From d5d0fdca28bb47e8617937e941027b89891eaccd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartek=20Iwa=C5=84czuk?= Date: Wed, 8 Apr 2026 08:21:41 +0200 Subject: [PATCH 1/2] docs: document minimumDependencyAge deno.json setting Adds documentation for the minimumDependencyAge configuration option, which protects against supply chain attacks by requiring dependencies to have existed for a minimum age before installation. Closes #3017 Co-Authored-By: Claude Opus 4.6 (1M context) --- runtime/fundamentals/configuration.md | 43 +++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/runtime/fundamentals/configuration.md b/runtime/fundamentals/configuration.md index 679a48c22..b3bbebdbd 100644 --- a/runtime/fundamentals/configuration.md +++ b/runtime/fundamentals/configuration.md @@ -300,6 +300,49 @@ Deno uses lockfile by default, you can disable it with following configuration: } ``` +## Minimum dependency age + +:::caution Unstable feature + +This feature is unstable and requires the `--unstable-npm-lazy-caching` flag or +can be configured directly in `deno.json`. + +::: + +The `minimumDependencyAge` field specifies the minimum age a dependency must have +before Deno will install it. This is a supply chain security measure that +protects against recently published malicious packages by ensuring only +dependencies that have existed for a specified period are allowed. + +The value can be specified as a number of minutes, an +[ISO 8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations), or an +[RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) timestamp: + +```json title="deno.json" +{ + // Number of minutes (e.g. 120 = 2 hours) + "minimumDependencyAge": 120 +} +``` + +```json title="deno.json" +{ + // ISO 8601 duration (e.g. P2D = 2 days) + "minimumDependencyAge": "P2D" +} +``` + +```json title="deno.json" +{ + // RFC 3339 absolute cutoff date + "minimumDependencyAge": "2025-09-16" +} +``` + +This setting can be overridden on the command line with +`--minimum-dependency-age=`, or disabled with +`--minimum-dependency-age=0`. + ## Node modules directory By default Deno uses a local `node_modules` directory if you have a From a6c1443a57ab78635e202115704b42fc918ebaf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartek=20Iwa=C5=84czuk?= Date: Wed, 8 Apr 2026 08:21:53 +0200 Subject: [PATCH 2/2] docs: add tsconfig.json and jsconfig.json support section to TypeScript page Closes #2666. Documents tsconfig.json compatibility on the TypeScript fundamentals page, including auto-detection, supported fields, precedence rules, jsconfig.json support (since Deno 2.1), and a practical example. Co-Authored-By: Claude Opus 4.6 (1M context) --- runtime/fundamentals/typescript.md | 81 ++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) diff --git a/runtime/fundamentals/typescript.md b/runtime/fundamentals/typescript.md index 48a2ffee1..6a9c8defb 100644 --- a/runtime/fundamentals/typescript.md +++ b/runtime/fundamentals/typescript.md @@ -264,6 +264,87 @@ To specify the library files to use in a TypeScript file, you can use /// ``` +## Configuring TypeScript with `tsconfig.json` {#tsconfig} + +While Deno uses `deno.json` for TypeScript configuration by default, it also +supports `tsconfig.json` files for compatibility with existing Node.js and +TypeScript projects. This makes it easier to adopt Deno incrementally without +rewriting your TypeScript configuration. + +### Auto-detection + +Each workspace directory containing a `deno.json` or `package.json` is probed +for a `tsconfig.json`. If one exists, Deno will automatically use it for type +checking and the language server — no extra flags needed. + +Since Deno 2.1, `jsconfig.json` files are also auto-detected when a +`package.json` is present. This is useful for JavaScript-only projects that rely +on `jsconfig.json` for editor and type-checking configuration. + +### Supported fields + +Deno supports the following `tsconfig.json` fields: + +```json title="tsconfig.json" +{ + "extends": "...", + "files": ["..."], + "include": ["..."], + "exclude": ["..."], + "references": [ + { "path": "..." } + ], + "compilerOptions": { + "...": "..." + } +} +``` + +Except for `compilerOptions`, these fields (`files`, `include`, `exclude`, +`references`, `extends`) cannot be specified in `deno.json`, so you may need a +`tsconfig.json` when you require that level of granularity. + +### Precedence rules + +When both `deno.json` and `tsconfig.json` are present, the following precedence +rules apply: + +- A parent `deno.json` with `compilerOptions` takes precedence over any + `tsconfig.json`. +- Among tsconfig references, a more specific path (e.g., `foo/bar/tsconfig.json`) + takes precedence over a less specific one (e.g., `foo/tsconfig.json`). + +### Example: Using an existing `tsconfig.json` + +If you have a Node.js project with a `tsconfig.json`: + +```json title="tsconfig.json" +{ + "compilerOptions": { + "strict": true, + "jsx": "react-jsx", + "lib": ["dom", "esnext"], + "paths": { + "@/*": ["./src/*"] + } + }, + "include": ["src/**/*"] +} +``` + +Deno will automatically pick up this configuration when running `deno check` or +using the Deno language server — no `deno.json` needed. If you later add a +`deno.json` with its own `compilerOptions`, those will take precedence. + +:::tip + +For Deno-first projects, it's recommended to use the `compilerOptions` field in +`deno.json` instead of a separate `tsconfig.json`. See the +[configuring TypeScript](/runtime/reference/ts_config_migration/) reference for a +full list of supported compiler options and their defaults. + +::: + ## Augmenting global types Deno supports ambient or global types in TypeScript. This is useful when