JSR

What JSR is

JSR is a package registry for JavaScript and TypeScript, distributing packages as web-standard ECMAScript modules. It accepts TypeScript source, then generates declaration files and documentation and transpiles code for compatibility across runtimes. JSR says its packages work with Node.js, Deno, Bun, browsers and more. Developers can add packages through Deno, pnpm, Yarn, npm or Bun tooling.

The registry creates documentation from source code and JSDoc comments, and provides package scores that can be used to filter package searches. To publish from GitHub Actions, developers can use OIDC without setting up secrets or authentication. Other CI providers can publish with a personal access token, but that method does not create provenance attestations. GitHub Actions publishing can produce SLSA provenance statements recorded in the Sigstore Rekor transparency log.

JSR is open source under the MIT License. Published versions are immutable and generally cannot be changed or deleted. Its listed Free plan costs nothing; quotas apply to scopes and package versions, and JSR says users can request quota increases by email. The Deno company operates JSR and pays its hosting bills; the service is designed to remain free to use.

Who it suits

JSR suits JavaScript and TypeScript developers who want to publish packages for several runtimes and use familiar package manager tooling. It may also suit teams that want generated documentation, package scoring or provenance from GitHub Actions.

Limits

The Free plan costs nothing, with quotas on scopes and package versions. Packages are limited to 20 MB; quota increases can be requested by email.

Getting started

1. Visit https://jsr.io/.
2. Choose a package manager supported by JSR: Deno, pnpm, Yarn, npm or Bun.
3. For GitHub Actions publishing, use OIDC without configuring secrets or authentication.
4. For another CI provider, publish with a personal access token.

Verdict

Choose JSR if you want a free registry for JavaScript or TypeScript packages distributed across runtimes, with generated documentation and several publishing options. Look elsewhere if you need private packages, packages above 20 MB or mutable published versions.