Cannot deno publish with "vendor": true when importing remote https specifier

[rojvv]

Version: Deno 2.0.0-rc.2+af2d992

[dsherret]

@rojvv I can't reproduce. Can you provide a reproduction? What error message do you get? Does it happen only when publishing and not a dry run?

[dsherret]

Going to close because can't reproduce.

[rojvv]

Hi, @dsherret.

I have prepared a minimal reproducible example, please re-open the issue:

https://github.com/rojvv/deno-25640

Apologies for the unexpectedly long delay.

[dsherret]

What error message does that give?

[rojvv]

Checking for slow types in the public API...
error[invalid-external-import]: invalid import to a non-JSR 'https' specifier
 --> /Users/roj/Projects/deno-25640/mod.ts:1:24
  | 
1 | import { concat } from "https://raw.githubusercontent.com/denoland/std/bf0ad522e873866764632b84f0e8460855f0d7e6/bytes/concat.ts";
  |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ the specifier
  | 
  = hint: replace this import with one from jsr or npm, or vendor the dependency into your package

  info: the import was resolved to 'https://raw.githubusercontent.com/denoland/std/bf0ad522e873866764632b84f0e8460855f0d7e6/bytes/concat.ts'
  info: this specifier is not allowed to be imported on jsr
  info: jsr only supports importing `jsr:`, `npm:`, and `data:` specifiers
  docs: https://jsr.io/go/invalid-external-import

error: Found 1 problem

[dsherret]

That's expected. You can't publish a package that relies on a remote https module (the "vendor": true feature only creates a local cache folder that's easily modifiable, but it's still treated as a remote specifier)

[rojvv]

@dsherret Why was this possible before 2.0?

[dsherret]

It wasn't with "vendor": true. With deno vendor it was sometimes possible because that updates the import map (which was not as much of a reliable way of vendoring for apps).