno audit`, and much more.
12月9日(火)
Build a dinosaur runner game with Deno, pt. 1
This series of posts will guide you through building a simple game using Deno. Each post corresponds to a stage in the development process, gradually introducing new features and concepts.
12月4日(木)
React Server Functions / Next.js Vulnerability: Deno Deploy users protected
A critical Remote Code Execution (RCE) vulnerability has been found in React Server Functions and Next.js. Deno has implemented mitigations in Deno Deploy. Immediate upgrades are required for other users.
10月21日(火)
My highlights from the new Deno Deploy
Highlights from the new version of Deno Deploy.
10月17日(金)
Deno's Other Open Source Projects
Here’s a roundup of some of our popular open source libraries and how we use them in Deno.
9月30日(火)
How Deno protects against npm exploits
Recent supply chain attacks on npm is a reminder that Node and npm grants unfettered access to your systems. Here's how Deno, with an opt-in security model, protects against these vulnerabilities.
9月10日(水)
Deno 2.5: Permissions in the config file
Simpler permission management with permission sets, new Deno.test APIs for setting up and tearing down test cases, specifying custom headers in WebSocket connections, runtime APIs in deno bundle, and more.
7月2日(水)
Deno 2.4: deno bundle is back
Deno bundle is back, alongside the addition of bytes and text imports, stabilized built-in OpenTelemetry, a new --preload flag, simplified dependency management with deno update, and more.
5月20日(火)
Reports of Deno's Demise Have Been Greatly Exaggerated
Addressing recent Deno criticisms and sharing our vision for the future
5月2日(金)
How Plaid migrated 100 services to a new database platform 5x faster with Deno
Learn how Plaid used Deno to minimize downtime and improve cutover speed during a critical infrastructure migration.
5月1日(木)
Deno 2.3: Improved deno compile, local npm packages, and more
Deno 2.3 adds new features for deno compile and deno fmt, support for using local npm packages, several performance improvements, and more. Here are the biggest highlights.
4月10日(木)
Zero-config Debugging with Deno and OpenTelemetry
Debugging requires implementation to get the right data for you to resolve issues quickly. Here's how you can use Deno to capture necessary telemetry data without any additional work.
4月1日(火)
Exploring Art with TypeScript, Jupyter, Polars, and Observable Plot
With Deno's Jupyter support, you can explore, interact, and create interactive charts with TypeScript and HTML. Here's a tutorial featuring data of over 130,000 famous artworks.
3月31日(月)
Deno v Oracle Update 3: Fighting the JavaScript Trademark
Oracle has filed a partial motion to dismiss our fraud claim. We’re now waiting on the USPTO to weigh in.
3月14日(金)
How to get deep traces in your Node.js backend with OTel and Deno
Adding meaningful tracing to a Node backend requires additional instrumentation and configuration. Here’s another approach that requires zero additional code.
3月8日(土)
toranoana.deno #20 登録受付中(2025年3月14日)
Deno は東京で行われるミートアップ toranoana.deno #20 に開催協力します。以下、主な詳細とスケジュールの概要です。
3月7日(金)
Node just added TypeScript support. What does that mean for Deno?
Node's experimental TypeScript support will be stabilized in 23.6. Here's what Node's TypeScript integration looks like and how it compares to Deno.
2月27日(木)
The Dino 🦕, the Llama 🦙, and the Whale 🐋
Did you know you can run a large language model with Deno and Jupyter Notebooks? Here's how.
2月26日(水)
Publish a lint rule, get a prize
Deno's new lint plugin system means you can extend the deno lint functionality with your own rules. We're giving prizes for anyone who publishes a lint rule this week. Here's how to participate.
2月19日(水)
Deno 2.2: OpenTelemetry, Lint Plugins, node:sqlite
Deno 2.2 adds built-in OpenTelemetry, a new linter plugin API, node:sqlite, and major improvements to deno check, deno lsp, and deno task.
2月14日(金)
If you're not using npm specifiers, you're doing it wrong
One common way to import npm packages is with transpile services like esm.sh or unpkg.com, which converts npm modules to esm and hosts them on the web. However, since Deno 2, which supports npm natively, we recommend using npm specifiers. Here's why.
2月8日(土)
How Deno's documentation is evolving
Documentation is a critical part of developer experience. Here's how we're improving our documentation and what's to come.
2月5日(水)
Oracle justified its JavaScript trademark with Node.js—now it wants that ignored
Oracle filed a motion to dismiss in response to Deno’s petition to cancel its “JavaScript” trademark. But instead of addressing the real issue—that JavaScript is an open standard with multiple independent implementations—Oracle is trying to stall the process and sidestep accountability.
1月29日(水)
Intro to Wasm in Deno
Web Assembly, or Wasm, is a great way to increase performance in your web application. Here is an introductory guide to what it is and how you can use it.
1月21日(火)
Deno in 2024
We had a busy 2024 with the launch of Deno 2 and JSR, and dozens of features to simplify programming. Here are the biggest updates in 2024 and what's on the horizon.
12月5日(木)
Build a SolidJS app with Deno
Learn how to build a simple SolidJS application with Deno.
12月2日(月)
Run your Next.js SSR app on Deno Deploy
Here's how to get your Next.js SSR project up and running on Deno Deploy.