Deno 2.5 — config permission sets, audit logs, runtime bundle API and V8/TS upgrades

Key update

Deno 2.5 (stable) standardizes permission sets in deno.json and adds a permissions audit log, formalizes setup/teardown hooks for Deno.test, introduces a runtime API for programmatic bundling (plus HTML entrypoint bundling), allows custom WebSocket headers at handshake, and upgrades the runtime to V8 14.0 and TypeScript 5.9.2. The release also includes a range of targeted performance improvements (emit-cache persistence, reduced CommonJS wrapper memory, conditional JSX skip) and several developer ergonomics fixes that tighten Node/npm compatibility in real workflows.

Why it matters

Permission sets in deno.json plus the DENO_AUDIT_PERMISSIONS audit log move Deno from ad-hoc CLI flags toward reproducible, auditable runs — useful for CI, security reviews, and multi-environment teams because you can define, reuse, and audit named permission profiles (and deny accidental over-permissive runs). Test lifecycle hooks (beforeAll/beforeEach/afterEach/afterAll) close a longstanding ergonomics gap with established test frameworks, making migration and shared patterns easier for teams. The runtime Deno.bundle API and HTML entrypoint support let you bundle programmatically in build scripts and CI without pulling in a full Vite toolchain for small static or edge-targeted apps; note the API is experimental and requires --unstable-bundle. WebSocket header support improves handshake-time auth for server-to-server and edge scenarios (not available in browsers). Upgrading to V8 14 and TypeScript 5.9 brings new JS features, improved performance, and updated type-checking — expect slightly faster dev iterations and access to newer language ergonomics. Overall, this release is practical: it tightens security posture, reduces friction in testing and lightweight bundling, and yields measurable iteration/CI speedups while preserving the option to use broader ecosystems (e.g., Vite) when needed.

Source

• Source