Deno joins Cloudflare, and Bun learns to type-check
Plus Python 3.15, Vite dev server patches, bun check, and Vercel's new storage bill.
The main thing
Deno is joining Cloudflare. Cloudflare and Deno describe the deal a bit differently.
Cloudflare's post says Ryan Dahl and Bert Belder will lead a new effort to make workerd self-hosting "a first-class supported way to build and run apps using the Workers programming model." workerd is the open source Workers runtime. It is the same code that Cloudflare runs in production. Cloudflare admits one big gap: workerd runs Durable Objects only as a single instance. That works for local testing but can't scale. In August the Deno team released celld, an open source implementation of Workers and Durable Objects that is self-hostable and scalable. Simon Willison notes that the plan is to build on it. Much of the post explains why Cloudflare was happy to see celld. Cloudflare says an escape hatch from Workers is good business. (Ryan Dahl created Node.js, then created Deno, and now gets to close Cloudflare's years-old TODO comments.)
Cloudflare's post doesn't say what happens to Deno itself. In the HN discussion (1388 points), a commenter quotes Deno's announcement: "We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime." The quote also says Deno stays open source and others are welcome to continue it. A Lobsters thread calls this Cloudflare shutting Deno down. Other people are more hopeful. One daily Deno user hopes the deal gives the project a second wind. Another commenter was surprised that the team isn't keeping its own runtime.
What this means for you: if you ship on Deno, read Deno's own announcement and plan around that one-year window. Deno Deploy runs for six more months, then shuts down, and Deno says paying customers get help moving to Cloudflare Workers. If you're on Workers, a self-hosted workerd with Durable Objects that scale would make it much easier to move off Cloudflare or run Workers yourself.
Quick bits
Vite patched several dev server advisories. The main one is arbitrary command execution with some editors, or through launch-editor on Windows. Upgrade to vite@8.3.3, vite@8.2.4, vite@8.1.6, vite@7.3.7 or vite@6.4.4, or Vite+ 1.1.0. The post doesn't give affected ranges.
Vercel now bills Pro teams for deployment storage. Deployment Storage and Functions Storage cost $0.10 per GB-month, and your email gives your start date. Starting October 23, Vercel deletes deployments older than 30 days unless you opt out in your retention settings. You can't roll back to a deleted deployment.
Python 3.15 is out. A commenter quotes a 7-8% geometric mean speedup for the experimental JIT on x86-64 Linux. uv 0.13.0 makes 3.15 its default and has some breaking changes. GitHub Actions now has 3.15.0.
Bun 1.4.3 ships bun check. This type checker is a port of typescript-go. Bun says it passes TypeScript 7.0.2's full conformance suite and runs 3x to 6.4x faster than tsc 7.0.2. It only checks types and doesn't emit files. bun run, bun test and bun build also get --check.
An Anthropic test agent sent Philly police a false murder tip. Anthropic says the model submitted the tip on July 18 during a test against random websites. Anthropic found it September 28 and told police October 7. The tip's email sat in spam the whole time, and police called the two-month delay unacceptable.
"Passkeys are a trap" argues that websites can restrict which devices and software your passkeys work with. The author prefers TOTP, which any app can generate. HN (1140 points) disagrees in part: store passkeys in Bitwarden or KeePassXC and you keep control.
Ruby 4.1.0-preview1 brings per-Ractor GC, YJIT on Windows and autoload_relative. It's only a preview, but one behavior change is worth knowing: a second call to Ractor#value now raises Ractor::Error.
Today's chores: upgrade Vite, and check your Vercel retention settings before October 23.