[codex] docs: add minimumDependencyAge configuration docs

[abhijeetnardele24-hash]

Summary

• document the minimumDependencyAge deno.json setting in the configuration guide
• explain the supported value formats using the repo's existing CLI reference wording
• add a short example showing a two-day dependency age policy

Closes #3017.

Validation

• deno fmt runtime/fundamentals/configuration.md could not be run because deno is not installed in this environment

[lunadogbot]

Thanks for adding this. A couple of blockers before this can land:\n\n- This is a substantive content change to , but the page frontmatter still has . Please bump it with this change.\n- Current Installs dependencies either in the local project or globally to a bin directory.

Local installation

Add dependencies to the local project's configuration (deno.json / package.json) and installs them
in the package cache. If no dependency is specified, installs all dependencies listed in the config file.
If the --entrypoint flag is passed, installs the dependencies of the specified entrypoint(s).

deno install
deno install jsr:@std/bytes
deno install npm:chalk
deno install --entrypoint entry1.ts entry2.ts

Global installation

If the --global flag is set, installs a script as an executable in the installation root's bin directory.

deno install --global --allow-net --allow-read jsr:@std/http/file-server
deno install -g https://examples.deno.land/color-logging.ts

To change the executable name, use -n/--name:
deno install -g --allow-net --allow-read -n serve jsr:@std/http/file-server

The executable name is inferred by default:

• Attempt to take the file stem of the URL path. The above example would
  become file_server.
• If the file stem is something generic like main, mod, index or cli,
  and the path has no parent, take the file name of the parent path. Otherwise
  settle with the generic name.
• If the resulting name has an @... suffix, strip it.

To change the installation root, use --root:
deno install -g --allow-net --allow-read --root /usr/local jsr:@std/http/file-server

The installation root is determined, in order of precedence:

• --root option
• DENO_INSTALL_ROOT environment variable
• $HOME/.deno

These must be added to the path manually if required.

Usage: deno install [OPTIONS] [cmd]... [-- [SCRIPT_ARG]...]

Arguments:
[cmd]...
[SCRIPT_ARG]... Script arg

Options:
--allow-scripts[=...] Allow running npm lifecycle scripts for the given packages
Note: Scripts will only be executed when using a node_modules directory (--node-modules-dir)
--cert Load certificate authority from PEM encoded file
--compile Install the script as a compiled executable
--conditions Use this argument to specify custom conditions for npm package exports. You can also use DENO_CONDITIONS env var.

                                                     Docs: https://docs.deno.com/go/conditional-exports

-c, --config Configure different aspects of deno including TypeScript, linting, and code formatting.
Typically the configuration file will be called deno.json or deno.jsonc and
automatically detected; in that case this flag is not necessary.
Docs: https://docs.deno.com/go/config
-D, --dev Add the package as a dev dependency. Note: This only applies when adding to a package.json file.
-e, --entrypoint Install dependents of the specified entrypoint(s)
--env-file[=] Load environment variables from local file
Only the first environment variable with a given key is used.
Existing process environment variables are not overwritten, so if variables with the same names already exist in the environment, their values will be preserved.
Where multiple declarations for the same environment variable exist in your .env file, the first one encountered is applied. This is determined by the order of the files you pass as arguments.
-f, --force Forcefully overwrite existing installation
-g, --global Install a package or script as a globally available executable
-h, --help[=] [possible values: unstable, full]
--jsr assume unprefixed package names are jsr packages
--location Value of globalThis.location used by some web APIs
--lockfile-only Install only updating the lockfile
--minimum-dependency-age (Unstable) The age in minutes, ISO-8601 duration or RFC3339 absolute timestamp (e.g. '120' for two hours, 'P2D' for two days, '2025-09-16' for cutoff date, '2025-09-16T12:00:00+00:00' for cutoff time, '0' to disable)
-n, --name Executable file name
--no-config Disable automatic loading of the configuration file
--npm assume unprefixed package names are npm packages
--preload A list of files that will be executed before the main module
-q, --quiet Suppress diagnostic output
--require A list of CommonJS modules that will be executed before the main module
--root Installation root
--save-exact Save exact version without the caret (^)
--seed Set the random number generator seed
--unstable The --unstable flag has been deprecated. Use granular --unstable-* flags instead
To view the list of individual unstable feature flags, run this command again with --help=unstable
--v8-flags[=<V8_FLAGS>...] To see a list of all available flags use --v8-flags=--help
Flags can also be set via the DENO_V8_FLAGS environment variable.
Any flags set with this flag are appended after the DENO_V8_FLAGS environment variable

Type checking options:
--check[=<CHECK_TYPE>] Set type-checking behavior. This subcommand type-checks local modules by default, so adding --check is redundant
If the value of "all" is supplied, remote modules will be included.
Alternatively, the 'deno check' subcommand can be used
--no-check[=<NO_CHECK_TYPE>] Skip type-checking. If the value of "remote" is supplied, diagnostic errors from remote modules will be ignored

Debugging options:
--inspect[=<HOST_PORT>] Activate inspector on host:port [default: 127.0.0.1:9229]. Host and port are optional. Using port 0 will assign a random free port.
--inspect-brk[=<HOST_PORT>] Activate inspector on host:port, wait for debugger to connect and break at the start of user script
--inspect-wait[=<HOST_PORT>] Activate inspector on host:port and wait for debugger to connect before running user code

Dependency management options:
--cached-only Require that remote dependencies are already cached
--frozen[=] Error out if lockfile is out of date [possible values: true, false]
--import-map Load import map file from local file or remote URL
Docs: https://docs.deno.com/runtime/manual/basics/import_maps
--lock [] Check the specified lock file. (If value is not provided, defaults to "./deno.lock")
--no-lock Disable auto discovery of the lock file
--no-npm Do not resolve npm modules
--no-remote Do not resolve remote modules
--node-modules-dir[=] Sets the node modules management mode for npm packages
-r, --reload[=<CACHE_BLOCKLIST>...] Reload source code cache (recompile TypeScript)
no value Reload everything
jsr:@std/http/file-server,jsr:@std/assert/assert-equals Reloads specific modules
npm: Reload all npm modules
npm:chalk Reload specific npm module
--vendor[=] Toggles local vendor folder usage for remote modules and a node_modules folder for npm packages [possible values: true, false]

Permission options:
Docs: https://docs.deno.com/go/permissions

-A, --allow-all Allow all permissions.
-P, --permission-set[=] Loads the permission set from the config file.
--no-prompt Always throw if required permission wasn't passed.
Can also be set via the DENO_NO_PROMPT environment variable.
-R, --allow-read[=...] Allow file system read access. Optionally specify allowed paths.
--allow-read | --allow-read="/etc,/var/log.txt"
-W, --allow-write[=...] Allow file system write access. Optionally specify allowed paths.
--allow-write | --allow-write="/etc,/var/log.txt"
-I, --allow-import[=<IP_OR_HOSTNAME>...] Allow importing from remote hosts. Optionally specify allowed IP addresses and host names, with ports as necessary.
Default value: deno.land:443,jsr.io:443,esm.sh:443,raw.esm.sh:443,cdn.jsdelivr.net:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443
--allow-import | --allow-import="example.com,github.com"
-N, --allow-net[=<IP_OR_HOSTNAME>...] Allow network access. Optionally specify allowed IP addresses and host names, with ports as necessary.
--allow-net | --allow-net="localhost:8080,deno.land"
-E, --allow-env[=<VARIABLE_NAME>...] Allow access to environment variables. Optionally specify accessible environment variables.
--allow-env | --allow-env="PORT,HOME,PATH"
-S, --allow-sys[=<API_NAME>...] Allow access to OS information. Optionally allow specific APIs by function name.
--allow-sys | --allow-sys="systemMemoryInfo,osRelease"
--allow-run[=<PROGRAM_NAME>...] Allow running subprocesses. Optionally specify allowed runnable program names.
--allow-run | --allow-run="whoami,ps"
--allow-ffi[=...] (Unstable) Allow loading dynamic libraries. Optionally specify allowed directories or files.
--allow-ffi | --allow-ffi="./libfoo.so"
--deny-read[=...] Deny file system read access. Optionally specify denied paths.
--deny-read | --deny-read="/etc,/var/log.txt"
--deny-write[=...] Deny file system write access. Optionally specify denied paths.
--deny-write | --deny-write="/etc,/var/log.txt"
--deny-net[=<IP_OR_HOSTNAME>...] Deny network access. Optionally specify defined IP addresses and host names, with ports as necessary.
--deny-net | --deny-net="localhost:8080,deno.land"
--deny-env[=<VARIABLE_NAME>...] Deny access to environment variables. Optionally specify inacessible environment variables.
--deny-env | --deny-env="PORT,HOME,PATH"
--deny-sys[=<API_NAME>...] Deny access to OS information. Optionally deny specific APIs by function name.
--deny-sys | --deny-sys="systemMemoryInfo,osRelease"
--deny-run[=<PROGRAM_NAME>...] Deny running subprocesses. Optionally specify denied runnable program names.
--deny-run | --deny-run="whoami,ps"
--deny-ffi[=...] (Unstable) Deny loading dynamic libraries. Optionally specify denied directories or files.
--deny-ffi | --deny-ffi="./libfoo.so"
--deny-import[=<IP_OR_HOSTNAME>...] Deny importing from remote hosts. Optionally specify denied IP addresses and host names, with ports as necessary.
--deny-import | --deny-import="example.com:443,github.com:443"
--ignore-env[=<VARIABLE_NAME>...] Ignore access to environment variables returning undefined. Optionally specify ignored environment variables.
--ignore-env | --ignore-env="PORT,HOME,PATH"
--ignore-read[=...] Ignore file system read access with a NotFound error. Optionally specify ignored paths.
--ignore-read | --ignore-read="/etc,/var/log.txt"
DENO_TRACE_PERMISSIONS Environmental variable to enable stack traces in permission prompts.
DENO_TRACE_PERMISSIONS=1 deno run main.ts
DENO_AUDIT_PERMISSIONS Environmental variable to audit all permissions accesses. Set to a file path for JSONL output, or "otel" to emit as OpenTelemetry log events via the configured OTel exporter.
DENO_AUDIT_PERMISSIONS=./audit.jsonl deno run main.ts
DENO_AUDIT_PERMISSIONS=otel deno run main.ts on stable Deno 2.7.14 still describes as . The new section should call out the unstable status so the docs match current stable behavior.

[lunadogbot]

Correction to my review body above (the shell expanded the inline command text):

Thanks for adding this. A couple of blockers before this can land:

• This is a substantive content change to runtime/fundamentals/configuration.md, but the page frontmatter still has last_modified: 2026-03-09. Please bump it with this change.
• Current deno help install on stable Deno 2.7.14 still describes --minimum-dependency-age as (Unstable) The age in minutes, ISO-8601 duration or RFC3339 absolute timestamp .... The new section should call out the unstable status so the docs match current stable behavior.

[bartlomieju]

Thanks so much for the contribution, @abhijeetnardele24-hash! The minimumDependencyAge documentation is now covered as part of the Deno 2.8 docs update in #3100, which adds a dedicated section under the supply-chain security guide (including all value formats, the --minimum-dependency-age CLI flag, and the .npmrc equivalent). Closing this in favor of #3100 — really appreciate you taking the time to document this!