denoland/deno · error · AnyError

You do not have write permission to {}

Error message

You do not have write permission to {}

What it means

Before replacing the binary, Deno checks write access to the output executable path (falling back to the current exe's metadata if the output does not exist yet). If the file's permission bits mark it read-only, the upgrade aborts with this message naming the path. It is a filesystem permission guard, distinct from the root-ownership case handled separately.

Source

Thrown at cli/tools/upgrade.rs:2017

}

fn set_exe_permissions(
  current_exe_path: &Path,
  output_exe_path: &Path,
) -> Result<std::fs::Permissions, AnyError> {
  let Ok(metadata) = fs::metadata(output_exe_path) else {
    let metadata = fs::metadata(current_exe_path).with_context(|| {
      format!(
        "failed to get metadata of the current executable at '{}'",
        current_exe_path.display()
      )
    })?;
    return Ok(metadata.permissions());
  };

  let permissions = metadata.permissions();
  if permissions.readonly() {
    bail!(
      "You do not have write permission to {}",
      output_exe_path.display()
    );
  }
  #[cfg(unix)]
  if std::os::unix::fs::MetadataExt::uid(&metadata) == 0
    && !nix::unistd::Uid::effective().is_root()
  {
    bail!(
      concat!(
        "You don't have write permission to {} because it's owned by root.\n",
        "Consider updating deno through your package manager if its installed from it.\n",
        "Otherwise run `deno upgrade` as root.",
      ),
      output_exe_path.display()
    );
  }
  Ok(permissions)

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Make the binary writable: `chmod u+w <path>` (as the message's path), then re-run `deno upgrade`.
2. If it is system/package-manager-managed, update through that package manager instead of `deno upgrade`.
3. Point the upgrade at a writable location: `deno upgrade --output <writable-dir>/deno` and adjust PATH.
4. Remove immutable attributes if set (`chattr -i` on Linux).

Example fix

# before
deno upgrade  # You do not have write permission to /usr/local/bin/deno

# after
sudo chmod u+w /usr/local/bin/deno   # or: chattr -i /usr/local/bin/deno
deno upgrade

deno_bin="$(command -v deno)"
[ -w "$deno_bin" ] || { echo "deno not writable — chmod or use --output"; exit 1; }
deno upgrade

deno upgrade 2>err.log || { grep -q 'write permission' err.log && chmod u+w "$(command -v deno)"; }

When it happens

Trigger: `deno upgrade` where the deno binary (or the configured `--output` path) has a read-only bit set — e.g. chmod 444/555, an immutable file attribute, or an output path on a read-only mount. Checked via `permissions.readonly()` at cli/tools/upgrade.rs:2017.

Common situations: Hardened system installs where binaries are deliberately read-only; files made immutable by admin tooling; upgrading from a system-managed location mounted read-only; custom `--output` pointing at a locked path.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• BenchContext::end() has already been invoked
• failed to open cache db at {}
• You don't have write permission to {} because it's owned by
• '{}' is writable or readable by other users
• Native addon cache directory '{}' is not private

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/9ab6f9a76affb5eb. Report an issue: GitHub.