Dependencies

Notable workspace and external dependencies. The full list lives in the top-level Cargo.toml [workspace.dependencies] block plus per-crate Cargo.toml files.

Workspace deno_* deps

The repo pins specific versions of several deno_* crates that are not member crates (they're maintained in separate repos under denoland/):

Crate	Pin	What it does
deno_ast	=0.53.1	TypeScript / JavaScript / JSX parser + transpiler
deno_doc	=0.198.0	Documentation generator (used by deno doc and JSR validation)
deno_error	=0.7.1	Error class machinery for ops
deno_graph	=0.107.2	Module graph builder used by cli/graph_util.rs
deno_lint	=0.84.0	Lint engine
deno_media_type	=0.4.0	MIME type detection for source files
deno_native_certs	0.3.0	OS-trusted root certs
deno_path_util	=0.6.4	Path helpers (URL ↔ filesystem)
deno_semver	=0.9.1	semver parser tailored for npm
deno_task_shell	=0.29.0	Cross-platform shell for deno task

Bumping any of these is a routine but careful operation — they often have breaking changes between minor versions and cargo update won't pick the right pin without help.

Major external deps

Runtime / V8

• v8 — the Rust binding to V8. The version pin here drives most of the build's complexity (V8 is huge to compile from source).
• tokio — the async runtime.
• hyper — HTTP server primitives, used by ext/http.
• reqwest / hyper-util — HTTP client used by cli/http_util.rs and ext/fetch.
• rustls — TLS implementation used by both server and client paths.

Parsing / serialization

• serde + serde_json — universal serialization.
• swc — JavaScript/TypeScript parser+transpiler stack used through deno_ast.
• url — URL parsing.
• clap — CLI flag parser used by cli/args/flags.rs.

Filesystem / OS

• notify — cross-platform file watcher; backs Deno.watchFs.
• sys_traits — abstraction over std::fs/std::env allowing in-memory testing.
• encoding_rs — character encodings.

Crypto

• ring / rsa / ed25519-dalek / p256 etc — the various algorithms used by ext/crypto. The provider crate is libs/crypto.
• openssl — used by ext/node_crypto for Node-shaped APIs requiring OpenSSL semantics.
• aes-gcm, sha2, hmac, pbkdf2 etc — RustCrypto suite.

npm

• tar, flate2 — for extracting npm tarballs.
• async-compression — streaming compression for fetch + zlib.

Macros

• thiserror — derive macro for error enums.
• proc-macro2 + quote + syn — used by libs/ops (the op2 macro implementation).

Misc

• ipnetwork — IP/CIDR parsing for net permissions.
• fqdn — FQDN parsing.
• chrono — date/time, used in audit logging.
• indexmap — order-preserving map.
• parking_lot — fast mutex.
• once_cell — once-init types.
• capacity_builder — string builder used in permission descriptors.
• tower-lsp — LSP framework used by cli/lsp/mod.rs.
• prost — protobuf for the OpenTelemetry exporter.

Web platform deps

A handful of crates exist specifically for web platform conformance:

• urlpattern — backs URLPattern.
• simdutf — fast UTF-8 validation/encoding (used in base64 and other hot paths).
• aho-corasick / memchr — fast substring search used in formatters and parsers.

Updating

# A single dep
cargo update -p <crate>

# All deps
cargo update

# Latest compatible (requires cargo-edit)
cargo upgrade

# Show outdated (requires cargo-outdated)
cargo outdated

Several deps have explicit =x.y.z pins in Cargo.toml [workspace.dependencies] because the API is unstable. Don't loosen those pins without confirming nothing breaks.

Build prerequisites

The project's external system dependencies are documented in .github/CONTRIBUTING.md:

• Rust (pinned by rust-toolchain.toml)
• cmake 3.x
• protobuf (protoc)
• Python 3 (used by V8 build)
• C/C++ toolchain
• Git submodules (--recurse-submodules)

See Getting started for the per-OS install commands.