Deno CLI reference
Verified against Deno 2.9. deno <subcommand> --help is authoritative — check
it before guessing at a flag. --help=full adds runtime and permission flags;
--help=unstable shows unstable ones.
Execution
| Command | Purpose |
|---|---|
deno run <file> |
Run a module. deno <file> is equivalent. |
deno watch <file> |
Reload on change; alias for deno run --watch-hmr |
deno run --watch <file> |
Restart on file change, without hot replacement |
deno task <name> |
Run a task from deno.json or a script from package.json |
deno repl |
Interactive REPL |
deno eval "<code>" |
Evaluate a string |
deno task with no argument lists tasks. Flags: --cwd, --filter (workspace
members), --if-present (exit 0 if missing), --eval (inline task),
-j/--jobs.
Dependency management
| Command | Purpose |
|---|---|
deno install |
Install everything declared in the config file |
deno install <pkg> |
Add and install one package |
deno install --entrypoint <files> |
Install what those files import |
deno install -g <spec> |
Install a global executable into $DENO_INSTALL_ROOT/bin |
deno add <pkg> |
Add a dependency to the config file |
deno remove <pkg> |
Remove a dependency |
deno ci |
Clean, reproducible install from the lockfile |
deno outdated |
Show outdated dependencies |
deno update |
Alias for deno outdated --update |
deno list |
List declared dependencies (like npm ls) |
deno why <pkg> |
Explain why a package is in the tree |
deno audit |
Audit installed dependencies for vulnerabilities |
deno approve-scripts |
Approve npm lifecycle scripts |
deno link <path> |
Link a local JSR or npm package for development |
deno unlink <path> |
Undo deno link |
deno uninstall |
Remove a dependency or global executable |
deno add / deno install
Unprefixed package names default to npm. deno add express installs
npm:express. Use a jsr: prefix or --jsr for JSR packages.
-D, --dev— add underdevDependencies(package.jsononly)--no-save— install without writing to the config file--lockfile-only— update only the lockfile--allow-scripts[=<pkg>]— permit npm lifecycle scripts--min-dep-age <age>— refuse packages published more recently than the given age, as a supply-chain attack mitigation. Defaults to one day, so installing a just-published version needs--min-dep-age=0. Accepts minutes (120), an ISO-8601 duration (P2D), or a cutoff date. Also spelled--minimum-dependency-age.
deno ci
Requires deno.lock, removes any existing node_modules, installs strictly
from the lockfile, and errors if it is out of date. CI should run this, not
deno install.
--prod— exclude devDependencies--skip-types— exclude@types/*packages (name-based heuristic; may skip packages that ship runtime code)
deno outdated / deno update
--update— apply updates rather than only listing them--latest— ignore existing semver ranges--lockfile-only— update within existing ranges without editing the config file (this is whatnpm updatedoes)--compatible— only semver-compatible updates--recursive— across all workspace members
Filters select by alias in the config file, not real package name, and take
wildcards and ! negation:
deno update --latest "@std/*" "!@std/fmt*"
deno outdated --update @std/fmt@^1.0.2deno list
--depth <n>— tree depth (0= direct dependencies only)--prod/--dev— restrict to one dependency set--recursive— include all workspace members
deno info walks the module graph from an entrypoint; deno list reports what
the project declares.
dx
dx <pkg> runs a package binary without installing it — npx / bunx /
pnpm dlx / yarn dlx. A separate binary shipped alongside Deno, aliasing
deno x, and absent from the top-level deno --help. Runs with the sandbox
disabled.
Toolchain
| Command | Replaces | Notes |
|---|---|---|
deno fmt |
prettier | --check for CI, --unstable-component for Vue/Svelte/Astro |
deno lint |
eslint | --fix, --rules to list, --json |
deno test |
jest, vitest, mocha | --watch, --parallel, --coverage[=dir] |
deno check <file> |
tsc --noEmit | --all includes remote and npm code |
deno bench |
tinybench et al | discovers *_bench.ts / *.bench.ts |
deno coverage |
nyc, c8 | reads --coverage output; --lcov, --html |
deno compile |
pkg, nexe | --target cross-compiles |
deno doc |
typedoc | --html for a site, --json for data |
deno info |
— | module graph, cache locations |
deno clean |
— | clear the module cache |
deno fmt handles JS, TS, JSON(C), Markdown, and Jupyter notebooks; HTML, CSS,
SCSS, LESS, YAML, Svelte, Vue, Astro, and Angular sit behind unstable options.
deno test discovers {*_,*.,}test.{js,mjs,ts,mts,jsx,tsx} and
**/__tests__/**. --coverage-threshold=<pct> fails below a coverage
percentage.
Suppress with // deno-lint-ignore <rule>, // deno-lint-ignore-file,
// deno-fmt-ignore, // deno-fmt-ignore-file.
deno check --doc also checks JSDoc code blocks; --doc-only checks only JSDoc
and Markdown blocks — a good way to keep documentation examples honest.
Project setup
| Command | Result |
|---|---|
deno init <dir> |
Script, test, and deno.json |
deno init --empty <dir> |
Just main.ts and deno.json |
deno init --lib <dir> |
Library laid out for JSR publishing |
deno create <pkg> <dir> |
Scaffold from a package initializer |
deno create is the npm create / yarn create equivalent and covers that
whole ecosystem: deno create vite, deno create astro, and so on. Unprefixed
names are treated as npm packages; --jsr selects JSR, and -y bypasses the
prompt and runs with full permissions.
Publishing
| Command | Purpose |
|---|---|
deno publish |
Publish to JSR |
deno pack |
Build an npm-compatible tarball |
deno bump-version <increment> |
Bump the version in the config file |
deno publish requires name, version, exports in deno.json. Flags:
--dry-run, --allow-dirty, --allow-slow-types, --set-version, --token.
Provenance is on by default in GitHub Actions, publicly linking the package to
the build that produced it; --no-provenance disables it.
deno bump-version takes major, minor, patch, premajor, preminor,
prepatch, prerelease. At a workspace root it applies to every member and
rewrites jsr: references in the root import map. With no increment it derives
per-package bumps from conventional commits since the last tag and prepends a
release note to Releases.md.
deno pack flags: --dry-run, --output, --set-version, --ignore,
--no-source-maps, --allow-dirty.
Permissions
Applies to run, serve, test, bench, compile, and eval.
| Flag | Short | Grants |
|---|---|---|
--allow-read[=<path>...] |
-R |
filesystem read |
--allow-write[=<path>...] |
-W |
filesystem write |
--allow-net[=<host>...] |
-N |
network |
--allow-env[=<var>...] |
-E |
environment variables |
--allow-sys[=<api>...] |
-S |
OS information |
--allow-import[=<host>...] |
-I |
imports from remote hosts |
--allow-run[=<bin>...] |
— | subprocesses |
--allow-ffi[=<path>...] |
— | native libraries (unstable) |
--allow-all |
-A |
everything |
Every --allow-* has a matching --deny-*, and deny always wins.
--allow-net scopes take ports (example.com:443) and Unix sockets
(unix:/var/run/docker.sock). --allow-import defaults to a fixed allowlist —
jsr.io, esm.sh, cdn.jsdelivr.net, and a few others — not to nothing.
Environment variables
| Variable | Effect |
|---|---|
DENO_DIR |
Cache directory |
DENO_INSTALL_ROOT |
Where deno install -g writes (default $HOME/.deno) |
DENO_CONDITIONS |
Extra export conditions for npm resolution |
DENO_JOBS |
Worker count for --parallel |
DENO_CERT |
Additional CA certificates |
deno --help lists the full set with descriptions.